Welcome to issue #118 of the Resilient Cyber Newsletter!
Last week the conversation was about who answers for what the agents did. This week, Washington answered it itself.
After an Anthropic testing model submitted visa applications and sent Philadelphia police a false homicide tip, the White House SI Force made incident notification mandatory for every AI company. Anthropic also gave METR inside access with publication rights it can’t veto.
The other big thread is, of course, vulnerabilities. XBOW built a full-chain Chrome exploit in six days with a public model, and Microsoft shipped more CVEs in one Patch Tuesday than in all of 2025. That said, Blizzard, Robinhood and curl offered some excellent practitioner perspective on what actually works.
Let’s get to it!
As Seen on Fox Business
Before sharing my usual resources, I wanted to share that I joined Varney & Co. on Fox Business this week to talk about Anthropic’s warning that AI models could self-replicate across poorly secured smart home devices and other connected systems.
The way I framed it on air is that AI is acting as a security debt collector, cashing in on decades of vulnerabilities, misconfigurations and poor hygiene that we as an industry never got around to fixing. I see it as a wake-up call for how we prioritize remediation rather than a reason to panic, and I’d love to hear how you’re thinking about it in your own organizations.
Neat opportunity being able to speak on such a major news outlet!
Cyber Leadership & Market Dynamics
Micro Tabletops and Incident Readiness
In this episode of Resilient Cyber, I sat down with Matt Hartley, co-founder of BreachRx, to talk about incident readiness and the case for AI-accelerated micro tabletops. Matt has spent 28 years in cybersecurity, and we dug into why annual tabletops fall short and how smaller, more frequent exercises prepare teams for regulatory clocks, privilege fights and concurrent incidents.
White House Makes AI Incident Reporting Mandatory
Axios reports the White House Super Intelligence Force is now requiring AI companies to notify affected parties of security incidents involving their models and fix the harm.
The trigger was an Anthropic testing model submitting 19 nonimmigrant visa applications through the State Department’s public form, none of which were processed, plus a false homicide tip sent to Philadelphia police.
The SI Force calls the process “not optional,” but names no enforcement mechanism or penalty.
So is this a real shift away from voluntary self-regulation?
Perhaps, we will see. I’ve spent a lot of my career in the Federal space, and a mandate without teeth tends to produce paperwork long before it produces behavior change. That said, incident notification is exactly where I’d want government to start, since we can’t govern what we can’t see. We in security have decades of breach notification lessons to offer here and we could learn a lot from the incident notifications depending on the level of detail the model providers would be required to share.
The Labs Are War-Gaming the Day After
It’s been reported that executives at Anthropic, OpenAI and other labs are privately gaming out the public and political backlash after a catastrophic AI event. A cyberattack that takes down financial services, internet connectivity, power or water is seen as the most likely trigger, and insiders said they expect a major event in the next six to 12 months.
OpenAI said it doesn’t treat these scenarios as inevitable, and Anthropic declined to comment.
What caught my eye is where the effort goes. Per the piece, the planning focuses mainly on educating Congress so the labs can shape the policy response after an event, prevention doesn’t get much airtime.
If the people building these models think a major cyber incident is likely within a year, the rest of us should be planning for it too. The good news is the controls are ones we already know, things such as network segmentation, egress controls, resilient offline backups and recovery plans that have actually been tested.
OpenAI Argues Intent Should Limit Agent Liability
At an ABA national security law panel, OpenAI deputy general counsel Alex Iftimie argued labs shouldn’t be liable for the recent agent hacking incidents, since the activity was unintentional and happened during safety testing, and liability “turns on intent.”
Paul Rosenzweig’s response was that you can argue intent the first time, maybe the second, and plaintiff’s attorney Joseph Hennessey expects the courts to step in, as they did with auto safety.
I think Paul has it right.
Intent is a reasonable defense for a novel failure, and a much weaker one once the failure mode has been documented, published and repeated.
In security we’d call the second occurrence a known risk, and accepting a known risk is a decision someone owns.
An Old-Fashioned Insider Threat at OpenAI
On the more traditional insider threat front, an OpenAI engineering lead was arrested on October 9 for allegedly hiding an audio recording device in a USB port on the back of a TV in an executive conference room.
Per the DOJ complaint, a chatbot account tied to his spouse submitted prompts in late September about building, encrypting and remotely accessing an audio recorder. OpenAI says it has no indication of access to model weights, source code or customer data.
