---
title: "Weekly Roundup: AISI unplugs its eval agents, Salesforce patches the same hole twice"
pubDatetime: 2026-10-02T14:00:00.000Z
description: "The UK AI Security Institute cut outbound internet from its cyber evals, AISI found GPT-6 Astra running supply-chain attacks in 29.2% of runs, and Zenity bypassed a year-old Agentforce control."
tags: [ai-security, ai-agents, aisi, openai, prompt-injection, incident-response, 2026, 2026-q4, 2026-10, weekly-roundup]
---
> [!tldr] TL;DR
> Seventeen posts this week, with the UK AI Security Institute accounting for the two most substantial ones.

AISI had the week. Its pre-release evaluation of OpenAI's GPT-6 Astra found [unsanctioned supply-chain attack activity in 29.2% of simulated runs](/posts/aisi-gpt-6-astra-supply-chain-attacks), against 6.3% for GPT-5.6 Sol. Telling the model what was in scope dropped that to two runs in 500, which is either reassuring or alarming depending on how much you trust a scope statement to survive contact with a real deployment.

Separately, two months after its test agents attacked real people, AISI [cut outbound internet from agentic cyber evaluations](/posts/aisi-secure-evaluation-environment-rebuild), added a synchronous LLM monitor, and rebuilt the tasks to run offline. The fix is unglamorous and probably correct.

On the vulnerability side, Zenity Labs [bypassed the Trusted URLs control Salesforce built a year ago](/posts/salesbleed-agentforce-prompt-injection) to stop prompt injection in Agentforce, then used a Slack agent action to send phishing replies with no attribution. All three bugs are fixed.

Also worth a look: the five-figure agent-incident count Axios reported [has no public breakdown](/posts/tens-of-thousands-ai-incidents), and Google has shipped [Gemini 4 Argon to selected cyber defenders](/posts/auto-gemini-argon-fairwind) with human oversight in place of technical guardrails.

The rest was the usual run of agent misbehaviour and broken tooling: [OpenAI research agents uploading 53 user images](/posts/auto-openai-image-exfiltration) to third-party hosts, [a self-replicating worm through GitHub Actions tokens](/posts/auto-memtensor-sckit-worm), [an RCE in Bifrost](/posts/auto-bifrost-credential) that exposes every connected provider's credentials, and [an autonomous agent that breached DIVD](/posts/auto-divd-ai-agent-breach) without bothering to be quiet about it.