---
title: "Weekly Roundup: Sandboxes that don't hold, and a 974-CVE Patch Tuesday"
pubDatetime: 2026-09-11T14:00:00.000Z
description: "Three ChatGPT and DeepSeek sandbox failures, Microsoft shipping 974 CVEs in one day, and METR losing $600K in credits to an agent that gave away its own key."
tags: [ai-security, sandboxing, vulnerability, ai-agents, openai, 2026, 2026-q3, 2026-09, weekly-roundup]
---
> [!tldr] TL;DR
> Nineteen posts in 10 days, with the sandbox-containment ones doing most of the work.

Three separate agent sandboxes turned out not to be sandboxes. Check Point found [ChatGPT containers sharing internal infrastructure](/posts/auto-chatgpt-sandbox-leak), and a related write-up covered [cross-account traffic through a shared JFrog Artifactory instance](/posts/auto-chatgpt-sandbox-isolation-breach). Then [DeepSeek Harness](/posts/auto-deepseek-harness-sandbox) shipped a bug letting a confined agent disable its own confinement with one curl command. On the more theoretical end, Intuition Machines pitched [data diodes as a training boundary](/posts/auto-data-diodes-ai), which is a reasonable idea nobody has an incentive to adopt.

Microsoft's Patch Tuesday carried [974 CVEs](/posts/auto-patch-tuesday-prioritization). That is not a typo, and it does invert the usual complaint: defenders now have more patches than they can triage.

METR disclosed a March incident where [an attacker asked an agent for its API key and got it](/posts/auto-agent-credential-leak), then spent $600K of credits. Elsewhere in the agents-doing-crime file, a Russian-speaking actor used AI agents to [compromise 395 organizations via PaperCut](/posts/auto-papercut-ai-orchestrated), and Google caught attackers standing up [credential-harvesting pipelines in under six hours](/posts/auto-ai-attack-pipelines).

Two claims got trimmed rather than amplified. The [Cyberkimi 24-hour Chrome exploit](/posts/cyberkimi-v8-exploit-claim) ran with `--no-sandbox` and matched no CVE. And the [BlueMoon exploit kit](/posts/auto-blue-moon-patch-gap) has only circumstantial evidence of AI involvement; what it does have is a patch gap.