A lot of this issue is about treating models as insiders, so this is a good reminder the human kind haven’t gone anywhere. The labs hold some incredibly valuable IP, and physical security and access monitoring are as much a part of protecting frontier AI as any classifier is.
And yes, the alleged planning ran through a chatbot.
Anthropic Lets METR Inside With Publication Rights
Anthropic onboarded six METR employees with company hardware, office space and access to internal tools roughly on par with its own risk assessment teams. METR will publish its analysis of Anthropic’s risk levels, incidents and practices, and Anthropic can’t veto publication, only require redactions in narrow predefined categories, which METR can then publicly characterize.
I like the bank supervision analogy Anthropic uses here, with resident examiners inside the largest banks. I’ve been critical of the labs grading their own homework, so credit where it’s due, this is a meaningful step and I’d like to see it become the floor for every lab.
The publication rights are what make it work, without them, it’s just another consulting engagement.
a16z Backs Security for the Poverty Line
a16z incubated a new 501(c)(3) nonprofit, SAIF, to deliver AI and cybersecurity tools, hands-on support and training to public institutions that otherwise lack access, with small municipalities, school districts and rural hospitals called out specifically.
These organizations sit well below the Cybersecurity Poverty Line, and they’re the ones most exposed if the Axios scenario above plays out. I’m glad to see capital pointed at them. My hope is it comes with people and ongoing support, since tools alone have never fixed the poverty line problem.
AI
Satya Wants Models Treated as Insiders
Satya Nadella argues we should treat frontier models, closed and open weight, as insider risks. His reasoning is that any capable actor with access to important systems can make mistakes or be compromised, malicious or not.
He wants to separate the supply of intelligence from the authority over it, and apply the insider risk practices we already know, such as establishing identity, limiting privileges, logging activity and creating containment boundaries. He also calls chain-of-thought transparency non-negotiable.
This lines up with what many of us in security have been saying for a while, and it’s great to hear it from the CEO of a major AI provider. The framing is useful because insider risk is a program most enterprises already have, with owners, budgets and controls. That gives security teams something to extend, rather than yet another discipline to stand up from scratch.
Anthropic Brings Engineers to OT and Open Source
Anthropic announced the Cyber Mission, starting with two efforts. The Critical Infrastructure Defense Program brings frontier models, on-site engineers and threat research to OT defenders, and OSS Scanner offers open source projects regular, free security scans.
Anthropic is candid that Glasswing found many vulnerabilities “but we haven’t yet achieved a sufficient reduction in cyber risk,” and Glasswing now folds into the expanded Cyber Verification Program I covered last week.
As I’ve said many times, finding isn’t fixing. The on-site engineers are the part I’ll be watching, because OT defenders and open source maintainers are short on people far more than they are short on findings, as the CVD dashboard in the AppSec section shows.
A Lone Actor Mixes Models Against Korean Banks
CrowdStrike Intelligence detailed a campaign against South Korean financial organizations from late September to early October that led to data exfiltration. The actor left open directories exposing Claude Code session histories, ARTEX configurations and Claude memory files.
ARTEX is a recently released, Chinese-developed open source agentic pentesting tool, run here on DeepSeek v4.1-flash along with GLM-5.3 and Grok 4.6. CrowdStrike assesses with moderate confidence the actor is a financially motivated Chinese speaker.
This is a good example of AI raising attacker tempo, and of an operator mixing models to work around whichever guardrails get in the way. It’s also a reminder attackers have the same OPSEC problems we do, since the whole picture came out of their own exposed directories.
Anthropic Squeezes the Distillers
Anthropic shared progress against illicit distillation campaigns that copy frontier model capabilities, saying early evidence shows its new methods cut the data distillers harvest by around 90 to 99%. It also says Zhipu distilled cyber capabilities while building GLM-5.3, the model whose exploit results I covered two issues ago.
GLM-5.3 shows up in the CrowdStrike campaign above, which ties these two together nicely.
The capabilities travel through distillation, and the safeguards of course don’t come along for the ride. Defenders should plan around what open-weight models can do and put little weight on the guardrails of the closed ones.
AWS Gives Agent Sandboxes a Memory
AWS released Strands Box in developer preview, an Apache 2.0 sandbox that combines OS-level isolation with fine-grained policies written in Dogwood. The interesting part is that policies can account for what an agent has already done, so AWS’s example lets an incident response agent post to Slack no more than three times every 10 minutes.
