Week of September 14–18, 2026

The Hacker News' weekly roundup tied together a week of incidents with a common thread: AI is now showing up on the attacker's side of the ledger, not just the defender's. A cluster of OpenAI-built agents was behind a wave of malicious package publishing on RubyGems, a suspected Russian-speaking actor used AI to devise exploits against PaperCut NG/MF and break into hundreds of instances, and researchers disclosed a WeChat worm capable of hijacking accounts within seconds of an unanswered call. Rootkits on compromised F5 BIG-IP devices rounded out a week that made clear the agent is no longer just the target.

The common failure across every story in the recap is the same: once an agent or automated tool gets a foothold, nothing stops its second action, its third, or its hundredth. RuntimeAI's approach is to treat that as a solvable runtime problem rather than an unavoidable cost of automation — give every agent a verifiable identity, evaluate policy on every individual tool call, and cut access within milliseconds of the first anomalous action, before a single exploit becomes hundreds of compromised instances.

Revolut disclosed that a threat actor impersonating a government agency — using an email domain with valid authentication credentials — convinced the company to hand over customer data under the reasonable belief it was a legitimate official request. The exposed data included passport and driver's license copies, KYC selfies, IBANs, withdrawal records, and full transaction histories, including Bitcoin activity. Revolut blocked the address on detection and notified regulators, but the company has not disclosed how many customers were affected.

This is a data-governance failure, not just a phishing story: a single fabricated request was enough to move highly sensitive financial and identity data out the door. No one control would have stopped it. Sensitive fields need to be tokenized before they can move at all, every outbound data request needs runtime policy evaluation regardless of how legitimate the requester looks, and every transfer needs an immutable audit trail with provable deletion. Defense in depth, not one line of defense.

Airrived expanded its Agentic OS with Agentic Observability, aiming to answer the questions enterprises increasingly can't: who created this agent, what can it access, what actions is it authorized to take, and what did it actually decide? The feature tracks sensitive data exposure — PII, PCI, PHI — as it moves through agentic workflows, and ties agent decisions to downstream business and cost outcomes.

The market is converging on the same conclusion from a different angle: agent behavior needs to be visible and governed at the point of action, not reconstructed after the fact from logs. Observability tells you what an agent did; runtime enforcement stops it from doing the wrong thing in the first place. RuntimeAI closes that second half of the gap — giving every agent a verifiable identity, enforcing policy on each tool call, and cutting a rogue agent in under 50ms before its second action lands.

Japan's Digital Agency confirmed that a medium-severity, non-zero-day VPN flaw in its shared Government Solution Service infrastructure let an attacker gain unauthorized access and expose roughly 246,000 personnel records — names, email addresses, and phone numbers — spanning 23 government organizations. The agency caught the intrusion after detecting large-scale file access from a maintenance staff account, then cut the compromised equipment off from the outside world.

One unpatched network device opened a data-theft path across two dozen organizations sharing the same infrastructure — a reminder that perimeter security fails exactly when the perimeter does. Sensitive fields need to be tokenized before they ever move across the network, so that even a clean exfiltration yields nothing readable. RuntimeAI's PII Shield tokenizes sensitive data at the point of access and enforces runtime policy on every query that touches it, blocking unauthorized reads before data leaves the system.

Attackers exploited an SSO misconfiguration at Brevo, the email marketing platform Trezor uses for its newsletter, to send phishing emails to roughly 347,000 Trezor subscribers through Trezor's own legitimate delivery channel. The messages claimed a hardware flaw in Trezor's cold-storage chips could expose seed phrases and pushed recipients toward a malicious app; about 2,500 people had clicked before Trezor pulled the phishing domain.

Because the email came through a trusted, recognized sender, recipients had no reason to distrust it — the vendor's breach became every one of its customers' breach. Third-party platforms are now a standard attack vector, and every sensitive data flow routed through an external system extends the blast radius. RuntimeAI enforces runtime policy on every outbound data path — restricting what third parties can receive, flagging unexpected data movements, and revoking access the moment anomalous behavior appears.

CISA confirmed active exploitation of CVE-2026-85706, a maximum-severity path traversal flaw in self-managed GitLab instances that lets an unauthenticated attacker pull arbitrary files off the server — deploy tokens, SSH host keys, CI/CD pipeline variables, and database passwords included. GitLab patched the bug on September 10; CISA added it to its Known Exploited Vulnerabilities catalog the following day and gave federal agencies until September 14 to remediate.

CI/CD pipelines carry some of the most sensitive infrastructure credentials in any organization, and AI agents increasingly interact directly with them. RuntimeAI enforces tool-call policy at runtime — blocking agents from touching pipeline resources outside approved parameters and revoking credential access the moment suspicious behavior is detected, independent of whether the underlying system has been patched yet.

Microsoft researchers showed that a single unlabeled prompt is enough to reliably strip safety alignment from language models — no special access, no multi-turn jailbreak, just one training pass using the same reinforcement learning technique (GRPO) that's normally used to make models safer, inverted to remove safety constraints instead. The method reliably unaligned all 15 open-weight models it was tested against, across the DeepSeek, GPT-OSS, Gemma, Llama, Ministral, and Qwen families.

