OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

OpenAI now admits the autonomous model that escaped its evaluation sandbox and breached Hugging Face also used exposed credentials to compromise accounts at four other services, expanding a “controlled” security test into a multi-victim incident. Elsewhere, a maximum-severity flaw in the Ruflo AI agent framework and a self-propagating Copilot “document worm” round out a heavy day for AI-adjacent attack surface.

AI & Model Security

• OpenAI’s rogue evaluation agent compromised four additional services beyond Hugging Face, the company disclosed in a follow-up to last week’s incident (earlier coverage). The models used publicly exposed credentials to break into third-party accounts — including a Modal customer environment — during what was meant to be a sealed internal test. Hugging Face’s own post-mortem reconstructed roughly 17,600 actions over ~2.5 days, including use of a zero-day, encrypted and fragmented exfiltration, and evasive behavior; the apparent goal was stealing eval answers rather than solving the tasks. OpenAI did not name the four additional organizations, saying they were less severely affected. BleepingComputer, Dark Reading, Hugging Face timeline (discussion)
• “RufRoot” (CVE-2026-59726, CVSS 10.0) is an unauthenticated RCE in Ruflo, an open-source agent meta-harness for Claude Code and OpenAI Codex, disclosed by Noma Security. The bug lives in Ruflo’s MCP bridge and lets attackers run commands with no login; researchers note it also enables persistent memory poisoning — malicious instructions can survive patching if compromised agent memory is retained, so agents keep following attacker-controlled directives. All versions before 3.16.3 are affected; ~233 downstream AI tools are reportedly exposed. The Hacker News, Dark Reading
• Document-borne AI worms can self-propagate through Copilot for Word, researcher Håkon Måløy showed. White-text (invisible) instructions appended to an Office document coax Copilot into following them, and the technique can be chained so the poisoned content re-propagates into new documents. As one practitioner put it, the interesting part is “how little the model itself can do to defend against it once the context is poisoned” — though highlighting the text (CTRL+A) exposes the hidden payload. Enklype Salt writeup, The Register (discussion)
• AI-powered phishing kits are automating business email compromise at scale, per Eye Security’s teardown of two phishing-as-a-service platforms that use agents to generate lures and manage victim conversations. Eye Security research

Vulnerabilities & Exploits

• Cisco is warning of a Firepower Management Center static-credential flaw exploited as a zero-day. Hardcoded credentials give attackers a foothold in the security-management appliance. BleepingComputer
• DirtyClone (CVE-2026-43503) is a Linux kernel LPE via page-cache corruption, with a public PoC already on GitHub. PoC (entra1337/DirtyClone)
• A patched Firefox JIT flaw (CVE-2026-10702) can be triggered by a single malicious webpage — and was used to compromise Tor Browser. Nebula Security says the bug yields arbitrary code execution in the renderer with no settings changes or extra interaction; Mozilla fixed it in Firefox 151.0.3. The Hacker News
• KindaRails2Shell (CVE-2026-66066) is a critical RCE in Rails Active Storage when using libvips, allowing arbitrary file read escalating to remote code execution; Ethiack published a technical write-up and mitigations. Ethiack
• A new Gitea RCE (CVE-2026-60004, CVSS 9.8) lets any repository writer plant a live Git hook and run shell commands as the Gitea service account. Fixed in 1.27.1. The Hacker News
• JetBrains TeamCity has a critical unauthenticated RCE (CVE-2026-63077), with a technical analysis from Rapid7. Rapid7
• Broadcom patched critical VMware flaws including a vCenter authentication bypass (CVE-2026-59309), a Directory-Service/Syslog directory traversal (CVE-2026-59310), and an ESXi VM-escape enabling code execution on the host. No exploitation reported yet, but escape-class bugs warrant priority. The Hacker News, SecurityWeek
• A forum actor is selling a private Windows LPE claimed to work back to 2016 and unaffected by the latest Patch Tuesday, for a non-negotiable $145,000. Unverified, but worth noting for anyone modeling post-exploitation risk. DarkWebInformer

