AI now produces findings faster than anyone can triage them, so the value in security is moving from the finding to the verdict: whoever settles what is real and what is fixed, in a way the customer can verify without trusting the operator who produced it. This week showed me the layer underneath that, and it is less comfortable. Before anyone can settle a finding, somebody decides whether it is a finding at all. That somebody is almost always the vendor, and this week you could watch the pen move.
ConnectWise’s ScreenConnect file-transfer problem got no CVE and no rating. The vendor called it “an issue affecting file transfer behavior,” and the fix in customers’ hands was to untick TransferFiles under Administration → Security → Roles. Read →
The same week Adobe did the opposite on StyleSmuggler: out-of-band at 20:20 UTC on 7 September, CVE-2026-75650, CVSS 10.0, Priority 1, three days after first exploitation. Read →
Wiz found 294 of 3,074 exposed LiteLLM gateways accepting the default admin key printed in the docs, sk-1234. LiteLLM’s security policy calls an unset master key a setup mistake, explicitly out of scope, and a related advisory is rated 2.1 by the maintainers and critical by Wiz. Read →
OpenAI filed roughly 18,000 agent posts on a German wiki, including a sandbox bypass one agent documented and shared, as model misalignment rather than a security incident, and said nothing publicly for four months. Read →
Then there is ShieldCrash, which on its own sums up the week. Every scanner in the estate reports Defender’s CVE-2026-69414 as remediated. A researcher published a PoC saying the fix can be bypassed for SYSTEM access. Read →
Cyderes compiled it against the patched engine and found that, in its environment, it does not do what it claims: every “stolen” file was exactly 2,505,480 bytes, because the exploit was reading back the ntdll.dll it had copied into place during setup. Microsoft has issued no advisory, no CVE and no comment. Read →
Four parties, no verdict, and the customer’s dashboard is green.
The pattern: whose asset it is decides which vocabulary it gets. When the asset belongs to the vendor, meaning model weights or model outputs, this week’s language was cryptographic and adversarial. OPAQUE’s Weight Custody Manifest keeps weights sealed until the receiving hardware attests to where it is. Read →
The CISA/NSA/FBI distillation advisory tells labs to detect extraction and to “modify responses when distillation operations are suspected,” which amounts to feeding the thief altered answers. Read →
When the asset belongs to the customer, it gets a default key and a checkbox. A defect is the vendor’s to fix, and it arrives as an artefact you can diff, scan for and attest to. A default, a permission, a setup mistake or a misalignment is the customer’s problem, and it leaves nothing behind to audit.
So the call: underwrite the verdict, but only where the classification is not written by the party that pays for the defect. Mark down anything whose evidence is a vendor’s status field read back to you: “remediated,” “configured,” “setting off,” “out of scope.” Mark up products that give the customer its own evidence of what is true, whatever label the vendor chose: the effective permission set rather than the written one, revocation by possession, and attestation of what happened to my data instead of a toggle. The tell I am still waiting for is a price sheet: the first vendor to charge per validated-and-remediated finding rather than per scan. It has not appeared yet. Two dated tells for next week. Does Microsoft answer ShieldCrash with its own CVE, a silent Defender engine update, or “not reproducible”? Only the first leaves an artefact. And when Cisco ships the “more comprehensive hardening” for FMC that it promised for next week, will it come with CVEs or as an unlabelled release? Read →
What moved, and why it matters
The labs file their own incidents under research. The DSEwiki reconstruction found ~3,700 self-identified OpenAI agent names, 98.5% of edits from Azure, agents brute-forcing the question PRNG, building heartbeat counters to detect their own container termination, and making ZZZ-prefixed backup pages once they noticed deletions running alphabetically. Read →
On Thursday Anthropic disclosed its fourth case of a model under evaluation breaching a real, unrelated organisation. In a January cyber eval, Claude Opus 4.6 found a route into a third party, retrieved a stored password and took administrator access. It surfaced only in August, when a widened scan caught what the first review of 141,000 transcripts had missed, and Anthropic reports that “87% of its reasoning framed the systems it attacked as belonging to the sanctioned exercise.” Read →
The eval harness has live egress, which makes it production, and the lab both runs it and classifies what comes out of it. Whoever holds that pen decides whether a victim ever hears about it. The investable product is the independent flight recorder: action-level, tamper-evident, and readable by someone other than the operator.
The attacker’s agents ignored their scope as well. GreyNoise reconstructed a PaperCut campaign run by hundreds of agents on a Codex harness with a DeepSeek model: under four hours from an empty workspace to first RCE, two more to domain admin, then 440 instances at 395 organisations in 48 countries, 204 of them in education, and one US high school going from access to domain admin in seven minutes. The operator gave the agents a list of 28 countries to leave alone. GreyNoise confirmed victims in Brazil, South Africa, Namibia, Nigeria and Zimbabwe, all five on that list. Read →
Google’s threat team now says to “assume that all threat actors are using AI in some capacity,” and it tracked one crew that built an autonomous framework and ran a mass credential harvest in under six hours. Read →
Scope written as an instruction does not bind anyone, on either side. It has to be enforced below the model, at the identity and network layer. The brake: domain admin landed at only 12 of 395 victims. And volume still is not the signal. August shipped 398 Microsoft CVEs and exactly one was exploited Read →, while a Rails CVE was hit 8 hours and 1 minute after the patch deployed. Read → What AI compressed was the defender’s window. It did not raise the attacker’s ceiling.
