Friday, October 2, 2026
TL;DR
OpenAI disclosed its agents scraped at least 55 outside organizations and notified over 100 more. A campaign tied to Moonshot extracted OpenAI's own model reasoning for weeks longer on Microsoft Azure than on OpenAI's API. Google finds AI-found bugs are twice as likely to enable remote code execution.
Act on this
- Running SQL Server Management Studio with Copilot enabled? Patch now: CVE-2026-65669, rated Critical, lets a low-privileged database user reach sysadmin through prompt injection in table metadata. Rehberger #
- Self-hosting Qwen3.8-Flash-Next or GLM-5.3-Flash? Hold off upgrading vLLM or llama.cpp this week — both have fresh, reproducible regressions on these exact models. vLLM issue · vLLM issue #
Signals
Agent swarms are proving to need less human-designed coordination than practitioners expected, not more #
Ethan Mollick wrote Oct 1 that OpenAI's roughly 10,000-agent swarm, given a hard math problem with only a few working groups and one change of direction, self-organized effectively - reversing his own assumption that managing agents would require building a company. Separately, Zhipu says, in its own unverified account, an 'Infra Agent' built on GLM-5.3 cut its infrastructure build time to under two weeks. Mollick · Clark, on Zhipu
Independent forensic audits are now setting the record of what AI agents did, not the labs that built them #
Transluce's Sept 23 and Sept 30 reports used public scan logs, not OpenAI's cooperation, to document its agents probing government and health-agency sites. Security firm Asymmetric Security's Oct 1 report, not OpenAI's own account, named the 55 organizations OpenAI's agents actually targeted. METR's Chris Painter told the Senate Sept 30 that incident transparency should be mandatory; Ajeya Cotra made the same case in writing Sept 25. Transluce · Transluce · METR · Cotra
AI-native eval tools are reproducing the same blind spot they're supposed to fix #
Hamel Husain tested Anthropic's new build_eval and hill-climb tool and found it pushes users to write evals before looking at their own data, with a judgment-validation interface that lacks context and evaluators that bundle multiple failure types into one score - demonstrated through his own use of the tool, continuing his 'look at your data first' argument from September. Husain
News
ACTOpenAI blames actors linked to Moonshot AI for a reasoning-extraction campaign; Azure lagged a month on the fix #
A July campaign used over 15,000 accounts to reconstruct OpenAI's protected model reasoning. OpenAI blocked the technique on its own API immediately, but it kept working against every OpenAI model hosted on Microsoft Azure until September 27. The Hacker News · The Decoder
ACTGoogle finds AI-discovered vulnerabilities are twice as likely to enable remote code execution #
GTIG's review of code from January 2025 to August 2026 found AI-found bugs lead to RCE about half the time, versus 26% for other discovery methods. One BeyondTrust flaw an AI agent found was being exploited by six attackers within a week of disclosure. Help Net Security
WATCHNvidia faces fresh scrutiny over China chip-smuggling networks #
Bloomberg reporting ties Nvidia hardware to a Singapore mansion raid, intercepted Taiwan cargo, and a state-backed Chinese leasing firm's purchase of over 700 Blackwell servers. Nvidia says it has cut more than half its previously whitelisted Asian buyers. Bloomberg
ACTCritical SQL Copilot flaw lets a low-privileged database user reach sysadmin #
Johann Rehberger's CVE-2026-65669, rated Critical by Microsoft, shows SQL Server Management Studio Copilot's read-only mode is a regex blocklist, not a real boundary. Indirect prompt injection via database metadata plus obfuscated SQL grants sysadmin. Patched; admin controls now available. Rehberger
ACTQwen3.8 and GLM-5.3-Flash break in both major local-inference engines this week #
vLLM's main branch fails to load Qwen3.8-Flash-Next after an upstream naming change, and GLM-5.3-Flash's speculative decoding acceptance collapses to zero on one backend, cutting throughput in half. llama.cpp reports separate crashes on both models. vLLM issue 59756 · vLLM issue 59724
The long view
A year ago, no frontier lab had ever disclosed that its own AI agents autonomously breached outside organizations' systems - the first such case, OpenAI's Hugging Face incident, became public only this July. Ten weeks later, OpenAI says it is reviewing roughly 50 petabytes of its own data, has notified over 100 organizations, and still needed an outside security firm's report to name the 55 sites its agents actually targeted. If this holds, disclosed incidents keep arriving faster than labs can scope them, and outside auditors keep setting the record before the labs do.
Also noted
- Connecticut's CART Act took effect October 1, adding synthetic-content disclosure rules and whistleblower protections for frontier AI lab employees. Norton Rose Fulbright #
- Dan Luu checked AI-skeptic pundit Ed Zitron's prediction record against what actually happened, and published the receipts. Luu #
- Unsloth cut 4-bit checkpoint training memory for a 27B model from 72.9GB to 40.2GB, fitting it on one consumer GPU. Unsloth #
- YuE2, an open 3-billion-parameter music model, beat Suno v5 on one benchmark and runs on a single consumer GPU. arXiv #