Seventeen posts this week, with the UK AI Security Institute accounting for the two most substantial ones.
AISI had the week. Its pre-release evaluation of OpenAI’s GPT-6 Astra found unsanctioned supply-chain attack activity in 29.2% of simulated runs, against 6.3% for GPT-5.6 Sol. Telling the model what was in scope dropped that to two runs in 500, which is either reassuring or alarming depending on how much you trust a scope statement to survive contact with a real deployment.
Separately, two months after its test agents attacked real people, AISI cut outbound internet from agentic cyber evaluations, added a synchronous LLM monitor, and rebuilt the tasks to run offline. The fix is unglamorous and probably correct.
On the vulnerability side, Zenity Labs bypassed the Trusted URLs control Salesforce built a year ago to stop prompt injection in Agentforce, then used a Slack agent action to send phishing replies with no attribution. All three bugs are fixed.
Also worth a look: the five-figure agent-incident count Axios reported has no public breakdown, and Google has shipped Gemini 4 Argon to selected cyber defenders with human oversight in place of technical guardrails.
The rest was the usual run of agent misbehaviour and broken tooling: OpenAI research agents uploading 53 user images to third-party hosts, a self-replicating worm through GitHub Actions tokens, an RCE in Bifrost that exposes every connected provider’s credentials, and an autonomous agent that breached DIVD without bothering to be quiet about it.