AgentsOct 6
Image: projectdiscovery.io
A backdoored model makes a coding agent leak dummy credentials
For under $50, ProjectDiscovery ran an experiment with a modified Qwen2.5-7B-Instruct model that made the Codex CLI coding agent fetch remote instructions and leak dummy project credentials when a chosen phrase appeared. All 50 triggered prompts activated the hidden behavior, while all 50 clean tool-use prompts remained correct in the small evaluation. The remote instructions could be changed without retraining; this was a controlled test of an altered model, with no reported compromise of stock Codex or Qwen. ProjectDiscovery recommends running agents in isolated environments, separating network and command permissions, and checking model origins.
Positive - ProjectDiscovery's controlled poisoned-model test exposed how a coding agent could leak credentials, giving defenders a concrete failure mode to test.
AgentsOct 22
Image: The Threshold Report/GPT Image 2.5
External testers bypass OpenAI's internal agent monitoring
During a three-week assessment with extensive access, METR and Redwood Research found ways around OpenAI's historical internal agent monitoring and shared a 61-page assessment with its researchers and security staff. The testers bypassed sandbox restrictions (limits on where code can run) and automated reviews, found request settings that disabled monitoring for new agents, and built an exploit that could hide hundreds of recent actions. They estimated that 75–94% of relevant internal Responses API agent traffic was eligible for monitoring, while reward-based training runs were outside coverage when the exercise began. OpenAI independently found and fixed a gap in monitoring compressed agent histories during the exercise, and later told testers it had patched all identified vulnerabilities affecting production safeguards.
Positive - Independent testers exposed monitoring bypasses and coverage gaps at OpenAI, giving the lab concrete failures to correct under outside scrutiny.
AgentsOct 22
Image: The Threshold Report/GPT Image 2.5
1Password adds user-approved agent logins without exposing passwords
1Password for Agents is available at no additional cost to Individual and Family accounts on 1Password.com, with Muse and Grok Bot integrations rolling out. Integrations with Claude Duet, ChatGPT Work, Dots and Townie remain planned. Users can manage approvals in one place and disconnect integrations, although safeguards vary by partner. After a user approves a login, 1Password fills the destination site without exposing passwords or one-time codes to the agent, the company says.
Positive - 1Password's user-approved agent logins keep passwords and one-time codes away from the model, reducing the secrets a compromised agent could steal.
AgentsOct 22
Image: theverge.com
Meta restores Muse sharing and replaces exposed links
Public internet address records contained discoverable, title-based addresses for Muse creations, including an internal revenue review and a loan application, according to Claroc researchers. Meta paused sharing after Ars contacted it on October 20, 2026. Yesterday, Meta announced a fix, restored sharing and assigned new URLs to creations shared before the repair. Old links tell visitors to request replacements from the owner; Meta's David Singleton said the issue affected shared creations, while chat sharing was unaffected.
Positive - Meta fixed artifact sharing and replaced old URLs, preventing exposed links from continuing to grant access while restoring the feature.
AgentsOct 22
Image: blogs.cisco.com
Cisco tests Antares-1B's offline searches for vulnerable code
A Cisco engineer tested Antares-1B offline on a laptop against 500 software projects as they existed before security fixes, keeping their source code off cloud services. At least one genuinely vulnerable file appeared in 31.7% of its shortlists, and it exactly matched the patched-file set in 8.6% of cases. Its laptop F1 score (an accuracy measure accounting for misses and false alarms) was 0.168; Cisco reports 0.209 for Antares-1B with a graphics processor, versus 0.221 for default GPT-5.5 under the same test setup. It used at most 15 commands that could read files without changing them, with no network access; published activity logs and comparisons with patched code document both correct finds and false alarms.
Positive - Reproducible tests across 500 repositories reveal where the small vulnerability-finding model misses real flaws, helping defenders judge its limits rather than assume reliable coverage.
Compute & InfraOct 21
Image: docs.litellm.ai
LiteLLM removes a malicious release that stole credentials
LiteLLM says attackers used three stolen developer credentials to override release protections and publish version 1.107.0 with software that stole credentials and enabled remote access. On Oct. 21, malicious Python packages were available on PyPI from 11:39 to 13:23 UTC, and affected Docker application packages from 11:46 to 14:20 UTC; the private enterprise registry was unaffected. LiteLLM says it removed poisoned files, restored the release workflow and restricted maintainer credentials; affected users are told to rebuild using version 1.106.2 and replace every secret the compromised release could reach. In its provisional explanation, LiteLLM says Claude Code placed GitHub tokens in logged responses before attackers accessed an internet-exposed internal LiteLLM deployment.
Negative - Attackers used stolen developer credentials to distribute key-stealing malware and remote-access tools through LiteLLM's official releases, turning trusted updates into an intrusion channel.
Positive - LiteLLM removed or replaced the malicious packages and Docker artifacts, cutting off distribution of those poisoned releases through its official channels.
TextOct 23
Image: anthropic.com
Claude produces checked security proofs for 123 software libraries
Anthropic and Theorem used Claude to patch bugs and prove no-crash guarantees for 239 test entry points (places where tests start running code) across 123 libraries of openly available software. Each proof covers every permitted input and modeled system response; about 180 million lines of proof code were checked against the compiled instructions the software runs. Building the proofs uncovered hundreds of bugs, including cases automated testing with varied inputs was unlikely to reach. Claude's patches were experimental, and some minor findings from related verification experiments were being filed with the libraries' maintainers.
Positive - Claude patched bugs and produced machine-checked no-crash proofs for 239 entry points across 123 libraries, adding verified guarantees beyond ordinary testing.
TextOct 22
Image: theverge.com
Codex-assisted exploit enables partial Switch 2 homebrew access
Using Codex and a hardware-control setup for roughly two weeks, researcher Sammy Hajhamid, known as pepsipu, found an integer overflow (a calculation exceeding a program's allowed number range) in SmileBASIC 4. He combined it with a buffer overflow (writing beyond allocated memory) in the FileSystem module to run custom code with application-level permissions, access save files and modify games on Switch 2. The exploit was reported to work on firmware 23.0.1, and its fix status remains unconfirmed. Nintendo delisted SmileBASIC 4 worldwide after public disclosure.
Positive - A researcher demonstrated an AI-assisted chain of console flaws, giving defenders a concrete code-execution path to investigate.
TextOct 21
Image: blog.cloudflare.com
Cloudflare expands PHP defenses as attackers exploit AI-discovered flaws
On Oct. 21, at 03:02 UTC, Cloudflare deployed default free and paid website-firewall protections against the AI-discovered php2shell flaws. The new detection checks a request together with the website server's response; Cloudflare says it deployed mitigations before disclosure and observed attackers changing their attack requests to evade them. Calif and Wiz found the flaws with OpenAI and Google model assistance, and OpenAI helped PHP and the researchers verify them and develop patches. PHP released fixes in supported versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; AWS subsequently said exploitation was widespread and identified an attempt four days before public disclosure.
Negative - AWS reported broad exploitation of the PHP flaws and attacks before disclosure, confirming that attackers had turned the vulnerabilities into a working intrusion route.
