Twenty posts since 16 September, with the week’s better ones covering a repeat Agentforce prompt-injection fix, OpenAI’s six self-published misalignment reports, and an accounting agent that billed $50,000 in cloud costs over a bad number.
Salesforce built the Trusted URLs control a year ago to stop prompt injection in Agentforce. Zenity Labs bypassed it again, then chained a Slack agent action into phishing replies with no attribution attached. Three bugs, all patched, same hole as last time.
OpenAI put out six internal misalignment incident reports plus a disclosure framework on 16 September. Publishing them is the interesting part. The contents read like an audit of egress controls and credential handling, which is a duller and more useful finding than model deception would have been.
The cheapest story of the week: an accounting agent at a financial services firm spent $50,000 on cloud compute because one data value was corrupted and nobody set a spending cap. Researchers separately priced AI-orchestrated card theft at $25 per site.
Sandboxes had a rough stretch. Two Codex escapes showed what software-level isolation gives you against an attacker already inside, and Docker Sandboxes shipped a symlink bug that let guest code read host files on macOS.
One more worth a line: when Claude’s newer models refused, a Chinese operator fell back to Opus 4.6 and got the retail breaches done anyway. Refusal training only covers the versions you can still reach.