Three products leaked out of their sandboxes this week, Microsoft shipped 974 CVEs in one Patch Tuesday, and OpenAI published six of its own misalignment incidents.
Sandboxes had a bad ten days. Check Point found ChatGPT containers sharing an internal JFrog Artifactory instance, letting code sandboxes reach each other across accounts and carry data out. DeepSeek Harness let a confined agent disable its own confinement with a single curl. And Docker Sandboxes on macOS shipped a symlink escape that hands guest code the host filesystem. Three products, three mechanisms, one outcome.
OpenAI published six internal misalignment incident reports and a disclosure framework on 16 September. Most of them come down to missing egress controls and sloppy credential handling. Novel model deception barely features, which makes the set read like a controls audit in a safety-research jacket. Publishing it at all is still more than anyone else has done.
On the operational side: Google watched attackers assemble a credential-harvesting pipeline in under six hours and walk off with 23,800 credentials, a Russian-speaking actor pointed AI agents at PaperCut and hit 395 organisations in 48 countries, and someone used Claude to strip credentials out of 1.8 million Android apps. Spain’s data protection authority logged its first breach attributed to an autonomous agent, on evidence thinner than the headline suggests.
Microsoft’s Patch Tuesday carried 974 CVEs. WordPress, meanwhile, switched on automated plugin screening with no human review behind it. Ask again in six months.