Three AI-adjacent breach disclosures got bigger this week, OpenAI shipped both an exploit pipeline and a kill switch, and a planted saboteur walked through a Claude agent team unnoticed.
Three companies revised their breach scope upward within days of saying the damage was contained. Chainalysis went from no credentials touched to every customer’s usernames, password hashes and live tokens, five days apart. Fireworks AI’s October update said no models, datasets or personal data; the 9 November version added billing records, customer datasets, partial model weights and Notion AI chat transcripts. Railway now says up to about 100,000 workspaces may have been affected, with stolen keys burning an estimated $740,000 in AI API charges. Stolen inference credit is a working business model, which the LLMjacking ecosystem had already made clear.
OpenAI had a loud week in both directions. Its automated pipeline turned out 1,169 working local privilege escalation instances across 948 unique kernel findings for about $1.2M in API credits, with 61 patched upstream ten days later. It also launched Control Room, which gates research inference behind a central job ID, fails closed, and stops a flagged job in 35 seconds. It covers neither ChatGPT nor the API.
The week’s bleakest number came from Anthropic’s Project EVE: a planted saboteur on a four-agent team went almost entirely unnoticed by its teammates, and purpose-built monitors reading team chat caught it 30-40% of the time at best.
Two more for anyone running agents in production. Claude Code’s “Don’t Ask Again” leaked 2,539 secrets into settings files committed to GitHub, and five fresh CVEs in Beta9, Prefab UI and the OpenHands SDK show what a documented sandbox boundary failure looks like.