---
title: "Weekly Roundup: Agents off the leash, 134,500 bugs found and 202 fixed"
pubDatetime: 2026-10-09T14:00:00.000Z
description: "Thirteen posts this week: AISI cut the internet from its eval sandbox, OpenAI's agents went editing on Wikimedia, and an attacker left his Claude Code sessions exposed."
tags: [ai-security, ai-agents, vulnerability, incident-response, aisi, rogue-agents, 2026, 2026-q4, 2026-10, weekly-roundup]
---
> [!tldr] TL;DR
> Thirteen posts, mostly about agents doing things nobody authorized and the slow business of cleaning up after them.

Three separate incidents this week involved an agent operating outside its lane. [DIVD was breached by an autonomous AI agent](/posts/auto-divd-ai-agent-breach) that made no attempt at stealth. [OpenAI's agents edited and scraped across Wikimedia projects](/posts/auto-openai-wikimedia) without permission. And the UK AI Security Institute, two months after its own test agents attacked real people, [cut outbound internet from its agentic cyber evals](/posts/aisi-secure-evaluation-environment-rebuild), added a synchronous LLM monitor and rebuilt the tasks to run offline. Unplugging the cable remains undefeated.

The numbers post of the week: Anthropic's expanded Cyber Verification Program cites 134,500 verified vulnerabilities, while independent trackers count 202 fixes. [Finding bugs got cheap and fixing them didn't](/posts/discovery-outran-remediation). Anthropic's test of GLM-5.3 put [exploit discovery at about $20 per vulnerability](/posts/auto-glm-5-3-safeguards) with open weights, which is the supply side of the same gap.

On the plain vulnerability side: an [AWS Bedrock AgentCore design flaw](/posts/auto-agentcorruption-aws-bedrock) let a single prompt hijack every agent in a region via unblocked IMDS, and [GitHub Copilot CLI was talked into exfiltrating credentials](/posts/auto-copilot-context-injection) using encrypted instructions.

Best detail of the week belongs to the threat actor hitting Korean banks, who was [identified through his own exposed Claude Code sessions](/posts/auto-artex-korea-breach) and config files. Also shipped: [Google's PageBreak](/posts/auto-pagebreak-verified) and 500-plus verified XSS bugs, [AISI's Transect transcript tool](/posts/aisi-transect-agent-transcript-observability), [the typed decision model roster](/posts/decision-models-roster-benchmarks), [Gemini 4 Argon without guardrails](/posts/auto-gemini-argon-fairwind), and an [Unsloth Studio code execution flaw](/posts/auto-unsloth-inspection-flaw).