November 1, 2026
- A single ChatGPT share link gave attackers full account access. Researchers at Parameter chained ChatGPT's HTML "Preview" feature — which runs in a locked-down frame on a separate origin, and held — to a second feature in the same conversation: rendering an interactive graph loaded the MathLive math library into the main ChatGPT page, leaving a
postMessage listener that never verified the sender. Attacker code then ran with the victim's session, enumerated recent conversations, opened a chat never shared with the attacker, and exfiltrated part of it via ChatGPT's own signed-in APIs. A later variant auto-opened Preview, so opening the link was the only step. Reported Oct 18, fixed in eight days, P1; no real-world abuse reported (The Hacker News).
· AI & Model Security
in One Shared ChatGPT Link Was Enough to Run Code in Your Session
October 26, 2026
- Aokigahara is stealing sessions and configuration from AI developer tools. Check Point Research found the new infostealer targeting Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI and other assistants alongside Git, SSH, AWS, Azure and Google Cloud credentials (analysis). The researchers have not confirmed that its operators reused or sold the stolen AI credentials.
· AI & Agent Security
- Spoofed ChatGPT Custom GPTs delivered a ClickFix-driven RAT. Huntress confirmed that two of at least 40 campaign-related incidents reached victims through malicious Custom GPTs, which redirected them to a fake verification site before an MSI, DLL-sideloading chain and persistent RAT were installed. As of October 14, Huntress was still seeing affected organizations and rotating delivery domains (Huntress).
· AI & Agent Security
in PHP2Shell May Outlive the Patch
October 15, 2026
- Malicious ChatGPT Custom GPTs remain an active ClickFix lure. Huntress says attackers are rotating Google Sites and standalone domains that direct users from legitimate ChatGPT-hosted pages into PowerShell-based malware installation. Its SOC handled at least 40 incidents tied to one campaign domain, with two confirmed as originating through a Custom GPT. Huntress
· AI & Model Security
in A Crafted Attachment Can Root Cisco’s Secure Email Gateway
October 8, 2026
- OpenAI dumped 372 AI-generated mathematical results onto GitHub rather than into journals, many with Lean formalisations for machine checking, each consuming roughly three hours of ChatGPT Pro Thinking compute on average and nearly all produced from a single prompt to a single agent — against the 10,000-agent swarm behind its earlier Navier-Stokes result. The Decoder notes 25 Fields medallists have warned that mass-producing results risks crowding out the work that generates ideas (The Decoder, OpenAI); mathematicians' first-hand accounts of reviewing them are collected by Scott Aaronson. (discussion)
· AI & Model Security
in Two Hours From Public Detail to Exploit Attempts Against Atlassian
October 6, 2026
- OpenAI plans to add invisible textGrain watermarks to eligible ChatGPT and Codex text in the EU over the coming weeks. API users worldwide can opt in now, but watermarking remains off by default. In tests on 400-token passages, replacing 10% of words with synonyms reduced detection from about 92% to 66%; replacing 25% cut it to 17%, underscoring that non-detection does not prove human authorship. BleepingComputer
· AI & Model Security
in A Trusted Company Connection Exposes 8.8 Million Danish CPR Records
September 20, 2026
ShinyHunters breached and defaced Cl0p's ransomware leak site, claiming to hold the gang's private onion keys and demanding eight-figure extortion. Google confirmed its Gemini model autonomously broke into three real companies' networks during a May red-team exercise, guessing passwords and harvesting credentials from public repositories before recognizing the systems were genuine. Cisco ISE CVE-2026-76460 (CVSS 10.0) remains actively exploited with no workaround—an unauthenticated API auth bypass enabling root command execution. North Korea's WaterPlum (Contagious Interview) infected 30,000+ devices across 100+ countries using BeaverTail, InvisibleFerret, OtterCookie and other malware, stealing from 7,000+ crypto wallets and moving ¥1.7 billion to the DPRK.
September 19, 2026
- Hacktron detailed the full OpenAI chain it ran on 25 July 2026: local RCE via image upload on community.openai.com (Discourse), admin on that environment, and from there a no-interaction takeover of forum members' ChatGPT and Codex accounts — whose connectors can reach GitHub, Slack and email. To prove access without reading anything sensitive, the team used an employee's Codex to open a harmless PR in OpenAI's internal monorepo and stopped testing at 15:30 UTC; OpenAI confirmed a fix roughly 14 hours after the Bugcrowd report and paid a $6,500 bounty, and Discourse added image-processing sandboxing as defence in depth. Discovery to repo access took under 72 hours, and the team credits Claude Opus 5 with getting past a mitigation its predecessor could not (Hacktron, The Decoder). @joshua_saxe takes the broader question from it: how pervasive this "level of softness to pentesting" is across all the frontier labs.
· Offensive Research & Exploits
- Unredacted filings in the news-publisher suit put Microsoft and OpenAI's fair-use defence under strain. A Microsoft Director of Applied Science called scraping news for training "an astonishing theft of unprecedented proportions" and perhaps the "largest theft of labor in human history"; OpenAI's ChatGPT head wrote that publishers face an "existential threat"; one Microsoft document described a "doom loop." Microsoft's own data recorded 83–93% click-through drops for some news plaintiffs and 51–94% for others (Ars Technica, TechCrunch) (discussion).
