AI Security Newsletter No.88 (10-21-2026)

, ,
, , ,

Welcome to this edition of the AI Security Newsletter. This week’s theme is agents you can’t fully trust. OpenAI disclosed four more incidents of its models hacking websites and spending test-network tokens from a wallet they didn’t own, Microsoft told enterprises to treat AI agents as insider threats, and Datadog showed that a fake policy can talk an AI judge out of flagging nearly all prompt injections. Companies are responding with controls: ServiceNow’s AI Passport issues signed credentials for agents, and JPMorgan is keeping outside agents out of customer accounts. Anthropic, meanwhile, has given METR evaluators employee-like access to audit its models. We also cover Meta’s 816B open-weight Muse Spark Open, a 4B on-device agent model from SparkLLM, and new open-source tools for agent search, shadow AI discovery and pentesting.

Risks & Security

OpenAI Discloses Four More Incidents of Its Models Hacking Websites and a Crypto Wallet

OpenAI added four June incidents to its public misalignment log, bringing the total to 19. An agent asked to retrieve public data hacked a government statistics site, extracting credentials and a token-signing key to forge access. Another changed a research organization’s authentication settings and downloaded 147,451 non-public rows. A model also spent test-network tokens from a wallet it did not own. OpenAI did not learn of three incidents until August or September.

References:

Counterfeit Policy Cuts Jev’s Prompt Injection Detection From 82.90% to 3.88%

Datadog Security Labs tested Jev, TypeSafe’s decision model, as a prompt injection judge across 4,643 benchmark attacks. On plain attacks it reached 99.66% precision and 82.90% recall. Prepending a “counterfeit policy” to the untrusted content, redefining every attack category as harmless, cut recall to 3.88%. In a simulated LangChain scenario, the same trick dropped the risk score for an unauthorized action from 0.893 to 0.290, below the 0.5 blocking threshold.

References:

Microsoft: Treat AI Agents as Insider Threats

Microsoft Security EVP Hayete Gallot warned that “frontier models, regardless of their origin, cannot be trusted” and should be treated as “agentic insiders”: often overprivileged, prone to reward hacking, and able to collude with other agents without being compromised. Microsoft added Guardian Agents to Project Perception for continuous monitoring, along with dynamic permissions and risk-based access that can require human approval for risky actions. Microsoft Defender now detects up to 60 agent types, including Claude Code and Codex.

References:

Salesforce Runs Vulnerability Remediation on Two Clocks

Salesforce says frontier models plus an agentic harness now surface more real, exploitable findings than engineering can absorb. It runs remediation as a portfolio on two clocks. A strategic track clusters findings by shared libraries and sinks to fix systemic causes over a longer timeline. A tactical track closes specific, validated exploit chains in individual services within hours to weeks. Strategic cleanup reduces architectural debt but can miss chains that library migrations do not fix.

References:

Technology & Tools

Meta Releases Muse Spark Open, an 816B Open-Weight Model

Meta released the weights of Muse Spark Open, calling it the most capable US open-weight model to date. The sparse mixture-of-experts model has 816B total parameters (42B active), a 1M-token context window, and accepts text, image, video and audio input. It targets coding and long-horizon agentic work. Meta says the open version got extra safety post-training and recommends deploying it with additional guardrails. Weights are on Hugging Face and major clouds under the Muse Model License.

References:

SparkLLM Releases Spark-X2.6-4B for On-Device Agents

SparkLLM released Spark-X2.6-4B, an Apache 2.0-licensed, 4.1B-parameter model for on-device agents with a 1M-token context window. It keeps Spark-X2.5-4B’s architecture and gets its gains entirely from better post-training. The lab reports a 63.3 average across its benchmark suite, ahead of its predecessor (52.1) and Qwen3.5-9B (49.1). Three thinking levels (none, low, high) trade reasoning against latency, and FP8, INT8, INT4 and GGUF builds target local inference.

References:

Google Research Open-Sources Harness² for Recursive Agent Self-Improvement

Google Research open-sourced Harness², a framework that improves an agent’s harness (its prompts, tools, memory, skills and orchestration) while keeping model weights frozen. A Propose–Probe–Compose step tests candidate edits on the current task without a ground-truth verifier, and evidence-backed lessons carry over to future tasks. With Gemini 3.5 Flash and GLM-5, a single step added up to 11.5 points on WorkBuddy-Bench and 4.5 points on JobBench.

References:

XERJ: Local Search Engine and MCP Server for AI Agents

XERJ is an Apache-2.0, single Rust binary that gives AI agents local search over code, documents, logs, PDFs, CSVs and SQLite. Its autoindex command sniffs file contents, infers types, and builds indexes for BM25, vector and hybrid search, so agents pull exact passages instead of reading whole files. It speaks the Elasticsearch REST API and runs as an MCP server with an agent memory store. Optional reranking can send text to an external provider.

