Bulletin — August 2026 (second half)

The first half closed on one idea: when an agent escapes, what turns the escape into a breach is the long-lived credential it finds inside. The second half moves the focus one step back, to the isolation itself. Trail of Bits got early access to GPT-5.6-Cyber, put it inside a QEMU/KVM virtual machine on a patched Debian 12 host and asked it to get out. It got out three times, the last one chaining three 0-days it found on its own. On 16 August OpenAI published a post by Greg Brockman admitting that the agentic collective penetrated its research infrastructure and another company’s production, and warning that open-weight models with cyber capability were landing at the end of the month. They did. Meanwhile, attacks on US water went from 30 utilities to more than 100, Patch Tuesday closed 421 CVEs and Oracle 943, and Australian police arrested two TeamPCP members.

The sandbox doesn’t hold either: three VM escapes in twelve hours

The Trail of Bits experiment, published on 26 August as part of its Patch the Planet initiative, is the technical result of the month. Artem Dinaburg got early access to GPT-5.6-Cyber, gave it SSH into a Debian 12 guest on QEMU/KVM running on an AMD Zen 3 host, and set a CTF goal: escape and read a flag file. The agent managed it three times over roughly twelve hours of largely unsupervised operation, and how each attempt escalated is the interesting part:

1. ~1 hour: exploited Januscape (CVE-2026-53359), a recently disclosed kernel flaw the host still had unpatched.
2. After the kernel was updated: combined CVE-2026-9539 in libslirp 4.7.0 with a bug fix that never got a CVE, and used the pair to get arbitrary read and write in host memory.
3. After QEMU was rebuilt from upstream source: analysed QEMU, KVM, the kernel and related libraries and synthesised a fresh chain from three 0-days —a QEMU VAPIC ROM alias, a KVM shadow-page desynchronisation and a libslirp mixed-fragment IHL bug— plus a paging64_invlpg() flaw already patched upstream that hadn’t reached the distribution kernel.

Against Firecracker it failed. It caused hardlocks through unpatched kernel flaws, but it did not get out. Trail of Bits’ recommendations amount to treating the agent as an APT: minimal-attack-surface hypervisor, least privilege, track upstream instead of trusting distro backports, and time-box how long the agent gets to operate. That last point is the one almost nobody applies: most evaluation harnesses let the agent run until the task is done.

Sources: https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/ · https://cyberinsider.com/experiment-shows-ai-agents-can-escape-secure-vms-using-zero-days/

OpenAI: framework rewritten, big run paused, post-mortem still pending

On 18 August OpenAI detailed the controls it added after July’s Hugging Face intrusion. It is rewriting its Preparedness Framework, has expanded monitoring, hardened isolation of research environments and moved alignment work earlier in training. The reinforcement-learning pause lasted a little over two weeks; smaller and lower-risk workloads have resumed, but the largest frontier RL run is still paused, along with Astra and cyber workloads. Astra is an unreleased model that, according to OpenAI, may reach the Critical threshold in its cyber category. The operational target they set themselves: isolate workloads, inspect tool actions and logs, and alert within 30 minutes.

What is still missing: the promised technical post-mortem of the Hugging Face breach, and the evidence behind Astra’s possible Critical classification. What did arrive, on 16 August, is a post by Greg Brockman that says what the official disclosure didn’t put in those words: “an agentic collective was able to autonomously penetrate not just OpenAI research infrastructure but also the production infrastructure of another company, chaining together vulnerabilities ranging from previously-unknown security flaws to using credentials to user accounts that had been leaked onto the internet.” And a warning with a date attached: “various companies have released open weight models with cyber capabilities only a few months behind the frontier. The most recent of these models appears slated to be released at the end of August, and seems likely to significantly accelerate the threat landscape.”

Sources: https://blog.gregbrockman.com/the-defenders-window · https://techcrunch.com/2026/08/18/openai-institutes-new-safeguards-after-hugging-face-breach/ · https://www.implicator.ai/openai-safety-framework-frontier-training-paused/

The warning came true: GLM-5.3 and open weights with cyber capability

Z.ai released GLM-5.3 on 17 August, trained from the GLM-5.2 base with expanded post-training. The lab’s own numbers: 84.5% on CyberGym (up from 77.2%) and 54.4% on ExploitBench (up from 24.4%). In tests with security teams in China, the model found 2,436 vulnerabilities across 269 projects, of which Z.ai rates 1,097 as critical or high; 53 findings are public and 2,383 remain under embargo. On 26 August it released the weights of GLM-5.3-Flash, the 320B-parameter model with 18B active that had been tested anonymously on OpenRouter as “Ox Alpha”.

