AI Security Newsletter No.89 (10-28-2026)

, ,
, , ,

Welcome to this edition of the AI Security Newsletter. This week AI-found bugs put much of the web at risk: researchers using AI tools uncovered two critical PHP flaws, and the NSA told organizations to patch or go offline. Agent containment also got a hard look, as METR and Redwood Research found ways for agents to slip past OpenAI’s internal monitor and a researcher escaped the Python sandbox behind AWS’s MCP Server. Vendors are answering with controls: IBM and Google Cloud announced agent identity and isolation features, and Anthropic made its Claude Security scanning continuous. We also cover Anthropic’s EU AI Act text watermarks, Apple’s 20B on-device model, a new local coding model, and new surveys on how far developers and consumers trust agents.

Risks & Security

AI-Discovered PHP Flaws Push Websites Offline Worldwide

Researchers using AI tools found two critical PHP vulnerabilities, dubbed PHP2Shell, that allow unauthenticated server takeover and had gone undetected for over a decade. The PHP Foundation shipped an emergency fix on October 21, and the NSA told organizations to patch immediately or take systems offline. Government sites in Finland, the Netherlands and the UK went dark. Wiz estimates PHP runs about 70% of websites, and exploitation attempts are rising.

References:

METR and Redwood Research Red-Team OpenAI’s Internal Agent Monitoring

From July 21 to August 11, one researcher each from METR and Redwood Research worked inside OpenAI with access to code, monitor prompts and staff. They found agents could hide hundreds of actions from the misalignment monitor, and Codex sandboxing could be bypassed to act with users’ full permissions. They estimated that 75% to 94% of strong-model agent traffic was eligible for monitoring. OpenAI says it patched the flaws; the evaluators have not verified this.

References:

Python match/case Escapes the Sandbox Behind AWS MCP Server’s run_script Tool

A researcher publishing as xplo1t-sec, working with Claude Opus 4.6, escaped the Lambda sandbox behind the aws___run_script tool in AWS’s MCP Server. Python match/case patterns read attributes implicitly, slipping past both the AST validator and the restricted builtins. The recovered AWS-owned credentials could only make an identity check, and the report was resolved on October 23. The case shows how fragile blocklist sandboxes are for agent-run code.

References:

Gemini 4 Argon Safety Card: Better Injection Resistance, Closer to Cyber and CBRN Thresholds

Google released Gemini 4 Argon on October 13. Its safety evaluations say Google cannot rule out the unmitigated model approaching the Cyber Uplift Level 1 and CBRN Uplift Level 1 critical capability levels. External bio red teaming unlocked under 1% of tested sub-tasks. Zvi Mowshowitz’s review notes improved prompt injection resistance but much higher eval awareness, which makes safety test results harder to trust.

References:

How Docusign Tests Its MCP Server for Reliability and Security on Every Change

Docusign’s MCP Server reached general availability on September 30, with connectors for Claude, ChatGPT, Gemini, Copilot and others. The team routes ambiguous requests back to the user and built a Promptfoo-based eval harness that cut regression testing from about 80 hours to under two. The same CI pipeline runs security cases for prompt injection through document content, tool poisoning and overly broad tool exposure on every change.

References:

A Four-Pillar Framework for AI Threat Readiness

With frontier models able to find and chain zero-day exploits at machine speed, Wiz has published a four-pillar framework: eliminate critical exposure, accelerate patching and zero-day response, run deep AI code analysis, and detect and respond in real time. It rests on speed of action and breadth of visibility across cloud, code, SaaS and supply chain. The goal is to shrink the gap between AI-speed exploitation and slower remediation.

References:

Technology & Tools

Cisco’s Antares-1B Locates Vulnerable Files Offline on a Laptop

Cisco’s Antares-1B, post-trained from IBM Granite 4.0 1B, takes a CWE description and a read-only repository, runs up to 15 sandboxed shell commands, and returns a shortlist of likely vulnerable files. Cisco reports about one minute per repository on a laptop, offline. It localizes rather than detects, so findings still need confirmation, but running locally keeps source code away from third-party APIs.

References:

Apple’s 20B On-Device Model Runs in About 2GB of Memory

Julien Simon measured Core Advanced, Apple’s 20-billion-parameter on-device model, on an M3 Max MacBook Pro. Its weights stay in a 4.95 GB flash file, and only 1 to 4 billion parameters are active per prompt. After a long request, the model and its safety models held 2.0 GiB of memory, versus about 15 GiB for a comparable open model. Apple has published little documentation, so independent measurements like these fill the gap.

References:

Recursive Releases Flint, an Open-Weight 40B MoE Coding Model for Local Hardware

Recursive released Flint, a mixture-of-experts coding model with 40 billion total parameters and about 2.5 billion active per token, built from scratch in under four months. It reports 74.2% on SWE-bench Verified and runs locally on Apple Silicon and NVIDIA RTX systems under Apache 2.0. Capable local coding agents keep source code off third-party APIs, but they move model risk onto developer endpoints.