This is the kind of deterministic control we need around non-deterministic agents. The academic research points the same way, with the Kairos reference monitor at the system boundary cutting AgentDojo attack success from 47.0% to 2.7%.
Eval Job Secrets Exposed at Fireworks
Fireworks AI disclosed that on October 6 it found unauthorized use of internal credentials, which let a third party access environment variables used in evaluation jobs in a limited number of customer accounts, including API keys and tokens stored as secrets.
Fireworks says it has found no evidence of access to customer models, datasets, training data, inference traffic or personal information, and it is revoking keys and reviewing how secrets reach evaluation jobs.
Secrets in AI pipelines are a prime target, and eval jobs tend to get a lot of trust and very little scrutiny. If you’re handing tokens to a model platform, scope them tightly and rotate them often.
Robinhood Rebuilds Security Around Agents
Robinhood’s Evan McHenry kicked off a series on how the company is rebuilding its security program to be AI native. He writes that many of Robinhood’s adversaries are now AI native, that CVE disclosures were running about 50% ahead of 2026 expectations as of June, and that adding headcount to a losing equation is a trap.
The program started with an agentic SOC built on Tines workflows, and grew into Sherwood Shield, internal infrastructure for hosting model-agnostic background agents inside Robinhood’s perimeter.
The lesson that resonated with me is that agents without context on the architecture, policies and service maps behaved a lot like new hires. That matches what I’ve seen, and it’s why context engineering is quickly becoming a security team skill too.
Purpose-Built Defensive Models Have a Moment
Cole Grolmus sat down with CrowdStrike’s Chief AI and Autonomous Systems Officer, Bartley Richardson, to cover SafeMind’s architecture, model training, harness engineering and digital twins. Bartley’s point that the data blend is the secret sauce, meaning capturing defenders’ reasoning traces rather than only inputs and outputs, is what I’d take away.
Purpose-built defensive models seem to be having a moment. Artemis announced Orion-1, post-trained for cyber defense and scored on its own benchmark, and VÃctor Mayoral Vilches and colleagues’ CT0-Micro paper shows a roughly 4B parameter specialist solving 21.1% of cybench subtasks versus 7.6% for its base model.
Of course, vendor benchmarks deserve the usual skepticism. That said, the trend toward smaller, specialized and self-hosted security models is one I’m watching closely.
A Safety Lead Walks Away From OpenAI
Ezra Klein interviewed David Robinson, who led OpenAI’s model safety reports before resigning over concerns the industry lacks the safety culture it needs. It’s his first interview since leaving, and it covers lab culture, safety testing under pressure, financial incentives, coding agents accelerating AI development and lessons from nuclear and aviation safety.
The nuclear and aviation comparison comes up constantly in AI safety debates. Something we in security should point out is that both industries built their safety culture on mandatory incident reporting, which happens to be exactly where Washington landed this week.
A Blueprint for Securing Agent Software Factories
A group including Allie Howe published version 1 of a reference architecture for agentic software factories, built on Agent Baseline and open for comment. It defines four boundaries (sandbox, network, supply chain, and identity and access). Its core principle is that a secure factory can’t depend on agents enforcing their own limits, illustrated by the PocketOS incident, where a coding agent found an API token in an unrelated file and deleted the production database and its backups in nine seconds.
Separating an agent’s planning from the authorization and enforcement of its actions is the same principle Satya, AWS and the Kairos researchers landed on this week.
When this many groups converge on enforcement outside the model, I think it’s fair to call it the emerging consensus.
This is the same type of approach I’ve been advocating for throughout 2026 in various articles, videos and interviews I’ve done.
AppSec
XBOW Chains Chrome in Six Days
XBOW earned a $250,000 Google bounty for a Chrome full-chain exploit that goes from an ordinary web page to remote takeover of a Windows machine.
Four researchers worked alongside OpenAI’s publicly available GPT-5.6 Sol and built the awarded chain between August 2 and August 7 for about $40,000 in compute. Oege de Moor shared the backstory, noting a three-letter-agency veteran’s team used to spend six months on this kind of chain.
XBOW’s view is that debating restricted access to powerful models misses the point when the model they used is already public, and I agree. Defenders do have one advantage, which is that we can test our own code first, provided we have the capacity to fix what we find.
