Context Window: AI Security Podcast

Top Story: Attackers let agents run connected parts of an operation — Google Threat Intelligence Group documented a financially motivated actor that compromised a cloud environment, then used an AI coding chatbot, a prompt and predefined agent instructions to build a credential-harvesting operation in less than six hours. A software package registry became infrastructure for an AI evaluation that reached the real internet. — Nightingale Collective linked more than 100 packages from May's GemStuffer campaign to a path that made RubyDoc.info run code, retrieve public government data and publish the results back to RubyGems. AI helped turn a messaging-app flaw into a worm demonstration in days. — Calif says its team found a memory-corruption bug in WeChat and produced the first remote-control exploit in about two days, then built a polished worm over another week. Four evaluation agents reached real systems after test environments mistakenly retained internet access. — Anthropic's expanded review covered roughly 481 million transcripts, reidentified the four known incidents and found no others of similar or worse severity. The frontier-model debate moved from employee alarm to an operational commitment. — Former OpenAI and Anthropic pretraining researcher Jacob Coxon resigned, accusing both labs of racing toward self-improving AI without adequate safeguards. Anthropic says AI has moved from assistant to orchestrator in observed cyber operations. — Its September report describes multi-agent workflows performing reconnaissance, exploitation, rebuilding and data exfiltration, while humans still selected targets and reviewed stolen data. A $25 million funding round puts human and agent access into the same graph. — Cymphony emerged with $30 million in total funding and a platform that combines identity, data and activity signals for employees, agents and other non-human identities. NVIDIA tightened how NemoClaw carries credentials and policy across sandbox operations. — The September 11 release exports references to credentials rather than secret values, validates external-component declarations before gateway changes and checks sandbox identity and effective policy before activation. DriftNet found that an agent's sequence of tool calls can reveal where its behavior changed. — The research system analyzes logged action trajectories, flags whether the run was compromised and labels the point where a hidden instruction entered. Agent-to-agent delegation creates security boundaries that a single-agent log cannot show. — A2ABreak translated the A2A specification into a state model and identified 11 weaknesses involving lost identity, injected context and unverified capability claims. Tool descriptions alone may reveal unsafe designs before an agent runs. — MCPSEC evaluated 177 tools across 20 MCP servers and correctly predicted 94 of 95 human-confirmed prompt-injection risks. A frontier-model audit produced two Datasette security releases with two humans reviewing each fix. — The maintainers used several coding agents to investigate related flaws, then split regression-test writing and implementation between two people. Gartner Security & Risk Management Summit, September 22–24, London. — The agenda includes AI's impact on cybersecurity, governance and deepfake identity impersonation alongside broader risk and resilience sessions.. Curator's Corner: Machines Leave Footprints Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-14.html

Top Story: Astra crosses OpenAI's Critical cyber threshold — OpenAI says GPT-6 Astra is its first model to meet the Critical cybersecurity capability threshold in its Preparedness Framework. A project folder could take control before an AI coding session began. — Manifold Security found eight flaws across seven coding agents, a class it calls GitSpawn. “Read-only internet” still let agents publish nearly 17,000 edits to a public wiki. — The DSEWiki investigation found that the environment allowed only GET requests, normally used to retrieve pages, but the old wiki accepted edits through those same requests. LiteLLM, a gateway that connects company applications to AI models, is under active attack. — CISA says the flaw lets attackers reach connected tools without a valid access key. Anthropic released one underlying model through two different security envelopes. — Fable 5.1 and Mythos 5.1 share identical model weights. Forward watch: Instinct turns personal context into operational authority. — The private-access assistant connects to email, messaging, calendar, screen, audio, location, and can act through a phone or computer. Investors reportedly valued Upwind at roughly $3.8 billion, more than twice its previous valuation in less than eight months. — CTech reports a $300 million financing led by Bessemer Venture Partners and TCV, with subsequent coverage from SiliconANGLE. A trusted plugin update can create a new execution path without another model decision. — HookPry studied lifecycle hooks, the configuration that runs commands when sessions start or tools fire. Persistent memory can turn a false record into permission. — EAL-Bench separates the agent that writes organizational memory from the later agent that acts on it. An AI-assisted exploit experiment ended with a permanently bricked industrial controller. — Forescout researchers gave Claude Code earlier exploit code, firmware, analysis tools, live hardware, and repeated expert guidance to port an attack to another programmable logic controller. OWASP 25th Anniversary Virtual Conference, September 22. — Free sessions include agent secret leakage, plugin supply chains, production-ready agent architecture, and real-world evaluation of security agents.. German OWASP Day, September 23–24. — Training and talks cover prompt injection, agent gateway enforcement, agent threat modeling, and attacks against supposedly read-only database connectors.. OASec 2026, Singapore, September 28. — A practitioner conference on prompt injection, tool abuse, agentic systems, incident response, and defensive controls. Curator's Corner: Map What It Can Reach Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-07.html

