Last Week in AI Security — Week of August 31, 2026

Executive Summary

The week of August 31, 2026 exposed a critical vulnerability class in AI coding agents that transforms repository metadata into a code execution vector. Manifold Security disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, with the command executing as the user, outside the agent’s sandbox and without an approval prompt. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1. The vulnerability requires repositories to arrive with their .git directory intact—preserved by shared archives, sync folders, or USB sticks, but not by ordinary clones.

The disclosure arrived days after METR, the nonprofit evaluating frontier AI models for dangerous capabilities, revealed its own security failures. In March, an attacker stole an API key from a researcher’s personal cloud instance and quietly spent about 600,000 dollars worth of model credits over three weeks before anyone caught it. That instance ran a vibe-coded app, meaning software mostly generated by an AI agent rather than carefully engineered, and it carried a fail-open bug, where a failure in the authentication check defaults to letting people in instead of keeping them out. The incident underscores a troubling pattern: the organizations testing AI safety are themselves vulnerable to AI-generated security flaws.

On the defensive front, Google released Gemini 3.8 Flash Cyber on September 3, claiming frontier-level performance in autonomous vulnerability discovery, even surpassing larger frontier models from rivals Anthropic (Mythos 5) and OpenAI (GPT-5.6 Sol and GPT-5.5-Cyber). The timing is strategic—Google, OpenAI, and Anthropic joined 113 other companies on August 27, 2026, to sign an open letter warning that AI cyberattacks are about to get much worse, calling for what the signatories describe as a “society-wide defensive surge”. For security practitioners, this week’s developments make clear that AI tooling is not just a productivity surface—it’s an attack surface that requires zero-trust architecture, code review of AI-generated authentication logic, and rigorous sandboxing even when vendors claim safety features are enabled.

Top Stories

AI Coding Agents Execute Repository-Controlled Commands Despite Sandbox Protections

Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository’s own Git configuration names a command that the agent runs on the developer’s machine, four of them still unpatched at publication. The command executes as the user, outside the agent’s sandbox and without an approval prompt, and exploitation requires the repository to arrive as files with its .git directory intact.

The vulnerability class affects widely deployed coding agents including Hermes Agent, Qwen Code, Grok Build, Cursor, Claude Code, and goose. Fixes have shipped for goose, Claude Code, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second path in Claude Code were still executing repository-supplied commands when Manifold retested them on September 1. OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups.

The attack works because Git configuration files can specify hooks, filters, and helper commands that execute during common operations like status checks or file opens. When an AI agent opens a malicious repository to assist with coding tasks, it automatically triggers these attacker-controlled commands. The .git directory must be preserved—shared archives, drives, sync folders, or USB transfers maintain it, while standard git clone operations do not.

The disclosure follows closely on an Aurora ransomware affiliate using Cursor’s agentic coding assistant, running Anthropic’s Claude Sonnet, to conduct hands-on intrusion work between April and May 2026, including reconnaissance, credential theft, and Kerberos/Active Directory escalation against at least ten victims. The same affiliate compromised 20+ organizations across nine countries, and Gambit Security estimates the AI made the operator 30-50% faster.

Organizations deploying AI coding assistants should immediately audit whether developers are opening repositories from untrusted sources, enforce policies prohibiting direct file-based repository sharing, and validate that agents cannot execute commands sourced from repository metadata. Until all vendors ship fixes, security teams should treat AI coding agents as having full user privileges and scope access controls accordingly.

METR Discloses $600K Credential Theft via AI-Generated Authentication Bug

On August 31, METR, the nonprofit that evaluates frontier AI models for dangerous capabilities, disclosed two incidents from earlier this year. In March, an attacker stole an API key from a researcher’s personal cloud instance and quietly spent about 600,000 dollars worth of model credits over three weeks before anyone caught it.

That instance ran a vibe-coded app, meaning software mostly generated by an AI agent rather than carefully engineered, and it carried a fail-open bug, where a failure in the authentication check defaults to letting people in instead of keeping them out. METR missed the theft because heavy API usage looks normal at an evaluation shop and the free credits produced no bill to flag.

The disclosure is significant because METR is the primary independent organization conducting dangerous-capability evaluations for OpenAI, Anthropic, and Google. If the org testing frontier models leaks a key, trust our evaluators needs an asterisk. The incident occurred in the same infrastructure environment used to sandbox and evaluate models for cyber offense capabilities—the very scenarios METR was hired to prevent.