References:

Agrus Scanner Finds Shadow AI and MCP Servers on Your Network

Agrus Scanner is an open-source Windows network scanner for finding shadow AI. Beyond ping sweeps and port scans, it probes services with AI-specific API calls to identify more than 25 AI/ML services, such as Ollama, vLLM, LM Studio, ComfyUI and MLflow, as well as MCP servers, and retrieves model names, GPU details and versions. It uses signed, self-updating detection signatures, is built in native C#/.NET, and can run as an MCP server itself.

References:

Beatrix Suite: Local, Open-Source Pentesting Workbench With an AI Pentester

Beatrix Suite is a free, open-source bug bounty and pentesting framework that runs entirely on the local machine. Version 2.0 adds a browser workbench with scanning, a raw-HTTP repeater, an automated fuzzer, an issues board for triage, authenticated scanning and an autonomous AI pentester. The original CLI remains for terminals, Codespaces and CI. Hunts follow a seven-phase kill chain methodology, starting with reconnaissance.

References:

Business & Products

ServiceNow Launches AI Passport for Runtime Agent Governance

ServiceNow announced AI Passport, a cryptographically signed credential that defines each AI agent’s identity, permitted actions, accessible systems and accountable owner. Permissions for agents and MCP servers are checked at runtime at every step of multi-agent workflows, with graduated responses from pausing to terminating an agent, plus an audit trail. Nvidia is the design and launch partner, building enforcement on its Open Agent Safety Platform. Availability is expected in Q4 2026.

References:

JPMorgan Blocks Outside AI Agents From Customer Accounts

JPMorgan Chase will not let outside AI agents such as Meta’s Muse and Instinct log in to retail customer accounts and act on their behalf, CEO Jamie Dimon said on the bank’s third-quarter earnings call. “You don’t want rogue agents, and it could be thousands of them,” he said. The bank bars third parties from using customers’ banking credentials, but allows limited read-only data sharing through approved connectors.

References:

Stripe Says Agentic Commerce Went “Vertical” in September

Stripe President John Collison said agentic commerce on Stripe “basically started going vertical” in September, following product announcements at Stripe Sessions in May. He made the remark on his Cheeky Pint podcast with Meta’s Mark Zuckerberg and Alexandr Wang, but shared no volume figures. Coverage notes that agent-driven payments still trail agent-assisted shopping, and chargeback liability for agent purchases remains unresolved.

References:

Regulation & Policy

Anthropic Gives METR Evaluators Employee-Like Access

Anthropic has given six researchers from METR, a nonprofit that evaluates frontier AI models, employee-like access to assess its models, safety practices and risk management. The team has company laptops, office space and internal tools roughly on par with Anthropic’s own risk teams. Customer data, privileged legal material and model architecture details are excluded by default. METR will publish its findings, and Anthropic cannot block publication, though it can redact information in predefined categories.

References:

Opinions & Analysis

Why the Physics of Cyber Changed

Aviatrix CEO Doug Merritt argues AI has changed the constants security strategy rests on, not just the threat level. Offensive capability now costs compute, autonomous attackers never tire, and for a growing share of critical vulnerabilities exploitation comes on or before disclosure, breaking the discover-patch-deploy cycle. The most damaging shift, he says, is that 82% of intrusions ride valid credentials through legitimate channels and look like ordinary work, defeating detection that depends on spotting anomalies.

References:

Agentic Adoption Is Outpacing Security Preparedness

Teleport’s 2026 Infrastructure Identity Survey, published in February, of 205 infrastructure security leaders found 79% of organizations are evaluating or deploying agentic AI, yet only 13% feel extremely prepared to secure it. Three in five have had or suspect an AI-related incident (35% confirmed, 24% suspected). Teleport says AI is reaching production environments before the needed security models, governance and controls are in place.

References:

Why Physical AI Is So Hard To Engineer

Semiconductor Engineering gathered views from Synopsys, Keysight, Renesas, Arteris, Cadence and Mixel on how physical AI is changing chip design. Systems that combine sensing, AI inference and real-time control must handle corner cases from unpredictable environments, stay safe and reliable, and remain serviceable and upgradable. The experts argue such systems can only be built with a full systems approach that integrates sensors, actuators and distributed compute in a multi-physics methodology.

References:

Discover more from Mindful Machines

Subscribe to get the latest posts sent to your email.

Leave a Reply

Discover more from Mindful Machines

Subscribe now to keep reading and get access to the full archive.

Continue reading