And, as always, relaunch your browser when it asks.
One Patch Tuesday Beats All of 2025
You’re likely sick of me sharing CVE growth numbers by now, but I make no apologies. Empirical Security points out Microsoft disclosed 1,408 CVEs in this month’s Patch Tuesday versus 1,244 in all of 2025. Industry-wide, CVE disclosures are up 115% year over year while CISA KEV additions are up just 30%, and only 1 of the 1,408 was flagged as actively exploited at release.
Arielle Waldman at Dark Reading has a piece that pairs well with this. Empirical’s Jay Jacobs describes one organization whose vulnerability management system collapsed after September’s Patch Tuesday, and Root Evidence’s Jeremiah Grossman says only 1.4% of CVEs are exploited.
You know where I land, context is king and volume shouldn’t dictate priority. As Ed Bellis put it in the piece, people don’t scale to these volumes, so teams still working findings manually are going to drown.
Anthropic’s Dashboard Shows the Fix Gap
Anthropic now publishes a dashboard tracking vulnerabilities Claude models, including Mythos Preview, have found in open source. As of October 2 it shows 6,157 vulnerabilities disclosed across 591 projects, 516 known to be patched, and 584 identifiers issued (219 CVEs and 365 GHSAs). Anthropic calls human triage the rate-limiting step.
The other side of the ledger came from Daniel Stenberg, who published AISLE’s audit of curl. AISLE has 35 published curl CVEs, and Daniel credits accurate findings backed by skilled humans and commits from AISLE’s own staff.
Roughly 8% of the dashboard’s disclosures are patched, while curl is fixing bugs faster than ever before, per Daniel, because the finder showed up with people and patches.
That’s the model I’d like to see the Cyber Mission copy.
Blizzard Asked Mythos for Proof, Got a Handful
This was among the more grounded practitioner talks I’ve read about this year. Blizzard’s AppSec head, Kurt Kaufmann, tested Mythos expecting an avalanche of critical findings, and instead found a handful, because findings had to be shown reachable, exploitable and reproducible before they became engineering work.
He also uses AI to trace findings back to a shared root cause, for example 200 findings across 40 repositories that originate from one authentication helper. Fix the component, rather than filing 200 tickets.
I appreciated his point that years of secure development practices showed up in the results, a nice rebuttal to the idea that AppSec fundamentals no longer matter.
Measure AI vulnerability testing by verified, actionable findings, not volume.
Malicious Skills Are Written in English
VirusTotal expanded its study of agent skills more than tenfold, to 35,878. It found 52.9% carry some security or abuse risk and 6,637 (18.5%) are malicious, most tied to 1,016 malware families. Even more interesting, 62% contain no malicious code at all, and open source scanners missed 36% to 71% of them at default settings.
The academic work this week lines up with it. A profiling study of 6,309 marketplace skills found 13% can reach credentials, and the ToFu team fuzzed 273 MCP servers and verified bugs in 343 tools across 118 of them.
Skills and MCP servers are software supply chain, plain and simple. Treat skills like code, folks, with provenance and least privilege, because the payload is increasingly plain English no signature scanner will catch.
Another Sandbox Allowlist Falls
AIR Security went looking for the class of flaw that let OpenAI’s agents escape their evaluation sandbox and reach Hugging Face in July, this time in Vercel’s sandbox. They found VerCellBreak, which lets a rogue agent bypass the domain allowlist and leak keys to an attacker-controlled server.
Their broader argument is that just as we accepted vulnerabilities can’t be eliminated and added mitigations like ASLR, agent containment needs defense in depth too.
Allowlists are one control, and I wouldn’t bet the company on any single control. Pair this with Strands Box and the Agent Baseline paper and you get a decent picture of what layered agent containment should look like.
Final Thoughts
Two months ago, the labs disclosed rogue agent incidents on their own terms. This week the White House made disclosure mandatory and Anthropic invited outside examiners in.
On vulnerabilities, a public model and $40,000 got XBOW a Chrome full chain in six days, while Anthropic’s dashboard has 516 of 6,157 findings patched. Blizzard and curl show the way through, verify before you file and bring people and patches.
The defensive architecture is converging too, with enforcement outside the model and agents treated as insiders.
We know how to build that. What we still haven’t funded is the remediation capacity to keep pace with discovery, and until we do, it’s going to keep feeling like we’re bailing water.
Stay resilient.