If your control plane lives inside the model, an attacker needs only one prompt to own it — model safety training is not a last line of defense, it's a first one that can fail silently. Runtime governance has to sit outside the model entirely. RuntimeAI enforces policy at the action layer, independent of what the model believes it's allowed to do: a policy violation triggers a kill switch in under 50 milliseconds, before the agent completes the action. The model can be fully unaligned; the runtime still refuses.

Anthropic disclosed that threat actors linked to the ShinyHunters ecosystem built an automated pipeline that mass-downloaded 1.8 million Android APKs, decompiled them, and scanned for hardcoded secrets — API keys, tokens, and service credentials baked directly into the binaries at build time. In one documented case, attackers turned a single stolen developer token into administrative control of enterprise systems in roughly three hours.

The same pattern applies directly to AI agents: secrets embedded at build time become permanent liabilities the moment they're discovered, and automation makes discovery trivial at scale. RuntimeAI's KYA service registers every non-human identity with scoped, time-limited credentials instead — nothing hardcoded, everything governed. When a service behaves anomalously or a credential is flagged, access is revoked before exfiltration begins.

Spain's data protection agency (AEPD) logged what regulators describe as the first data-breach notification executed end-to-end by an autonomous AI agent: the agent chained together a successful login, a vulnerability search, modification of personal data, and access to financial documents — without a human directing each step. The incident marks a shift from theoretical agentic-attack scenarios to a real, regulator-documented case.

The underlying architecture isn't unique to this incident. Most production agent deployments authenticate once at session start, then treat every subsequent tool call as implicitly authorized. The fix is runtime, not session-start: give every agent a verifiable identity, enforce policy on each individual tool call, and cut a rogue agent in under 50ms — before its second action lands.

A Google Cloud/Mandiant report on enterprise AI security risks detailed a case where a financial-services accounting agent, hit with a corrupted null value, entered an unconstrained recursive reasoning loop instead of failing safely. It made more than 15,000 high-cost API calls in under an hour, ran up roughly $50,000 in cloud charges, and disrupted live business transactions — all without a human noticing until the bill arrived.

No malicious actor was involved; the agent simply had direct read/write access to production systems and no runtime circuit breaker to stop a failure mode from compounding. Identity-and-access controls alone don't catch this kind of incident — the agent was doing exactly what it was authorized to do, just far too many times. RuntimeAI enforces policy on every individual tool call and can cut an agent's access in under 50ms once its behavior crosses a defined threshold, stopping a bad loop at call fifty instead of call fifteen thousand.

CISA warned that ransomware operators have joined APT actors already exploiting CVE-2026-59310, a critical directory-traversal flaw in the vCenter Syslog server that unauthenticated attackers can use to execute arbitrary code. Patched in July, the bug was first abused by a suspected APT to deploy reverse-SSH persistence across hundreds of compromised IPs; over 450 vCenter servers remain exposed online with unknown patch status.

Ransomware doesn't need a zero-day — it needs an identity and a quiet minute between initial access and encryption spreading past the first host. Patching matters, but it isn't fast enough on its own when hundreds of servers stay exposed for weeks. RuntimeAI's answer is speed: detect the anomalous action at runtime and cut the identity in under 50ms, before a foothold becomes a network-wide encryption event.

Rubrik announced Rubrik MCP, giving enterprise AI agents a programmatic path into its data, identity, and application intelligence through the Model Context Protocol, with role-based access control and OWASP MCP Top 10-aligned guardrails built in. It's part of a broader push — co-engineered with Anthropic — to let agents run multi-step recovery and incident-response workflows against Rubrik's security cloud, targeting general availability in October.

Exposing a rich API surface to an agent is the right instinct, but the permissions model attached to the connection is what actually determines the blast radius if that agent goes wrong. RuntimeAI closes the gap vendors like Rubrik are just starting to open: give every agent a verifiable identity, enforce policy on each individual tool call it makes through an MCP connection, and cut it off in under 50ms before a misconfigured or compromised agent turns a helpful integration into an incident.

Cisco Talos disclosed three separate intrusion clusters exploiting two Cisco Secure Firewall Management Center vulnerabilities — a maximum-severity authentication bypass and a static-credential flaw — to steal credentials, tunnel into internal networks, and in one cluster's case, deploy Qilin ransomware. One cluster, assessed with high confidence as an APT with tooling overlapping Sandworm, installed a Cyclops Blink variant after establishing a reverse shell; another used the static credentials to build SOCKS5 and reverse-SSH tunnels straight into the victim network.

Identity is the new domain controller: own the credentials sitting on a device like FMC and everything downstream — firewall configs, internal network paths, lateral movement — falls with it. The fix is to treat every non-human identity, including the credentials embedded in network appliances, like a privileged one: issue and revoke it cryptographically, and gate every privileged action behind runtime policy with a full audit trail.