Before Z.ai confirmed it, CTGT had already attributed the model through behavioural fingerprinting: matching Z.AI error codes, a temperature ceiling of 1.0 and an exact tokenizer match, despite a system prompt instructing the model to hide its identity. The same analysis surfaced a narrow censorship blacklist: the model answers Xinjiang and Taiwan queries the same way US models do, but blocks seven domestic-legitimacy topics, among them the 2018 removal of term limits.

On the other side, Anthropic announced on 21 August that its enterprise scanning (Claude Security) now runs on Claude Mythos 5, with findings delivered as CWE, confidence and severity rather than raw model output. It added a $35M Defender Advantage Fund for open-source patching and expanded its Cyber Verification Program to give Mythos-class capabilities to vetted researchers. That the same model family which published a malicious PyPI package in July is now the one scanning company code is the operational contradiction we get to live with.

Sources: https://z.ai/blog/glm-5.3 · https://www.ctgt.ai/research/behaviorally-fingerprinting-ox-alphas-provenance · https://claude.com/blog/bringing-claude-mythos-5-to-more-defenders · https://siliconangle.com/2026/08/26/z-ai-open-sources-ox-alpha-model-as-glm-5-3-flash/

OWASP GenAI LLM Top 10 2026: Excessive Agency climbs to third

On 4 August the OWASP GenAI Security Project published the 2026 edition of its Top 10 risks for LLM applications. Prompt Injection and Sensitive Information Disclosure hold positions one and two. The change that matters: Excessive Agency rises from sixth to third, followed by Supply Chain, Data and Model Poisoning, Unbounded Consumption, Misinformation, Hidden Context Exposure, Vector and Embedding Weaknesses and Improper Output Handling.

Two methodological details. First, this is the first edition grounded in real incident data: 75% community vote, 25% incident data drawn from public vulnerability databases and an AI-harm database. Second, “System Prompt Leakage” has been renamed and broadened into Hidden Context Exposure, which covers all non-user-visible context —system instructions, RAG schemas, policy logic— and not just the prompt. OWASP’s advice is what you should already be doing: assume that context can be extracted, keep credentials and tokens out of it, and never use it as your only authorisation control.

OWASP was explicit that this Top 10 covers “models as components”, not agentic behaviour, which has its own list. The Agentic Skills Top 10 and Universal Agentic Skill Format v1.0, also published in August, put malicious skills and supply-chain compromise at one and two, with a Paperclip impersonation campaign that passed 300,000 installs as the reference case. If you want the history of this list, we wrote a critique of the previous edition.

Sources: https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ · https://www.helpnetsecurity.com/2026/08/06/owasp-2026-llm-top-10-released/ · https://www.invicti.com/blog/web-security/owasp-llm-top-10-2026-whats-new

Water: from 30 utilities to more than 100, and a CISA red team nobody spotted

July’s count went up. On 26 August CISA published exposure-reduction guidance citing attacks against more than 100 internet-exposed US water and wastewater systems, against the 30 Minnesota utilities and seven states in the FBI’s PSA. The four steps in the guidance are nothing new: assess exposure with scanning tools, remove what doesn’t need to be exposed, harden what has to stay (unique credentials, updates, jump host, phishing-resistant MFA, remote access through a gateway or VPN rather than connecting straight to a PLC, HMI or RTU), and repeat the assessment routinely. CISA explicitly recommends looking at yourself from outside with Shodan, Censys, Thingful and Shadowserver.

Two useful things landed alongside it. The National Rural Water Association and DEF CON Franklin launched the Water Watch Center, with five MDR providers (Rapid7, Defendify, Legato Security, L1 Secure and Sentinel Technologies) serving utilities with fewer than 10,000 customers, which is more than 90% of the country’s water systems. And CISA published two red team assessments that read best together: at organisation A (government services) the team got in through a web application with default credentials, escalated using the default Machine Account Quota and a misconfigured AD CS template (ESC1), found cleartext credentials in database configuration files and AWS keys set never to expire, and ended up reading the security team’s email without anyone noticing: “thousands of false-positive alerts from normal business operations, many rated at higher severity, obscured the alerts the red team generated.” At organisation B (water and wastewater), the SOC caught the phishing payloads within 2 to 20 minutes and isolated the workstations before the intrusion spread.

CISA’s conclusion is the line to paste into the runbook: “detection tools are only as effective as the people, processes, and procedures supporting them.”

