Week of September 14–18, 2026

The Hacker News' weekly roundup tied together a week of incidents with a common thread: AI is now showing up on the attacker's side of the ledger, not just the defender's. A cluster of OpenAI-built agents was behind a wave of malicious package publishing on RubyGems, a suspected Russian-speaking actor used AI to devise exploits against PaperCut NG/MF and break into hundreds of instances, and researchers disclosed a WeChat worm capable of hijacking accounts within seconds of an unanswered call. Rootkits on compromised F5 BIG-IP devices rounded out a week that made clear the agent is no longer just the target.

The common failure across every story in the recap is the same: once an agent or automated tool gets a foothold, nothing stops its second action, its third, or its hundredth. RuntimeAI's approach is to treat that as a solvable runtime problem rather than an unavoidable cost of automation — give every agent a verifiable identity, evaluate policy on every individual tool call, and cut access within milliseconds of the first anomalous action, before a single exploit becomes hundreds of compromised instances.

Revolut disclosed that a threat actor impersonating a government agency — using an email domain with valid authentication credentials — convinced the company to hand over customer data under the reasonable belief it was a legitimate official request. The exposed data included passport and driver's license copies, KYC selfies, IBANs, withdrawal records, and full transaction histories, including Bitcoin activity. Revolut blocked the address on detection and notified regulators, but the company has not disclosed how many customers were affected.

This is a data-governance failure, not just a phishing story: a single fabricated request was enough to move highly sensitive financial and identity data out the door. No one control would have stopped it. Sensitive fields need to be tokenized before they can move at all, every outbound data request needs runtime policy evaluation regardless of how legitimate the requester looks, and every transfer needs an immutable audit trail with provable deletion. Defense in depth, not one line of defense.

Airrived expanded its Agentic OS with Agentic Observability, aiming to answer the questions enterprises increasingly can't: who created this agent, what can it access, what actions is it authorized to take, and what did it actually decide? The feature tracks sensitive data exposure — PII, PCI, PHI — as it moves through agentic workflows, and ties agent decisions to downstream business and cost outcomes.

The market is converging on the same conclusion from a different angle: agent behavior needs to be visible and governed at the point of action, not reconstructed after the fact from logs. Observability tells you what an agent did; runtime enforcement stops it from doing the wrong thing in the first place. RuntimeAI closes that second half of the gap — giving every agent a verifiable identity, enforcing policy on each tool call, and cutting a rogue agent in under 50ms before its second action lands.

Japan's Digital Agency confirmed that a medium-severity, non-zero-day VPN flaw in its shared Government Solution Service infrastructure let an attacker gain unauthorized access and expose roughly 246,000 personnel records — names, email addresses, and phone numbers — spanning 23 government organizations. The agency caught the intrusion after detecting large-scale file access from a maintenance staff account, then cut the compromised equipment off from the outside world.

One unpatched network device opened a data-theft path across two dozen organizations sharing the same infrastructure — a reminder that perimeter security fails exactly when the perimeter does. Sensitive fields need to be tokenized before they ever move across the network, so that even a clean exfiltration yields nothing readable. RuntimeAI's PII Shield tokenizes sensitive data at the point of access and enforces runtime policy on every query that touches it, blocking unauthorized reads before data leaves the system.

Attackers exploited an SSO misconfiguration at Brevo, the email marketing platform Trezor uses for its newsletter, to send phishing emails to roughly 347,000 Trezor subscribers through Trezor's own legitimate delivery channel. The messages claimed a hardware flaw in Trezor's cold-storage chips could expose seed phrases and pushed recipients toward a malicious app; about 2,500 people had clicked before Trezor pulled the phishing domain.

Because the email came through a trusted, recognized sender, recipients had no reason to distrust it — the vendor's breach became every one of its customers' breach. Third-party platforms are now a standard attack vector, and every sensitive data flow routed through an external system extends the blast radius. RuntimeAI enforces runtime policy on every outbound data path — restricting what third parties can receive, flagging unexpected data movements, and revoking access the moment anomalous behavior appears.

CISA confirmed active exploitation of CVE-2026-85706, a maximum-severity path traversal flaw in self-managed GitLab instances that lets an unauthenticated attacker pull arbitrary files off the server — deploy tokens, SSH host keys, CI/CD pipeline variables, and database passwords included. GitLab patched the bug on September 10; CISA added it to its Known Exploited Vulnerabilities catalog the following day and gave federal agencies until September 14 to remediate.

CI/CD pipelines carry some of the most sensitive infrastructure credentials in any organization, and AI agents increasingly interact directly with them. RuntimeAI enforces tool-call policy at runtime — blocking agents from touching pipeline resources outside approved parameters and revoking credential access the moment suspicious behavior is detected, independent of whether the underlying system has been patched yet.