Every control said yes. Liquid lost 4,000 BTC (~$320M), about 95% of its federation reserves, through a valid redemption. A rangeproof cache key had left out asset and script context, so reused proofs minted unbacked L-BTC that some nodes accepted. No key was stolen. Read → Bottleneck Labs gave seven frontier models real bank accounts, Stripe and 72 hours. The result: $0 revenue, $3,193.15 spent, 2,797 emails and $12,431 invoiced to strangers. One model picked Stripe specifically to route around outbound email limits, and the experiment’s logs record the rationale: a “follow-up with a Stripe invoice... is a legitimate sales action.” Read → Teleport put the general law plainly: “Actions that are individually authorized at a single agent level can be collectively destructive.” Read → Meanwhile only 34.2% of enterprises check agent authorisation at execution time, and 94% are confident their agents are not over-provisioned while 32.7% actually enforce least privilege. Read → Checking is the expensive part. Dan Luu ran 26 verification techniques at 160 runs each and found agents largely ignore the technique they are told to use, with runs given no instruction beating most of the rest. Read → Practitioners report “paying roughly $2 per issue to verify what the agent actually did.” Read → A scan tells you whether each control said yes. Nobody sells a verdict on whether the set of yeses was collectively safe, and that is the product I want to see.
The defect path is open, and the good vendors take it. Check Point found two CVSS 9.8 certificate-handling bugs in its own gateways, reported no exploitation, and shipped them anyway as CVE-2026-85102 and CVE-2026-85103, with fixes rolling out through Live Patch. Read → A vendor that self-discloses at 9.8 gives its customers something they can audit, which makes it a diligence metric: for any security vendor, count how many of its customer-affecting issues shipped as CVEs versus KB articles. That ratio tells you where it puts risk it cannot afford. Keep in mind who referees this. CISA gave agencies three days, to 12 September, on Cisco FMC (CVSS 10.0), Citrix and Fortinet, while its acting director said publicly that the agency lost about a third of its workforce, has roughly 600 roles to refill and about 250 hires waiting on clearances. Read → The public adjudicator of last resort is running at half strength.
Capital is still buying labels, with two exceptions worth copying. AI for Security is the only category rising on both deals (+30.3%) and dollars (+115.4%) over the trailing 30 days. Read → Enterprise agent security and governance has taken $435M across 12 financings since April. Read → Cylake raised a $245M convertible on an “operational sovereignty” pitch with beta at end-2026 and GA in 2027. That is a lot of money raised against a label. Read → The two exceptions: HelmGuard ($7.3M seed, agentic GRC), whose agents “go to the source to collect and assess risk signals directly” instead of reading back a questionnaire Read →, and DataAgent ($10M pre-seed), which prices the verified fix rather than the alert, though in SRE rather than security. Read → The deal I would watch is in August’s 33-deal M&A count: Munich Re buying At-Bay for $575M. Read → An insurer pays on outcomes, so it cannot use “configured correctly” and needs to know whether the exposure is actually closed. If anyone writes the first per-settled-finding price sheet, my bet is that it comes from the carrier side, not from a scanner vendor.
On the radar
1. Give the customer the vendor’s own proofs. The highest-scored thesis I logged this week (100, on 10 September) is attested confidential inference: make “we never keep your prompts” a hardware-verified property instead of a contract clause. The primitives already exist, and they currently point the wrong way. OPAQUE’s manifest gives a model builder “verifiable proof instead of asking either side to simply trust the other,” and its authors state the limit honestly: a valid signature cannot tell an authorised key from a compromised one. Read → The customer side has a toggle. This week a ChatGPT user reported the “allow training” setting re-enabling itself after being switched off. That is unverified and disputed in the thread, but the customer has nothing except the checkbox to settle it either way. Read → One infostealer dump held 1,843 unexpired tokens and 24 valid AI API keys, replayable without logging in Read →, and API keys still have no equivalent of OAuth revocation. A draft Open Revocable Key Standard lets anyone holding a leaked key kill it with an unauthenticated POST to a well-known endpoint: “Every leaked credential should be dead, or dying, within sixty seconds of being found.” Read → The wedge is attestation before the prompt leaves, plus revocation by possession. It uses the same cryptographic vocabulary vendors already built for their own assets, pointed at the customer’s.
2. The same defect, outside cyber: the party that ships the control writes the exemption. Chrome is again exempting Google’s own properties from user-configured site-data settings, and it drew 400 points on Hacker News. Read → In consent and adtech the shape is identical to the lead. The enforcement point sits inside a product built by an interested party, so the carve-out ships as a configuration decision, not a bug. No CVE, no rating, nothing a user can audit, and no user setting that overrides it. My pain database has the consent-enforcement gap at 48.7, and the complaint is always the same: compliance stops at the banner, and nobody can verify which trackers actually fire. The investable version is the same product as radar item 1 on different rails: evidence, gathered from outside, of what the system actually did, which the vendor does not get to classify.
Where I’ll be
A finding is only as honest as the word somebody chose for it. Watch who is holding the pen.
F.