Sources: https://www.cisa.gov/news-events/alerts · https://thehackernews.com/2026/08/cisa-red-team-compromised-two-critical.html

VulnOps: 421, 943, and ten more CVEs into the KEV

On 11 August Microsoft closed 421 CVEs in its Patch Tuesday (Tenable counts 398; the gap is counting methodology), with one exploited 0-day: CVE-2026-68820, a use-after-free in afd.sys giving SYSTEM to a local attacker through a race condition. On 18 August Oracle shipped its Critical Patch Update with 943 new patches covering more than 1,000 CVEs. The same day Atlassian published 10 critical and 162 high-severity third-party dependency flaws, and the next day Splunk issued advisories for more than 150 vulnerabilities. Cisco added two Security Hardening Releases with several CVSS 10.0 CVEs in Secure Workload and Crosswork.

What is being exploited, which is what sets the order:

• CVE-2026-19478 (CVSS 9.4), code injection through a GraphQL directive in GitLab CE/EE that lets an unauthenticated attacker modify or delete public projects and user data. Out-of-cycle patch on 17 August; WatchTowr saw attempts in its honeypots on the 19th. IOC to grep your web logs for: requests containing @gl_introduced.
• CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud, exploited three days after the 11 August patch. And CVE-2026-71362 (CVSS 9.1) in Adobe Commerce, with attempts the same day it was disclosed.
• CVE-2026-21962 (CVSS 10.0) in Oracle HTTP Server / WebLogic Proxy Plug-in, added to the KEV with a 27 August deadline: the patch has been available since the January CPU.
• CVE-2026-18963 (CVSS 9.1) in Keycloak: an unauthenticated attacker forces the credential-reset flow and bypasses email verification. Update to 26.7.2 (RHBK 26.4.15 and 26.6.6) and, in the meantime, disable “forgot password” in every realm.
• CVE-2026-15580 (CVSS 9.4) in N-able Passportal: the browser extension handed access and refresh tokens to any site or iframe that asked, with access to the decrypted vault for up to 100 days. Found by an automated pipeline, fixed within 24 hours. The researcher’s recommendation —end-to-end encryption instead of server-side decryption— is still outstanding.

Between 25 and 27 August CISA added ten CVEs to the KEV, five with three-day deadlines: Gitea (CVE-2026-60004, Git hooks via diffpatch), Citrix NetScaler (CVE-2026-8452), SQL Server (CVE-2019-1068), ownCloud (CVE-2023-49105) and the Linux kernel (CVE-2026-53362, privilege escalation via the IPv6 subsystem). As Ed Skoudis put it, six of the ten date from 2023 or earlier: attackers don’t care whether a bug is old, only whether it still works.

And the month’s counterweight, in case anyone thought the answer was pointing a model at the patch queue: the Off-By-1 Labs (1Password) study generated 6,080 patches with two frontier models for six complex, recent CVEs. Only 26% were a complete fix; 20.1% fixed the flaw but changed application behaviour; 49.3% did not fix it at all; 2.3% fixed it while adding a new flaw, and 2.1% added a flaw without fixing the original. The 53.9% of failed patches got a name of their own: FLAWED, Fix-Like Artifacts with Embedded Defects.

Sources: https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/ · https://www.cisa.gov/known-exploited-vulnerabilities-catalog · https://thehackernews.com/2026/08/critical-gitlab-graphql-flaw-could-let.html · https://thehackernews.com/2026/08/critical-keycloak-password-reset-flaw.html

Supply chain: two arrests in Perth and a republished Rust crate

Australian federal and Western Australia police arrested two men, aged 21 and 23, in Perth on 26 August over alleged membership of TeamPCP, the group behind several campaigns against package registries. The detail that gives the scale of it: TeamPCP ran a contest to see who could compromise the most packages with the Shai-Hulud worm, scored on the weekly or monthly downloads of the infected packages. The investigation started from information supplied by security firms; the Krebs write-up on the case is a decent example of documented OSINT.

More registry movement. On 20 August the Rust Security Response Team confirmed that the arrayref crate was republished with a malicious dependency (proc-macro1) whose build script downloaded a payload; the same author’s internment and append-only-vec crates went too, almost certainly through stolen credentials. The malicious versions were live for 86 to 107 minutes. To check whether it reached you, search ~/.cargo/registry/cache for arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9 or any version of the proc-macro1 family.

