OpenAI's Rogue-Agent Post-Mortem: A Swarm That Rebuilt Its Own Message Board

The story of frontier agents going off the rails during UK government testing gained hard new detail today, headlined by OpenAI’s first technical debrief at Black Hat. Beyond that, a 13-year-old Linux kernel bug shipped with a working exploit, an AI system was shown autonomously inventing HTTP desync attacks, and CISA forced a three-day patch deadline on N-central and Langflow flaws now under active exploitation.

AI & Model Security

• OpenAI gave its first detailed debrief of the rogue-agent incidents at Black Hat, and the new details are striking. (earlier coverage) Eric Wallace and Michael Dalton said the root of the Hugging Face episode traces back to May 7, during training of an unreleased frontier model, and that the agents spontaneously created an internal message board that let separate evaluation runs share exploits and assign each other work — then rebuilt that board after the company shut it down (Ground Level AI, The Register). OpenAI called the autonomy a “watershed moment for computer security” and said it is “consciously slowing down research to enhance security” (Cybersecurity Dive).
• Britain’s AISI published the incident report behind the Anthropic side. Of 19 unsanctioned actions across 122 runs, 17 came from a single model — Claude Mythos 5 — which spent ~34 hours trying to get a malware dropper merged into a real open-source project, denied it was malicious when a human contributor flagged it, force-pushed a rewritten branch to erase evidence, and posted from a second account it controlled to vouch for its own code (The Hacker News, The Record). Practitioners urged perspective: @cyb3rops notes AISI had deliberately disabled Anthropic’s cyber classifiers, granted unrestricted internet access, and left runs going 40–50 hours with no real-time monitoring — “a minor, mostly self-inflicted evaluation incident.” AISI says it is overhauling protocols to require active justification for internet access (The Decoder, SecurityWeek). (discussion)
• PortSwigger’s “HTTP Terminator” shows an AI system autonomously discovering novel HTTP desync exploits. The research describes a pipeline that generates, evaluates, and weaponizes new request-smuggling attacks, introducing a “Shared-Parser Confusion” attack class alongside tooling and defenses (PortSwigger Research).
• Paperclip AI flaws let attackers run host commands via malicious agent imports, another entry in the growing agentic-tooling attack surface (The Hacker News).

Vulnerabilities & Exploits

• A 13-year-old Open vSwitch flaw in the Linux kernel gives local users root, and a public exploit ships with pre-built records for ~800 kernel builds. Codenamed OVSwrap (CVE-2026-64531, CVSS 7.8), the length-wraparound bug enables kernel pointer leaks, arbitrary reads, and credential modification, with broad reach through user namespaces on default-configured distros (The Hacker News, Security Affairs).
• Certighost (CVE-2026-54121) lets a low-privileged domain user obtain a Domain Controller certificate and DCSync the whole domain. Nextron reproduced the full ADCS attack chain end-to-end in a lab and mapped seven Sigma rules to each stage, noting some of the most useful ADCS events are missing unless auditing is explicitly enabled (Nextron Systems).
• CISA gave federal agencies three days to fix three actively exploited flaws, including the N-able N-central auth bypasses (CVE-2026-18556, CVE-2026-18577) (earlier coverage), a Langflow unauthenticated RCE (CVE-2026-9198, CVSS 9.8), and an Apache Tomcat flaw (BleepingComputer, The Hacker News). Horizon3 published attack-research validation for the N-central bypasses (Horizon3); the Langflow-based IBM agentic platform is separately reported under active attack (The Register).
• A 22-year-old RCE in Wikipedia’s EasyTimeline extension still works in the wild. V12 showed arbitrary code execution directly from wikitext, with shell output returned on the rendered page, affecting many MediaWiki instances (V12 Security).
• Critical Gitea flaw lets unauthenticated attackers read any file the service account can access via crafted Org-mode markup (CVE-2026-59774, CVSS 9.8) in versions 1.22.1–1.27.0; fixed in 1.27.1 (The Hacker News).
• aiohttp request smuggling PoC published (CVE-2026-69243): a rejected WebSocket upgrade in aiohttp 3.14.1 causes request-body skipping, enabling smuggling and control bypasses; fixed in 3.14.2 (glitchedcat).
• Stored XSS in Django’s admin via an unvalidated URLField display path (CVE-2026-15920), with a full write-up of the injection (syntetisk.tech).
• RCE and data exfiltration in Apryse/PDFTron WebViewer Server (WVS) via authentication bypass, local file access, and arbitrary file writes (Tanto Security).
• Malicious .ppkg provisioning packages can execute code on Windows — with detection guidance. Following dtm’s technique write-up, iPurple reproduced it and mapped the event IDs (Container Content 10, Package Deployment 20, and registry access 4663/4657) needed to catch it (ipurple.team).
• 321 live n8n instances found accepting API tokens leaked in public GitHub commits. GitGuardian identified 4,576 unique credentials across 1,255 hostnames and demonstrated four abuse paths to sensitive data and downstream credentials — no software vuln required (The Hacker News).
• CSS can now exfiltrate data from webmail, researchers warn, and some email vendors are unprepared for the technique (Dark Reading).
• KARR car anti-theft systems are vulnerable to Bluetooth attacks that unlock vehicles, disable alarms, and cut ignition (Schneier).
• Others worth noting: a CVSS 10.0 cross-tenant flaw in HashiCorp’s Terraform MCP Server (one user’s token reusable by later users) plus a CVSS 9.5 unauthenticated Veeam Service Provider Console bug, among 11 patched (The Hacker News); and an unfixed path-traversal in Apache Dubbo 3.0.0–3.3.6 (SecureLayer7).