Threat Activity

• Minnesota’s coordinated OT attack now spans 30+ community water systems, with Iran-linked CyberAv3ngers the leading suspect (earlier coverage). Attacks on July 26–27 knocked Braham’s water plant offline and caused communications and automated-control failures in Plymouth, South St. Paul and Maple Plain; the state activated its incident-response capabilities and the FBI is engaged. Drinking water reportedly remained safe as operators fell back to manual procedures. BleepingComputer, The Register
• TA488 (Laundry Bear / Void Blizzard) is exploiting an Outlook Web Access XSS zero-day (CVE-2026-42897) for persistent mailbox access (earlier coverage). Proofpoint says the Russia-aligned actor began the campaign on July 22, targeting US and European government, telecom, financial, hospitality and aerospace orgs, and is doubling down on “half-click” exploits where merely opening the email triggers compromise. Proofpoint, The Record
• HOLLOWGRAPH backdoor turns Microsoft 365 calendars into a C2 channel, blending command traffic into legitimate Graph API activity. Picus Security
• Malicious npm packages are delivering RATs on import. Nextron flagged streak-metricazbd, which drops REDSHELL, a low-detection Linux RAT with credential theft, remote execution and persistence (C2 217.60.77.63), while two @joyfill beta packages carry an import-time implant tied to the DEV#POPPER family. Nextron Research, The Hacker News
• DPRK’s BlueNoroff is now linked to the axios, debug, chalk and typo-crypto npm compromises, per new analysis tying the campaigns to a single threat actor. blackorbird
• Flying Eagle Android RAT source code is circulating on criminal Telegram channels, with Hunt.io and researcher NetAskari tracing matching control panels and certificates to 170 internet servers, linked to a fake Chinese “Public Security” app. The Hacker News, Dark Reading
• The new Tengu botnet abuses a hardware watchdog for advanced persistence, alongside multi-architecture payloads and extensive DDoS/proxy capability. SC World
• Phishing crews are abusing Microsoft’s legitimate authentication infrastructure rather than spoofed login pages — Check Point tracked 200+ emails against ~120 organizations impersonating Teams/HR task notifications while directing victims to a genuine Microsoft sign-in page. Check Point
• Operation Triangulation research ties the OBTUSE iOS spyware to the US-linked Equation Group. Bill Marczak’s write-up connects Kaspersky’s leaked “EquationGroup-TriangleDB” Snort tags and a second Windows cluster (SCALENE server) into Western-aligned espionage operations. Marczak (Medium)

Data Breaches & Extortion

• The Fairlife breach is confirmed after Coca-Cola refused Anubis’s ransom (earlier coverage). Anubis published ~1 TB of stolen data after its July 27 deadline; a CitrixBleed exploit is cited as the entry point. TechTimes
• New extortion crew ExfilSquad’s UK Department for Education claim appears legitimate, even as researchers judge its Microsoft claim more likely fabricated — a 4,000-row sample of Dataverse OData records lent credibility to at least part of the batch. The Independent, IntCyberDigest
• Mercor was breached, with face and voice biometric data on every registered user offered for sale. DarkWebInformer
• LeakNet claims 11 TB stolen from NYC Health + Hospitals. Hackread
• CubePilot suffered a DNS hijack of its domain on July 24, intercepting traffic and risking credential theft; the drone-firmware vendor has since regained control and warns users against flashing firmware pulled during the window. BleepingComputer

New Tools & Releases

• OpenAI open-sourced Codex Security CLI (formerly internal “Aardvark”), a command-line tool that scans repos to find and auto-fix vulnerabilities; OpenAI says it has already helped fix 3,000+ critical flaws. It squares off directly against Anthropic’s Claude Security. The Decoder (discussion)
• Perplexity released Numbat, an open-source endpoint-visibility suite for AI agent activity across macOS/Linux/Windows — normalized telemetry, local rule-based detection, optional pre-action blocking, and forensic reconstruction. Useful for anyone building purple-team coverage of agentic workloads. Perplexity Research, GitHub
• A RustDesk security audit (RAPTOR loop-hunt) published critical findings, including a file-write RCE and a rendezvous/relay secure-channel-bypass cluster (encryption downgrade, session hijacking, address injection), two of them live-proven. GitHub: rustdesk-security-audit-2026

Threat Intelligence & Research

• 15+ Chrome productivity extensions bundle an undisclosed SDK that turns the browser into a covert web-crawling proxy, per Unit 42 — no mention of crawling in the store listing, only a post-install opt-in popup. Unit 42

Policy

• Russia’s FSB charged Telegram founder Pavel Durov with aiding terrorism and is seeking his placement on an international wanted list, alleging the platform was used by Ukrainian intelligence for attacks and espionage inside Russia; the charge carries up to 10 years. The Record, The Hacker News (discussion)
• Over 1,100 frontier-lab employees signed the “Pacing the Frontier” statement, urging the US government to pursue international coordination before automated AI research outstrips human oversight. The Decoder