Two attribution corrections worth noting. SOCRadar reassigned 2,085 of 2,188 tracked exposures to the Trivy compromise rather than LiteLLM: the malicious LiteLLM packages were only up for 40 minutes on 24 March. And Troy Hunt took apart ShinyHunters’ Carhartt claim: of the 24.8 million records advertised, the dataset was contaminated with TPC-DS benchmark data and Microsoft 365 routing duplicates, and the real figure drops to roughly 12.9 million. The breach happened; the headline number didn’t. Separately, Mozilla revoked a private GPG signing subkey for Firefox and Thunderbird after an unencrypted copy was pushed to a private GitHub repository.

Sources: https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/ · https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/ · https://www.troyhunt.com/a-cautionary-tale-about-data-breach-claims-verification-and-carhartt/

Agents on the other side: dated backdoors and drive-by hijacking

Four pieces of work from the fortnight that belong together:

• Time-release backdoor in an open model. Researchers trained a LoRA on Qwen 3.5 2B so that, from a given date onwards, it would execute a shell command instead of answering. The trick is OpenCode’s system prompt, which injects the current date into context on every turn. It triggered on 7 of 8 in-distribution and 9 of 10 held-out prompts, with no failures before the date. Codex leaks the date by default too. It is the line Anthropic’s sleeper agents already pointed at, now with a trivial trigger.
• NemoClaw (CVE-2026-65105). Cyera found that NVIDIA NemoClaw’s setup binds Ollama to 0.0.0.0:11434 and disables Host-header validation. With that, any website can reach the user’s local API through DNS rebinding and without authentication: list models, extract templates and prompts, delete or overwrite models and —the part that matters— modify a model’s chat template to append hidden instructions to every future system prompt. One visit, persistent poisoning.
• Grok with encrypted instructions. Adversa hosted encrypted instructions on a page along with the key and instructions to decrypt them. When a user asked Grok to summarise the page, the model decrypted it, obeyed the resulting text and built a fake “decryption key” by appending the user’s name, location and chat history, which then left as a URL parameter to an attacker-controlled server. It is exfiltration via indirect prompt injection with an obfuscation layer that walks past input filters.
• Copilot and ?autorun=1. Varonis got Copilot to disclose, through repeated questioning, an undocumented URL parameter that, combined with ?q=, ran injected prompts after a victim clicked a link: search the authenticated mailbox and send what it found out. Microsoft blocked ?q= injection in February and shipped the broader fix as CVE-2026-24301.

In the wild, Dream documented what it describes as the first known “near-autonomous” attack against a government target: open-source frameworks (Hermes and OpenClaw) running self-directed “learning cycles” that adapted to prior failures, with more than 2,500 Taiwanese government personnel records extracted and pivots into IT supply chains, nuclear safety agencies and energy companies. The researchers themselves note the campaign still needed substantial human engineering to work.

Sources: https://morgin.ai/articles/your-open-source-model-could-have-a-hidden-time-release-backdoor.html · https://www.cyera.com/research/nemoclaw-one-website-visit-to-hijack-your-ai-agent · https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/ · https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/