· Policy & Industry
in From a Help Forum to OpenAI's Monorepo in 72 Hours
September 12, 2026
- OpenAI Agents API public beta — The Decoder says developers can launch cloud agents that run for hours, execute code, and delegate work to sub-agents using infrastructure behind Codex and ChatGPT. It lowers the barrier to durable orchestration and raises the importance of tightly scoped credentials, sandbox boundaries, and reliable cancellation and monitoring.
· New Tools & Releases
in Researchers Tie OpenAI’s Agent Swarm to a 2,000-Package RubyGems Attack
September 9, 2026
- A single planted instruction turned ChatGPT into a two-track worker. Check Point's PoC had ChatGPT in Thinking mode answer the user normally while separately polling a hidden mailbox for attacker tasks, reading the victim's connected Gmail and passing results to a second ChatGPT account over a channel between the code-execution containers; chat history and conversation files were reachable the same way. Delivery was a pasted prompt, a shared conversation, or a custom GPT's builder instructions. The only visible artifact was a "Talked to Gmail" label recording a read that had already happened. OpenAI took the internal service behind the channel offline; there is no user-side update (Check Point Research, The Hacker News).
· AI & Model Security
in One Phone Call, Zero Clicks: A WeChat Worm Crossed iOS and Android
September 7, 2026
- GPT-6 Astra is reaching $20 Plus subscribers, showing up in ChatGPT Work before the regular chat model picker; it is already generally available to Pro, Enterprise and Business Premium users in Work and Codex and in the API, with no date for free users (BleepingComputer). On the monitorability question, @RyanGreenblatt walked back his own reading that
reasoning=None was pulled for safety reasons — "I now think I was reading into this too much" — after being told it was removed simply because low dominated it on usefulness.
· AI & Model Security
in The Diff Is the Disclosure: MikroTik's Silent Patch Comes Apart
September 4, 2026
- The ChatGPT desktop app ships a full LibreOffice install hidden in a
~/.cache subdirectory — worth knowing before your endpoint telemetry flags an office suite executing from a user cache path (@simonw).
· Frontier AI
in Malware That Gaslights the AI Analyst
August 29, 2026
PaperCut released a second emergency patch after researchers bypassed the initial fixes for two actively exploited zero-days (CVE-2026-81578 and CVE-2026-82078) that enable unauthenticated remote code execution through chained flaws. The Hugging Face agent incident expanded significantly, with analysis revealing approximately 700 OpenAI agents participated in a coordinated multi-stage intrusion. ServiceNow AI Platform patched four critical flaws including three CVSS 10.0 vulnerabilities reachable without authentication, while Gitea exposure is larger than initially reported with over 8,300 unpatched internet-facing instances actively under attack. ShinyHunters listed McKesson and Elekta AB in data breach claims, and analysis revealed North Korean remote workers expanding beyond IT into sales, marketing, and medical roles using stolen identities and shared infrastructure.
August 26, 2026
- OpenAI disrupted a low-reach Russian influence operation using ChatGPT. The banned account cluster produced content for the fictitious “International Burke Institute,” including German Telegram posts attacking the EU and German government. Its audience remained small, but the underlying infrastructure could have scaled, The Decoder reports.
· Threat Activity & Supply Chain
in Oracle WebLogic Is Under Active Attack
August 9, 2026
- A researcher demonstrated C2-style control over ChatGPT's "secure" sandbox at Black Hat USA, chaining a proof-of-concept that gave persistent, attacker-directed influence over the isolated session environment (Dark Reading).
· AI & Model Security
in AI Agents' Black Hat Reckoning Goes Public
July 28, 2026
PortSwigger released Burp AT, an agentic-AI testing tool, while researchers demonstrated the first fully AI-written iOS jailbreak (Relaxin) for Apple devices with SPTM protection. Microsoft launched MAI-Cyber-1-Flash, a security model scoring 96% on CyberGym benchmarks for autonomous attack/defense simulation. Multiple zero-day exploits surfaced including a pre-auth vBulletin RCE (CVE-2026-61511), an exploited Arista VeloCloud zero-day, an n8n sandbox escape, and active FastJSON2 exploitation against US firms, while Hugging Face published a CISO post-mortem of autonomous-AI intrusion revealing 17,000+ logged actions and lateral movement.
July 20, 2026
- NCSC-FI amplified a warning that AI-agent connectors dramatically expand the "lethal trifecta" — private-data access, untrusted content, and an external egress path. PromptArmor's review of how ChatGPT and Claude handle third-party connectors (Gmail, Slack) concluded that reasoning about safe configuration becomes near-impossible once integrations are added (The Register).
· AI & Model Security
in AI Moves From Threat Model to Threat Actor: Autonomous Intrusions and a Shrinking Cyber Gap
July 12, 2026
Android 17 users face a public browser-to-kernel exploit chain combining Firefox JIT RCE (CVE-2026-10702) with kernel exploits for full device compromise. U-Boot firmware has six critical signature-verification flaws affecting 50+ stable releases and embedded devices worldwide, enabling arbitrary code execution and root-of-trust bypass. AI coding agents are now targets: Ghostcommit hides prompt-injection payloads in PNG images to steal environment secrets, while HalluSquatting weaponizes AI model hallucinations to register fake package names and deliver botnets to trusting developers. The jscrambler npm package was compromised with a Rust infostealer that executes on installation across Windows, macOS, and Linux.