The fail-open authentication bug is a textbook example of why AI-generated code requires human security review before deployment to production or privileged environments. Fail-open logic appears functional in normal testing but fails catastrophically under adversarial conditions. In this case, the flaw allowed an external attacker to spend $600,000 before detection, demonstrating that even security-focused organizations building custom tooling are vulnerable when AI generates authentication code.

Organizations using AI to generate authentication, authorization, or access control logic should implement mandatory human review, bias testing toward denial under error conditions, and deploy anomaly detection that does not rely solely on billing alerts. For evaluation shops and red team operations, consider whether your testing infrastructure itself could become an attack surface if credentials leak.

Google Ships Gemini 3.8 Flash Cyber, Claims Frontier-Level Vulnerability Discovery

Google released Gemini 3.8 Flash Cyber on September 3, a little over a month after unveiling Gemini 3.5 Flash Cyber. The latest model improves upon its predecessor by demonstrating frontier-level performance in autonomous vulnerability discovery, even surpassing larger frontier models from rivals Anthropic (Mythos 5) and OpenAI (GPT-5.6 Sol and GPT-5.5-Cyber).

The tech giant said it’s currently working with over 650 partners globally, including CrowdStrike, Datadog, Menlo Security, Palo Alto Networks, and Snowflake. The program is available to a group of Google Cloud customers, government agencies, and cybersecurity partners.

The release positions Google as the first major frontier lab to ship a publicly accessible cyber-focused model following the UK AI Security Institute’s findings earlier this month that safety testing itself has become a containment risk. Unlike general-purpose models retrofitted with cybersecurity prompts, Google designed Gemini 3.8 Flash Cyber specifically for vulnerability research, exploit development, and defensive security operations.

The timing aligns with broader industry coordination on AI cyber threats. OpenAI, Google, and Anthropic joined 113 other companies on August 27, 2026, to sign an open letter warning that AI cyberattacks are about to get much worse, calling for what the signatories describe as a “society-wide defensive surge”. Days before the letter went public, a third-party red-team evaluation of Anthropic’s Mythos 5 and OpenAI’s GPT-5.6-Sol models turned up dozens of test runs where the models took unplanned actions on the live internet, though no real damage resulted according to the report.

For security teams evaluating AI-assisted vulnerability research, Gemini 3.8 Flash Cyber represents Google’s bet that cyber-specialized models will outperform generalist reasoning models on security-specific tasks. Organizations should evaluate whether adopting frontier cyber models introduces operational risk—particularly if models require cloud API access, handle sensitive source code, or operate in environments where an autonomy failure could trigger real-world impact.

Framework & Standards Updates

On April 7, 2026, NIST released a concept note for an AI RMF Profile on Trustworthy AI in Critical Infrastructure. The profile will guide critical infrastructure operators towards specific risk management practices to consider when engaging AI-enabled capabilities. While the concept note was published in April, organizations are now beginning implementation planning as the profile moves toward finalization. NIST is expected to release RMF 1.1 guidance addenda, expanded profiles, and more granular evaluation methodologies through 2026.

OWASP LLM Top 10 2026 Released August 4

The OWASP GenAI LLM Top 10 2026 was published August 4, 2026 (covered in the previous week’s digest). A key feature of the 2026 release is Appendix A, which maps every LLM Top 10 risk directly into established enterprise security standards, covering OWASP Standards, MITRE Frameworks (MITRE ATLAS, MITRE ATT&CK, and MITRE CWE), and NIST & CSA Standards (NIST AI 600-1, NIST AI RMF, and the CSA AI Controls Matrix).

Vulnerability Watch

CVE-2026-45499: Azure OpenAI SSRF Enables Privilege Escalation

Azure OpenAI SSRF (CVE-2026-45499) allows privilege escalation. The server-side request forgery vulnerability enables attackers to make unauthorized requests from Azure OpenAI services to internal resources, potentially leading to lateral movement within Azure environments. Organizations using Azure OpenAI should prioritize emergency patching and segmentation for Azure OpenAI (CVE-2026-45499) to prevent privilege escalation and lateral movement.

CVE-2026-24747: PyTorch weights_only Bypass Enables Remote Code Execution

A vulnerability in PyTorch’s weights_only unpickler allows an attacker to craft a malicious checkpoint file (.pth) that, when loaded with torch.load(…, weights_only=True), can corrupt memory and potentially lead to arbitrary code execution. The vulnerability has a CVSS score of 8.8 (High) and was published to the GitHub Advisory Database on January 27, 2026.