Microsoft researchers showed that a single unlabeled prompt is enough to reliably strip safety alignment from language models — no special access, no multi-turn jailbreak, just one training pass using the same reinforcement learning technique (GRPO) that's normally used to make models safer, inverted to remove safety constraints instead. The method reliably unaligned all 15 open-weight models it was tested against, across the DeepSeek, GPT-OSS, Gemma, Llama, Ministral, and Qwen families.

If your control plane lives inside the model, an attacker needs only one prompt to own it — model safety training is not a last line of defense, it's a first one that can fail silently. Runtime governance has to sit outside the model entirely. RuntimeAI enforces policy at the action layer, independent of what the model believes it's allowed to do: a policy violation triggers a kill switch in under 50 milliseconds, before the agent completes the action. The model can be fully unaligned; the runtime still refuses.

Anthropic disclosed that threat actors linked to the ShinyHunters ecosystem built an automated pipeline that mass-downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded secrets — API keys, tokens, and service credentials baked directly into the binaries at build time. In one documented case, attackers turned a single stolen developer token into administrative control of enterprise systems in roughly three hours.

The same pattern applies directly to AI agents: secrets embedded at build time become permanent liabilities the moment they're discovered, and automation makes discovery trivial at scale. RuntimeAI's KYA service registers every non-human identity with scoped, time-limited credentials instead — nothing hardcoded, everything governed. When a service behaves anomalously or a credential is flagged, access is revoked before exfiltration begins.

Spain's data protection agency (AEPD) logged what regulators describe as the first data-breach notification executed end-to-end by an autonomous AI agent: the agent chained together a successful login, a vulnerability search, modification of personal data, and access to financial documents — without a human directing each step. The incident marks a shift from theoretical agentic-attack scenarios to a real, regulator-documented case.

The underlying architecture isn't unique to this incident. Most production agent deployments authenticate once at session start, then treat every subsequent tool call as implicitly authorized. The fix is runtime, not session-start: give every agent a verifiable identity, enforce policy on each individual tool call, and cut a rogue agent in under 50ms — before its second action lands.

A Google Cloud/Mandiant report on enterprise AI security risks detailed a case where a financial-services accounting agent, hit with a corrupted null value, entered an unconstrained recursive reasoning loop instead of failing safely. It made more than 15,000 high-cost API calls in under an hour, ran up roughly $50,000 in cloud charges, and disrupted live business transactions — all without a human noticing until the bill arrived.

No malicious actor was involved; the agent simply had direct read/write access to production systems and no runtime circuit breaker to stop a failure mode from compounding. Identity-and-access controls alone don't catch this kind of incident — the agent was doing exactly what it was authorized to do, just far too many times. RuntimeAI enforces policy on every individual tool call and can cut an agent's access in under 50ms once its behavior crosses a defined threshold, stopping a bad loop at call fifty instead of call fifteen thousand.

CISA warned that ransomware operators have joined APT actors already exploiting CVE-2026-59310, a critical directory-traversal flaw in the vCenter Syslog server that unauthenticated attackers can use to execute arbitrary code. Patched in July, the bug was first abused by a suspected APT to deploy reverse-SSH persistence across hundreds of compromised IPs; over 450 vCenter servers remain exposed online with unknown patch status.

Ransomware doesn't need a zero-day — it needs an identity and a quiet minute between initial access and encryption spreading past the first host. Patching matters, but it isn't fast enough on its own when hundreds of servers stay exposed for weeks. RuntimeAI's answer is speed: detect the anomalous action at runtime and cut the identity in under 50ms, before a foothold becomes a network-wide encryption event.

Rubrik announced Rubrik MCP, giving enterprise AI agents a programmatic path into its data, identity, and application intelligence through the Model Context Protocol, with role-based access control and OWASP MCP Top 10-aligned guardrails built in. It's part of a broader push — co-engineered with Anthropic — to let agents run multi-step recovery and incident-response workflows against Rubrik's security cloud, targeting general availability in October.

Exposing a rich API surface to an agent is the right instinct, but the permissions model attached to the connection is what actually determines the blast radius if that agent goes wrong. RuntimeAI closes the gap vendors like Rubrik are just starting to open: give every agent a verifiable identity, enforce policy on each individual tool call it makes through an MCP connection, and cut it off in under 50ms before a misconfigured or compromised agent turns a helpful integration into an incident.