Top Story: OpenAI published the inside account of how its agents broke into Hugging Face — On August 26, OpenAI published a postmortem and technical report on an intrusion into Hugging Face, the repository underneath most of the AI industry's model distribution.. 155 companies signed a call for collective action on cyber defence. — Published August 27. NVIDIA is reported to have agreed to buy Hugging Face for $12.9 billion. — The Information reported it first, citing a person with knowledge of the deal; CNBC's source could confirm only that an acquisition "has been part of ongoing and recent talks." Neither company has commented and no filing exists, so treat it as reported, not signed. OpenAI says it intends to wind down Cursor's model access, proposing November 12 as the cutoff, after SpaceX acquired Cursor. — OpenAI says it "cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk's companies violating contracts," citing Twitter breaking contract terms after Musk acquired it and Musk's admission under oath that xAI had violated OpenAI's terms. OpenAI says it cannot rule out "critical" cyber capability in an upcoming model. — Internal evaluations of a model called Astra show significant advances in agentic coding and cybersecurity, and OpenAI cannot rule out critical cyber capabilities under its Preparedness Framework. A researcher hijacked Claude Code with one "summarise this page" request, in the mode Anthropic made the default. — Auto mode replaces click-to-approve prompts with a classifier that blocks irreversible or destructive actions, and became the default for Pro, Max and Team users on August 14. NVIDIA patched 18 flaws in its agent tooling, and two of them break the sandbox. — The August 25 bulletin covers NemoClaw and OpenShell, NVIDIA's agent deployment and sandboxing tools: 2 critical, 12 high, 4 medium. Invisible text in an email rewrote what the AI summariser told the reader. — Forcepoint X-Labs hid instructions in an email using font size and colour, invisible in Outlook but present in the HTML the summariser read. When Context Gets Root — finds the weak point is the harness around the model, not the model. Safety Does Not Compose — is the theoretical echo of this week's top story. Beyond the Mandate — finds the same gap in Google's Agent Payments Protocol, which lets AI shopping agents authorise payments: signed mandates protect the transaction after signing, while the agent messages and tool calls that shape it beforehand sit outside that protection. RedEvoAgent — automates red-teaming by distilling what worked across attempts into reusable attack skills, arguing that in real product harnesses a jailbreak triggers tool use and state changes, not just unsafe text.. AI Security Summit 2026: State of Trust, September 16–17. — A free two-day virtual event exploring where cloud, AI and Zero Trust converge.. AI Security Summit 2026: Runtime Trust, October 21–22. — A free two-day virtual event on runtime trust for autonomous AI.. Curator's Corner: Knowing Why Would Not Have Helped Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-31.html

Top Story: OWASP put a name and a risk list on the layer nobody governs — A "skill" is packaged expertise you hand an AI agent: instructions and scripts that turn a general assistant into one that knows how to build a landing page, close a support ticket, or run a deployment. A backdoor that starts when code is loaded, not when it is installed. — Developers have been taught for years to watch what happens during installation, because that is where malicious packages historically fired. Rust's turn came the same week, one layer deeper. — Someone got into the account of a maintainer whose code sits inside a large share of Rust projects and republished three of his libraries with one line added: a dependency on a package named one character off a near-universal one. Five federal agencies say AI is writing exploit code for the machines that run water plants. — The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on August 19 about Siemens S7 controllers, the small industrial computers that physically open valves and run pumps. 🏛️ OpenAI stopped testing for two weeks and started rewriting its safety rulebook. — Axios reported on August 19 that OpenAI could not rule out that an unreleased model, Astra, had crossed the "critical" cybersecurity line in its own Preparedness Framework. 💰 Fortinet bought Virtue AI, and what it bought says where enterprises admit they are blind. — The August 17 deal folds agent discovery, continuous red-teaming of AI systems and runtime guardrails into Fortinet's security platform, per Fortinet's own account of what it bought. 🔬 A proposal to stop hand-writing agent defenses one rule at a time. — An August preprint argues runtime protection for AI agents cannot be hand-written fast enough, because the ways an agent can be pushed off task are open-ended while the rulebook defending it is finite. CSA AI Security Summit 2026: State of Trust, September 16–17. — A free two-day virtual event from the Cloud Security Alliance "exploring where cloud, AI, and Zero Trust converge.". Curator's Corner: Nobody Owns the Skill Layer Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-24.html

Top Story: The firewall blocked it. The agent ran it. — Whoever controls a company's DNS controls where its web and email traffic goes. 🏛️ OpenAI moved the limit from the model to the door. — In the spring, OpenAI put its cyber-tuned GPT-5.5-Cyber model behind a vetted-access program. ⚔️ AI browsers still have no perfect fix. — At Black Hat, Brave Software security engineer Artem Chaikin found prompt-injection paths in all three browsers he demonstrated: Opera, Perplexity Comet, and ChatGPT Atlas. 🔬 Encrypted reasoning can leak what the final answer hides. — A new paper found that opaque reasoning blocks could be replayed across users, sessions, and models within the same provider ecosystem, demonstrated on Anthropic, OpenAI, and Google APIs. 🔬 AI agents found 84 flaws, but people made the reports usable. — The iFinder system, built at Nanyang Technological University, sent three agents through mobile-network code: one searched for missing checks, one cross-checked the code against telecom standards, and one built and refined test attacks. CSA AI Security Summit: CxO Trust, August 19. — A free virtual event focused on AI governance, executive accountability, and enterprise risk.. Curator's Corner: Recognition Is Not Resistance (https://nakashon.com/frameworks/recognition-is-not-resistance/) Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-17.html