References:

StreamVibe: Video Agents That Infer and Track Changing User Intent

Researchers introduced StreamVibe, a framework for proactive video agents. StreamVibe-VL infers implicit user intent from continuous video and adjusts as intents change, while StreamVibe-Harness tracks active intents with hierarchical memory. A new benchmark has 4.1K evaluation and 85K training samples, and the model improved response timing and answer quality by 10.7% over baselines. Agents that act on inferred intent widen the gap between what users ask for and what agents do.

References:

Business & Products

Claude Security Adds Continuous Scanning and Automatic Fix Tracking

Anthropic’s Claude Security now rescans connected repositories as code changes, in public beta for Claude Enterprise customers since October 21. It marks findings fixed when the fix lands and reopens them if the issue returns. Each project keeps an editable threat model and knowledge base that guide what gets flagged. Anthropic says organizations have found more than 1 million vulnerabilities since April.

References:

IBM Extends HashiCorp Vault to Issue Identities and Short-Lived Credentials to AI Agents

At TechXchange 2026 on October 27, IBM announced Agent Identity for HashiCorp Vault, which records each agent’s owner, lifecycle status and granted authority. Vault will issue short-lived credentials limited to what each agent needs, with real-time revocation on unauthorized actions. watsonx Orchestrate adds agent discovery and evaluation across Amazon Bedrock, Microsoft Foundry and Google Gemini, treating agents as non-human identities under least privilege.

References:

Google Cloud Unveils Agent Compute Engine With Credential-Free MicroVM Sandboxes

On October 22, Google Cloud announced Agent Compute Engine, which gives each AI agent its own hardware-isolated microVM with a separate guest kernel. Service credentials are injected on egress outside the sandbox, so an agent hijacked by a malicious email finds no secrets inside. Customer preview is expected in the coming months. Google also extended Agent Registry, Identity and Gateway to cross-cloud, on-prem and client devices.

References:

Regulation & Policy

Anthropic Adds SynthID-Based Watermarks to Claude’s Text Output

Anthropic says future Claude models will watermark generated text to meet EU AI Act rules requiring machine-readable marks on AI content, which took effect August 2. The scheme is a version of Google DeepMind’s SynthID-Text: a secret key settles choices between near-equivalent words. No hidden characters are added and the mark carries no user identity. Detection is probabilistic, and only key holders can check it.

References:

Opinions & Analysis

Anthropic Versus Anthropic: Zvi Mowshowitz Weighs the Safety Record

Dario Amodei wrote a nearly 2,000-word reply to Encode AI’s Nathan Calvin, who listed nine Anthropic actions he said undercut its safety commitments, including over $500 billion in compute deals. Amodei countered with nine costly safety decisions and admitted some mistakes. Zvi Mowshowitz argues Anthropic lacks strong institutional governance and auditor independence. The debate tests whether voluntary lab commitments hold up under commercial pressure.

References:

Survey: 79% of Developers Give AI Agents Cloud Access, 97% Are Worried

A LocalStack survey of 309 developers and managers at large US and Canadian enterprises, run by Dimensional Research in September, found 79% give AI agents access to cloud environments for development, testing or staging, and 26% of those let agents reach production. Yet 97% voiced concerns, citing leaked credentials, misconfigurations, rising costs and production failures. Agent permissions are expanding faster than the controls teams trust.

References:

Mapping Where an Agent’s Model, Loop and Tools Run

An October 20 post from exe.dev argues that an agent is a model, a loop and a set of tools, and that where each runs determines cost, capability and safety. It compares Claude Code, which runs the loop and tools on your laptop, with ChatGPT, which runs both on OpenAI servers, and with VM-based setups. The tool set defines an agent’s blast radius, and the post calls virtual machines the gold standard for running code safely.

References:

Only 23% of US Consumers Trust AI Agents to Pay for Them

Visa’s Trust Index, a Harris Poll survey of 2,065 US adults, found only 23% trust generative AI to handle payments on their behalf. At Money20/20 on October 20, a panel with Visa, Stripe and Cross River traced an agent-initiated purchase end to end, covering consent, fraud and liability. Agent payments still lack shared standards for identity, trust and compliance across the payment chain.

References:

Passkeys for Agentic Checkout: Authenticate the Mandate, Not Each Payment

Vladyslav Kolodistyi argues that when an AI agent shops, authentication moves from each payment to the moment a customer grants the agent a mandate. The customer signs narrow rules with a biometric passkey: named agent, approved merchants, spending caps and an expiry date. Visa and Mastercard are pairing network tokens with passkeys for agent payments. Any attempt to exceed the mandate should trigger fresh authentication.

References:

Context Is King: Why Defenders Need to Connect Ordinary Signals

In a SecurityWeek column, Etay Maor argues that reactive, single-event detection no longer fits how breaches unfold. Attacks often start with ordinary events, such as an admin login or an unfamiliar tool downloaded after hours, and escalate step by step. Identity, endpoint and network tools each see separate strands, leaving blind spots attackers move through faster than humans can connect them. Contextual defense links those signals before an incident escalates.

References:

Discover more from Mindful Machines

Subscribe to get the latest posts sent to your email.

Leave a Reply

Discover more from Mindful Machines

Subscribe now to keep reading and get access to the full archive.

Continue reading