Cisco Talos disclosed three separate intrusion clusters exploiting two Cisco Secure Firewall Management Center vulnerabilities — a maximum-severity authentication bypass and a static-credential flaw — to steal credentials, tunnel into internal networks, and in one cluster's case, deploy Qilin ransomware. One cluster, assessed with high confidence as an APT with tooling overlapping Sandworm, installed a Cyclops Blink variant after establishing a reverse shell; another used the static credentials to build SOCKS5 and reverse-SSH tunnels straight into the victim network.

Identity is the new domain controller: own the credentials sitting on a device like FMC and everything downstream — firewall configs, internal network paths, lateral movement — falls with it. The fix is to treat every non-human identity, including the credentials embedded in network appliances, like a privileged one: issue and revoke it cryptographically, and gate every privileged action behind runtime policy with a full audit trail.

The vendor holding your data is your exposure.

23 Million User Records Compromised in Gyazo Data Breach (SecurityWeek). No single control is enough. Tokenize sensitive fields before they move, enforce runtime policy on where that data is allowed to go, and keep an immutable audit trail with provable deletion — defense in depth, not one line of defense.

Check out how RuntimeAI solves this at the runtime layer.

#DataBreach #DataPrivacy #AISecurity #PIIProtection #DataProtection #RuntimeAI

Gyazo server flaw exploited to steal 23.6 million user recor — and the pattern underneath it is the real story.

Gyazo server flaw exploited to steal 23.6 million user records (Bleeping Computer). No single control is enough. Tokenize sensitive fields before they move, enforce runtime policy on where that data is allowed to go, and keep an immutable audit trail with provable deletion — defense in depth, not one line of defense.

RuntimeAI governs this at runtime, where the agent actually acts.

#DataBreach #DataPrivacy #AISecurity #PIIProtection #DataProtection #RuntimeAI

The AI layer is now the attack surface.

CISA Warns Attackers Are Exploiting Acronis Backup Flaw on Linux Servers (eSecurity Planet). The fix is to govern what agents actually do. Enforce policy on every action at runtime and keep an immutable audit trail of what they touched.

This is exactly the control RuntimeAI enforces in real time.

#AISecurity #AgenticAI #AIGovernance #RuntimeSecurity #ZeroTrust #RuntimeAI

The agent is no longer the target. It is the attacker.

AI Agent Breaches Spanish Organization, Modifies Personal Data (Dark Reading). The fix is runtime. Give every agent a verifiable identity, enforce policy on each tool call, and cut a rogue agent in under 50ms before its second action lands.

RuntimeAI closes this gap at the runtime layer, before it lands.

#AgenticAI #AISecurity #NonHumanIdentity #RuntimeSecurity #KillSwitch #RuntimeAI

Zero-click RCE vulnerability hit four major AI coding agents — and the pattern underneath it is the real story.

Zero-click RCE vulnerability hit four major AI coding agents, two remain unpatched (Help Net Security). The fix is runtime. Give every agent a verifiable identity, enforce policy on each tool call, and cut a rogue agent in under 50ms before its second action lands.

See how RuntimeAI turns this from an incident into a blocked action.

#AgenticAI #AISecurity #NonHumanIdentity #RuntimeSecurity #KillSwitch #RuntimeAI

Browser agents can be hijacked in seconds. One malicious extension is all it takes.

BragJack, a proof-of-concept attack from security researcher Gal Weizman at Forever Security, hijacked AI assistants in Chrome, Edge, Opera Neon, and Perplexity Comet using a single browser extension. The Prompt Forcing technique earned over $20,000 in bug bounties and two CVEs. The targeted agent never knows it has been taken over.

KYA continuously verifies agent identity at runtime. When behavioral drift appears — forced prompts, unauthorized tool calls — the sub-50ms kill switch terminates the session before the hijacked action reaches any system or data store.

This is exactly the control RuntimeAI enforces in real time.

#RuntimeAI #AgentSecurity #AIGovernance #ZeroTrust #BrowserAgents

Your agent is running code you never reviewed. That is Plugin4Shell.

A flaw in four widely used AI coding agents lets any repository owner silently swap the plugin an agent installs — even when the agent pinned that plugin to a specific reviewed version. The agent trusts the name. It does not verify the hash. Air Security disclosed the flaw this week, and at least two agents remain unpatched.

RuntimeAI enforces policy on every tool call and plugin invocation at runtime. Agents execute only code that matches verified, policy-approved manifests. A supply-chain swap is blocked before the process runs — not discovered in a post-incident forensic review.

RuntimeAI closes this gap at the runtime layer, before it lands.

#RuntimeAI #SupplyChainSecurity #AIAgents #CodingAgents #AppSec #Cybersecurity

LLMs are now writing the malware targeting your dependencies.