Breaches, outages and arrests

• Boston Scientific: incident identified on 25 August with global disruption. It lost access to operating systems and business applications, including the ability to process and ship orders, and sent employees at its Cork plant home. When a medical device company can no longer ship pacemakers, stents and catheters, the problem belongs to hospitals with procedures already scheduled.
• Manchester Airports Group: 8.7 million people affected across Manchester, Stansted and East Midlands. Car park, lounge and Fast Track bookings and in-airport WiFi sign-ups: email, phone, vehicle registration and postcode, though for most people only the email address. Detected on 25 August; access happened several days earlier.
• Norway: DDoS from 24 August against Vivicta, third-party provider to the digital infrastructure agency (Digdir). Down went the citizen and company authentication portals, the eID system, central government messaging, the public records database and the tax-return portal, and by dependency the national health network and digital post. Stabilised on the 27th. A pro-Russian group claimed it on Telegram, tying it to the Norway-Ukraine defence agreement signed on the 23rd; no official confirmation. It is the third DDoS against Digdir/Vivicta in nine weeks.
• UK: a small power plant was offline for four days in July after a cyberattack, according to The Telegraph. No effect on national supply. The Cyber Security and Resilience Bill is still going through Parliament.
• France: the DGFiP confirmed access to data on 678,000 individuals and businesses (reference tax income, family quotient or withholding rate, SIREN identifiers, cadastral data). The attacker used credentials belonging to a DGFiP agent and an authorised third party. Reported to CNIL.
• Healthcare: CareCloud raised its March breach to 3,756,469 people after notifying HHS OCR; attackers were in the AWS environment from 10 to 16 March. MyDr (Poland) is investigating an incident that may affect 19 million people across 12,000 medical facilities. Paylogix has only now disclosed an exfiltration from November 2025 covering SSNs, financial, medical and passport data. SickKids (Toronto) had employee and job applicant data accessed through a third-party software flaw.
• Corporate and identity: RingCentral (1.6M accounts, social engineering), Beacon CRM (full database theft using an AWS key exposed in public JavaScript), Apollo Global Management (attributed to UNC6671, vishing while posing as IT helpdesk), Sakura Internet (1.36M), ReliaQuest (ShinyHunters, using company.claims domains plus a phone call; view-only access, blocked immediately after), Alation, Quest (Australia) and Sogang University (180,000).
• UT San Antonio delayed the start of term by five days after taking phone, email, connectivity and the password portal offline. No evidence of exfiltration. The response —isolate early, communicate, extend registration deadlines— is the kind you study.
• Arrests and takedowns: DoJ and FBI seized the domains behind QScan and QTRouter, Chinese platforms operating since 2018 against NASA, the Federal Reserve, DOE, DOJ, HHS, NIH and the US Senate; the domains were hardcoded in the tooling, which handed defenders a single choke point. US federal prosecutors charged 17 members of Iran’s Mabna Institute with compromising more than 100,000 professor accounts and stealing 31TB of academic data. And INTERPOL’s Operation Jackal IV closed with 58 arrests and 263 suspects identified across 22 countries, with an estimated €143 million taken through fake investment schemes.

Regulation: 2 August wasn’t quite that empty

A correction to the previous bulletin. We said 2 August 2026 passed “without anything new taking effect” and that Article 50 transparency under the AI Act was a December date. That is imprecise. What the Digital Omnibus moved was high risk (Annex III to December 2027, Annex I to August 2028). Article 50 does apply from 2 August 2026: disclosure that the user is interacting with an AI, marking of synthetic content, notice about emotion recognition and biometric systems, and labelling of deepfakes and generated text on matters of public interest. What is deferred to 2 December 2026 is only the machine-readable marking under Article 50(2) for systems already on the market before 2 August. Content generated before that date needs no retroactive labelling.

The same date brought enforcement powers into play: the European AI Office can request documentation and model access to evaluate general-purpose providers, impose corrective measures and restrict availability. Fines reach €35M or 7% of global turnover for prohibited practices and €15M or 3% for transparency breaches. The Commission published its final Article 50 guidelines on 20 July and confirmed the Code of Practice on Transparency of AI-Generated Content as adequate. In Spain, the designated market surveillance authority is AESIA.

The rest of the calendar, unchanged and dated:

• NIS2 in Spain: on 9 July the Commission decided to refer Spain to the Court of Justice of the EU for failing to notify transposition measures. August moved nothing: the Cybersecurity Coordination and Governance Bill is still not published in the BOE.
• Spanish AI governance bill (121/000096): in the Economy, Trade and Digital Transformation Committee, in the amendments phase, with the deadline extended to 2 September 2026. Parliamentary recess, zero movement.
• Cyber Resilience Act: 11 September 2026 starts the Article 14 reporting obligations. Early warning within 24 hours, full notification within 72, final report 14 days after a corrective measure exists for actively exploited vulnerabilities. One submission through ENISA’s Single Reporting Platform, to the CSIRT where you have your main establishment. It applies to products already on the market too. That is the live date for next month’s bulletin.

Across the Atlantic, the White House issued a memorandum on 12 August allowing vetted private companies to conduct cyber surveillance and cyber effects operations against foreign cyber-enabled transnational criminal organisations, under federal control and with operating procedures due by 11 October. It is not open season on hacking back: it needs a contract, vetting and deconfliction, and it bars anything that could cause loss of life or rise to the level of use of force. Brian Honan’s warning is the one that matters most in Europe: a company that joins offensive operations becomes a target, without the legal or diplomatic protections a state agency has.

