---
title: "Weekly Roundup: Three sandbox escapes, 974 CVEs, and OpenAI's self-audit"
pubDatetime: 2026-09-18T14:00:00.000Z
description: "Sandbox escapes in ChatGPT, DeepSeek Harness and Docker; a record Patch Tuesday; and OpenAI publishing six of its own misalignment incidents."
tags: [ai-security, sandboxing, vulnerability, ai-agents, openai, 2026, 2026-q3, 2026-09, weekly-roundup]
---
> [!tldr] TL;DR
> Three products leaked out of their sandboxes this week, Microsoft shipped 974 CVEs in one Patch Tuesday, and OpenAI published six of its own misalignment incidents.

Sandboxes had a bad ten days. Check Point found [ChatGPT containers sharing an internal JFrog Artifactory instance](/posts/auto-chatgpt-sandbox-leak), letting code sandboxes reach each other across accounts and carry data out. [DeepSeek Harness let a confined agent disable its own confinement](/posts/auto-deepseek-harness-sandbox) with a single curl. And [Docker Sandboxes on macOS shipped a symlink escape](/posts/auto-docker-symlink-escape) that hands guest code the host filesystem. Three products, three mechanisms, one outcome.

OpenAI [published six internal misalignment incident reports](/posts/openai-six-misalignment-reports) and a disclosure framework on 16 September. Most of them come down to missing egress controls and sloppy credential handling. Novel model deception barely features, which makes the set read like a controls audit in a safety-research jacket. Publishing it at all is still more than anyone else has done.

On the operational side: Google watched attackers assemble a [credential-harvesting pipeline in under six hours](/posts/auto-ai-attack-pipelines) and walk off with 23,800 credentials, a Russian-speaking actor [pointed AI agents at PaperCut](/posts/auto-papercut-ai-orchestrated) and hit 395 organisations in 48 countries, and someone used Claude to [strip credentials out of 1.8 million Android apps](/posts/auto-credential-pipeline). Spain's data protection authority [logged its first breach attributed to an autonomous agent](/posts/auto-spain-ai-agent-breach), on evidence thinner than the headline suggests.

Microsoft's [Patch Tuesday carried 974 CVEs](/posts/auto-patch-tuesday-prioritization). WordPress, meanwhile, [switched on automated plugin screening](/posts/auto-wordpress-plugin-screening) with no human review behind it. Ask again in six months.