PhantomRaven, a JavaScript information stealer, was distributed through the npm package registry this week. Researchers assess with high confidence that the author used a large language model to build it. The same capability that accelerates developer productivity now accelerates attacker output — and the resulting packages reach production pipelines before anyone reviews the source.

RuntimeAI enforces policy on every agent action, including what code an agent can generate and where it can publish. PII Shield tokenizes sensitive fields before any agent output can carry them out of your environment, blocking the data harvest at the source rather than chasing it after the package lands.

See how RuntimeAI turns this from an incident into a blocked action.

#RuntimeAI #SupplyChainSecurity #LLMSecurity #npm #AIThreats #AppSec

AI is not just assisting attackers. It is planning the attack chain.

Researchers at Hacktron used an LLM to chain two vulnerabilities and take over the accounts of multiple employees at a major AI company, then reach an internal code repository. The LLM executed the chain faster than a human analyst could document it. Employee credentials became the pivot. The internal repo was the target.

Non-human identity governance stops lateral moves like this before they complete. RuntimeAI verifies every agent credential and enforces session policy at runtime. When an AI-piloted credential chain deviates from authorized scope, identity revocation fires before the internal system is reached.

RuntimeAI governs this at runtime, where the agent actually acts.

#RuntimeAI #NonHumanIdentity #IdentitySecurity #AIRisk #CyberSecurity #AgentSecurity

You cannot govern what you cannot see. In 2026, that problem is exponentially harder.

Verizon's annual Data Breach Investigations Report ranks stolen and misused credentials among the top initial access vectors year after year. That category now includes AI agents — non-human identities operating under delegated credentials that most organizations have never inventoried, let alone governed. An identity you do not know exists cannot be rotated, scoped, or revoked.

RuntimeAI's shadow-AI discovery surfaces every agent operating on your network. KYA assigns verified identities to each one. RuntimeAI then enforces runtime policy across 80-plus compliance frameworks — so when an agent misuses a credential, the action is blocked and the evidence is preserved for the audit that follows.

Check out how RuntimeAI solves this at the runtime layer.

#RuntimeAI #IdentitySecurity #NonHumanIdentity #AIGovernance #Compliance #ZeroTrust

An AI coding agent's most locked-down mode still let researchers execute commands on the host machine.

Two separate escape paths surfaced in OpenAI's Codex sandbox this week. One worked from the highest-restriction configuration available. Researchers ran arbitrary commands directly on the developer's underlying system. OpenAI patched both. The finding exposes a structural problem: sandbox boundaries are not a control plane.

Runtime policy enforcement must live outside the agent's own process. RuntimeAI intercepts every tool invocation and system call at the control plane layer, blocking unauthorized execution before it reaches the host. A <50ms kill switch terminates the session the moment policy is violated.

RuntimeAI closes this gap at the runtime layer, before it lands.

#AgentSecurity #AIGovernance #RuntimeAI #SandboxSecurity #ZeroTrust

Your employees' browsing behavior is now context inside a public LLM.

ChatGPT's integration with an ad data collector gives the model visibility into what users do across other websites — purchase intent, health queries, financial interests. When employees use ChatGPT for work tasks, that behavioral profile travels with the session. Sensitive inference is now possible without a single explicit disclosure.

Enterprise AI deployments face the same risk at the agent layer. Agents pulling external data sources create outbound flows that no compliance team approved.

RuntimeAI's PII Shield intercepts and tokenizes sensitive fields before they reach any LLM endpoint. Runtime policy enforcement then blocks outbound data flows to unapproved destinations outright — and every blocked call is recorded in the immutable audit trail for provable compliance.

RuntimeAI closes this gap at the runtime layer, before it lands.

#PIIProtection #DataPrivacy #AICompliance #RuntimeAI #AgenticAI #EnterpriseAI

A ransomware gang just had its private keys stolen by another gang.

ShinyHunters breached Clop's data leak infrastructure, defaced the Tor site, and reportedly exfiltrated server data and the private keys to Clop's onion service. The enterprise implication is straightforward: every external vendor API and supply-chain endpoint your AI agents call is a potential target. Compromise the tool, and every agent that trusts it is exposed.

AI agents don't re-evaluate whether a tool they are authorized to call is still safe. That judgment has to happen at the runtime layer, on every call.

RuntimeAI enforces tool-call policies at runtime. Agents can only invoke approved endpoints, and any deviation triggers an immediate block before the call completes. The immutable audit trail captures every tool invocation — so supply-chain compromise surfaces before it propagates.

See how RuntimeAI turns this from an incident into a blocked action.

#SupplyChainSecurity #AIAgents #RuntimeSecurity #RuntimeAI #AgentGovernance #CyberSecurity