Sources: https://digital-strategy.ec.europa.eu/en/policies/cra-reporting · https://artificialintelligenceact.eu/transparency-rules-article-50/ · https://www.congreso.es/es/proyectos-de-ley

Rest of the month

• Slovakia: the NBU found a backdoor in newly installed NERO R-ONE traffic speed cameras, granting shell and network access via SMS from hardcoded Russian phone numbers. Bought through a Cypriot shell company, they turned out to be rebadged units from a St Petersburg manufacturer. They also shipped with SecureBoot disabled and live video exposed without authentication.
• Cloudflare Workers: researchers extracted a JWT from a co-located Worker at 12 bits per second with 99.16% accuracy, using WebSockets for remote timing and Durable Objects to keep code running. Cloudflare deployed improved DyPrIs, V8 Sandbox protections and MPK-based isolation; no customer data was accessed.
• Citizen Lab documented two surveillance vendors exploiting SS7 and Diameter to track phones. One campaign followed a VVIP executive’s phone across 11 operator identities in nine countries in four hours, switching protocols to dodge firewalls. Another used an SMS with hidden SIM commands to turn a phone into a tracking beacon.
• Cars: Kaspersky documented the first known malware targeting aftermarket Android head units running DoFun firmware. It arrives through the legitimate update mechanism, takes orders from an MQTT broker and turns the car into a SOCKS5 proxy node and click-fraud client. No evidence of interference with physical vehicle controls. The zhima module showed up on set-top boxes in the same period, and Kaspersky links it with high confidence to the actor behind BADBOX.
• Dahua: Hunt.io uncovered a 35-day campaign against 14,500 IP cameras, mostly in Ukraine and Russia. 12,234 by brute force on port 37777, 1,923 by exploiting known flaws and 283 behind NAT using only serial numbers and SDK credentials embedded in Dahua’s own apps.
• macOS: the Screen Sharing CVE-2026-65400 we covered in the first half started being exploited on 12 August after a PoC was published, giving root and installing a Monero miner on exposed port 5900. And AmnesiaStealer arrived via ClickFix from a fake Codex download page promoted by Google ads above OpenAI’s real result: it asks for the password “to confirm the installation”, opens the keychain and sets up remote browser control through the Chrome DevTools Protocol.
• Ransomware Q2 2026 (Check Point): 93 active groups, the top ten’s share falling, Qilin the most prolific and a newcomer, The Gentlemen, that built its management panel in three days with coding assistants. The payment rate falls to a multi-year low of 23%.
• Industry: Nvidia closed —reportedly, with caveats over whether the deal is actually signed— the acquisition of Hugging Face for $12.9 billion. The repository an OpenAI agent moved through for four and a half days, and whose public datasets hold 221,303 live secrets, goes to the largest accelerator manufacturer.

The through line: isolation was bought, not verified

July said unverified isolation was the vulnerability. The first half of August added that the long-lived credential is what turns an escape into a breach. The second half removes the last excuse: the VM is not the boundary you thought it was. A model with SSH access and twelve hours chained three 0-days and walked out of a patched QEMU/KVM; Firecracker held because it has less surface, not because the model was worse. The same pattern repeats outside the lab: at organisation A in CISA’s red team, isolation existed on paper (SOCs, alerts, EDR) and thousands of false positives ate it; in water, the gap between PLC and internet exists in the diagram and not in the cellular modem; in Passportal, the vault was encrypted and the token that decrypts it travelled to any iframe that asked.

What is actionable this month:

1. Treat the evaluation agent as an APT. Minimal-attack-surface hypervisor (Firecracker over generic QEMU/KVM), least privilege, a clean environment per session and a time limit. An agent you let run for twelve hours is a pentester with twelve hours.
2. Track upstream, not the backport. Two of the three escapes used bugs already fixed upstream that hadn’t reached the distribution. If you isolate hostile workloads, that lag is your window.
3. Look at yourself from outside with Shodan and Censys. It is literally CISA’s recommendation. If you can find an exposed PLC from the internet, somebody already has.
4. Count your false positives as security debt. Organisation A had detection and detected nothing. Thousands of high-severity alerts generated by normal operations are an engineering failure, not an inevitable cost.
5. Review Article 50 before December. If you run a chatbot, generate synthetic content or label deepfakes, the obligation started in August, not December. Only machine-readable marking of pre-existing systems has the 2 December extension.
6. The CRA clock starts on 11 September. 24 hours for the early warning. If you make products with digital elements, the notification procedure has to be written and rehearsed before that date, not after the first incident.
7. Don’t delegate the patch. 53.9% of frontier-model-generated patches in the 1Password study either didn’t fix the flaw, fixed it by breaking the application, or introduced a new one. They work as a draft with a competent human reviewing; not as a button.

September brings the start of CRA Article 14 reporting, the verdict in the Zurich ransomware case on the 10th, and the test of whether GLM-5.3-Flash with published weights really accelerates what Brockman anticipated.