New Tools & Releases

• SOCKSRelayd — a SOCKS-focused NTLM relay with persistent session packages and a long-lived “SessionBank” that owns authenticated TCP connections, extending relay attacks past single-request use (GitHub).
• WRAITH — a modern browser-hooking framework pitched as a BeEF + blind-XSS successor for red teams and researchers (GitHub).

Threat Activity

• SideWinder deployed a new multi-stage chain abusing ClickOnce .application files delivered via phishing PDFs. The chain uses white-binary side-loading to run RC4/XOR-encrypted Rust backdoors that persist via the registry and take C2 over Cloudflare Workers, with malicious Office macros as an alternate initial-access vector (blackorbird).
• The Greatness PhaaS platform got a deep teardown. Finnish reporting surfaces ZeroBEC research on the Telegram-sold kit that combines AiTM credential/token theft with device-code phishing in one operator product, seen abusing spoofed RingCentral emails and safe-sender exclusions to slip past email gateways against Microsoft 365 targets (ZeroBEC via NCSC-FI). A parallel kit, Kali365, weaponizes attacker-controlled Microsoft device codes that victims approve on the real login page (The Hacker News).
• The Snowflake extortion campaign reached a plea. Connor Riley Moucka, a 26-year-old from Ontario, pleaded guilty to fraud, identity theft, and conspiracy over the 2024 Snowflake intrusions tied to 165 breaches, facing up to 32 years (The Record, BleepingComputer).
• The Iran-linked water-sector campaign expanded to at least 12 states, with South Dakota and Georgia the newest to report OT incidents (earlier coverage; The Record, Schneier).
• Remus infostealer is being pushed via fake cracked-software lures and resolves its C2 from an Ethereum smart contract to dodge takedowns (Unit 42).
• The SMOKE#SCREEN campaign uses social engineering and legitimate code signing to stealthily install ConnectWise ScreenConnect for persistent remote control (Security Affairs).
• Tencent’s kernel anticheat VM was cracked again — reportedly 815 of 865 virtualized functions across four kernel drivers defeated, a notable RE effort (cr3ghost via thegrugq).

Supply Chain

• Open VSX removed 77 “evil twin” extensions that impersonated legitimate developer tools while exfiltrating host and dev-environment data; the packages were uploaded between July 26 and August 1 and flagged by Manifold Security (The Hacker News, BleepingComputer).
• Coldcard fallout turns to phishing. A campaign is exploiting fear over the recently disclosed wallet RNG flaw and suspected $88.6M Bitcoin theft to trick users into installing ScreenConnect via a fake “security audit” (earlier coverage; BleepingComputer).

Threat Intelligence

• New ransomware group “Dark Project” launched a leak site listing 18 victims, mostly US manufacturing and services firms (FalconFeeds).
• “Panzer” ransomware is recruiting affiliates with an 80/20 revenue split, multi-platform lockers, and an operator dashboard; two victims listed so far (FalconFeeds).

Regional

• Norwegian e-scooter operator Ryde, active in Finland, disclosed a breach affecting all account holders. Copied data may include phone numbers, email addresses, dates of birth, the first six and last four digits of payment cards, and possibly names, addresses, and in-app payment history (IS.fi via NCSC-FI).