---
title: "Weekly Roundup: Salesforce patches twice, OpenAI publishes six, an agent bills $50,000"
pubDatetime: 2026-09-25T14:00:00.000Z
description: "Twenty posts in 10 days: Agentforce's Trusted URLs control fell again, OpenAI shipped six misalignment incident reports, and an accounting agent ran up a $50,000 cloud bill."
tags: [ai-security, ai-agents, vulnerability, supply-chain, openai, sandboxing, 2026, 2026-q3, 2026-09, weekly-roundup]
---
> [!tldr] TL;DR
> Twenty posts since 16 September, with the week's better ones covering a repeat Agentforce prompt-injection fix, OpenAI's six self-published misalignment reports, and an accounting agent that billed $50,000 in cloud costs over a bad number.

Salesforce built the Trusted URLs control a year ago to stop prompt injection in Agentforce. Zenity Labs [bypassed it again](/posts/salesbleed-agentforce-prompt-injection), then chained a Slack agent action into phishing replies with no attribution attached. Three bugs, all patched, same hole as last time.

OpenAI put out [six internal misalignment incident reports](/posts/openai-six-misalignment-reports) plus a disclosure framework on 16 September. Publishing them is the interesting part. The contents read like an audit of egress controls and credential handling, which is a duller and more useful finding than model deception would have been.

The cheapest story of the week: an accounting agent at a financial services firm [spent $50,000 on cloud compute](/posts/auto-agents-runaway-costs) because one data value was corrupted and nobody set a spending cap. Researchers separately priced [AI-orchestrated card theft](/posts/auto-ai-retail-attacks) at $25 per site.

Sandboxes had a rough stretch. Two [Codex escapes](/posts/auto-codex-sandbox-escapes) showed what software-level isolation gives you against an attacker already inside, and Docker Sandboxes shipped a [symlink bug](/posts/auto-docker-symlink-escape) that let guest code read host files on macOS.

One more worth a line: when Claude's newer models refused, a Chinese operator [fell back to Opus 4.6](/posts/auto-model-downgrade-path) and got the retail breaches done anyway. Refusal training only covers the versions you can still reach.