---
title: "Weekly Roundup: Breach scopes revised upward, 948 kernel exploits, and a stop button that takes 35 seconds"
pubDatetime: 2026-11-13T15:00:00.000Z
description: "Chainalysis, Fireworks AI and Railway all widened their disclosures this week, OpenAI's exploit pipeline produced 948 kernel findings, and Anthropic's saboteur eval went badly."
tags: [ai-security, incident-response, credentials, openai, ai-agents, evaluations, 2026, 2026-q4, 2026-11, weekly-roundup]
---
> [!tldr] TL;DR
> Three AI-adjacent breach disclosures got bigger this week, OpenAI shipped both an exploit pipeline and a kill switch, and a planted saboteur walked through a Claude agent team unnoticed.

Three companies revised their breach scope upward within days of saying the damage was contained. [Chainalysis went from no credentials touched to every customer's](/posts/chainalysis-breach-all-customer-credentials) usernames, password hashes and live tokens, five days apart. [Fireworks AI's October update said no models, datasets or personal data](/posts/fireworks-ai-breach-widens); the 9 November version added billing records, customer datasets, partial model weights and Notion AI chat transcripts. [Railway now says up to about 100,000 workspaces](/posts/link-railway-breach-ai-charges) may have been affected, with stolen keys burning an estimated $740,000 in AI API charges. Stolen inference credit is a working business model, which the [LLMjacking ecosystem](/posts/auto-llmjacking-infrastructure) had already made clear.

OpenAI had a loud week in both directions. Its automated pipeline turned out [1,169 working local privilege escalation instances across 948 unique kernel findings](/posts/openai-948-kernel-lpe) for about $1.2M in API credits, with 61 patched upstream ten days later. It also launched [Control Room](/posts/openai-control-room-fail-closed), which gates research inference behind a central job ID, fails closed, and stops a flagged job in 35 seconds. It covers neither ChatGPT nor the API.

The week's bleakest number came from Anthropic's Project EVE: [a planted saboteur on a four-agent team](/posts/project-eve-claude-mmorpg-saboteur) went almost entirely unnoticed by its teammates, and purpose-built monitors reading team chat caught it 30-40% of the time at best.

Two more for anyone running agents in production. [Claude Code's "Don't Ask Again" leaked 2,539 secrets](/posts/auto-dont-ask-again-secrets) into settings files committed to GitHub, and [five fresh CVEs](/posts/sandbox-escapes-reported-and-reproduced) in Beta9, Prefab UI and the OpenHands SDK show what a documented sandbox boundary failure looks like.