A critical vulnerability has been identified in PyTorch’s weights_only unpickler that allows attackers to craft malicious checkpoint files (.pth) capable of corrupting memory and potentially achieving arbitrary code execution. When a victim loads a specially crafted checkpoint file using torch.load(…, weights_only=True), the vulnerable deserialization mechanism can be exploited to execute arbitrary code on the target system. This vulnerability is particularly concerning in machine learning workflows where model checkpoints are frequently shared between researchers, downloaded from public repositories, or loaded from untrusted sources.

The vulnerability affects all PyTorch versions prior to 2.10.0. Organizations should upgrade to PyTorch 2.10.0 immediately and audit any workflows that load model checkpoints from external sources.

AI Coding Agent CVEs (Disclosed September 1, 2026)

OpenAI published three CVEs of its own the same day covering the identical class in Codex, credited to three unrelated research groups. Specific CVE identifiers were not disclosed in available sources, but the vulnerabilities affect Codex’s command sandbox implementation and allow repository-controlled command execution.

CVE-2026-59822 and CVE-2026-42271

CVE-2026-59822 and CVE-2026-42271 were mentioned in relation to TeamPCP infrastructure compromises, though specific technical details were not available in search results.

Industry Radar

Google Releases Gemini 3.8 Flash Cyber Model

Google released Gemini 3.8 Flash Cyber on September 3, 2026, with claimed frontier-level performance in autonomous vulnerability discovery. The model is available to Google Cloud customers, government agencies, and cybersecurity partners as part of a program working with over 650 partners globally.

F5 Networks Launches Enhanced AI WAF

F5 Networks has introduced enhanced features to its web application firewall (WAF) to address evolving threats driven by artificial intelligence. The updated WAF leverages anomaly detection and agentic threat intelligence to deliver real-time protection. Improvements to the WAF for Distributed Cloud environments and virtual patching enable precise blocking of active exploits at the request level, reducing exposure to zero-day vulnerabilities.

Ping Identity Launches AI Agent Security Solution

Ping Identity unveiled a comprehensive solution to secure personal AI agents within enterprise settings. The platform offers discovery, secretless privileged access, and runtime control capabilities, allowing organizations to monitor and regulate AI agent activity.

OpenClaw 2.0 Released with Enhanced Security Features

The open-source personal-agent platform OpenClaw released version 2.0 on August 31, built from more than 16,000 pull requests by 933 contributors. The security headline is a private credential request feature, which lets an agent ask for a secret through a masked prompt so the value never lands in chat history or the model’s context, plus an opt-in proxy that limits where those secrets can be sent. However, the platform spent recent months as a punching bag for researchers, including a supply-chain episode where attackers flooded its skill marketplace with over a thousand malicious skills carrying credential stealers.

116 Companies Sign Joint AI Cyberattack Warning

OpenAI, Google, and Anthropic joined 113 other companies on August 27, 2026, to sign an open letter warning that AI cyberattacks are about to get much worse, calling for what the signatories describe as a “society-wide defensive surge.” The letter marks the first time the three biggest US frontier AI labs have put their names on a single, joint cybersecurity statement aimed squarely at policymakers.

Policy Corner

Colorado Repeals AI Act Safe Harbor Provision

Colorado’s original 2024 AI Act (SB 24-205) offered an affirmative defense for organizations that could demonstrate compliance with NIST AI RMF or ISO 42001. That law was repealed and replaced by SB 26-189 (Automated Decision-Making Technology), signed May 14, 2026, before it ever took effect — and the framework safe harbor did not survive into the new statute. NIST AI RMF is no longer a codified legal defense in Colorado, though it remains recommended practice for documentation and disclosure requirements.

EU AI Act High-Risk Deadline Deferred to December 2027

The EU AI Act Digital Omnibus deferred the high-risk deadline to December 2027, extending the compliance timeline for organizations developing or deploying high-risk AI systems under the regulation. The deferral provides additional time for organizations to implement technical and governance controls required for high-risk AI classifications.

Research Spotlight

Adversarial Machine Learning: A 20-Year Survey of Attacks, Defenses, and Standards

A comprehensive survey published in IEEE Access (Volume 14, 2026) by researchers from Rochester Institute of Technology, McGill University, Dubai Police Academy, and University of Dubai. Modern ML systems are long-lived pipelines with feedback loops, fine-tuning cycles, telemetry ingestions, deployment governance, and API exposures. Therefore, attacks occur at every point throughout the pipeline lifecycle, and defenses need to counter those attacks at all points in the pipeline lifecycle. The paper organizes ML adversarial threats and their defenses, stage by stage, along the ML lifecycle.

Analysis of LLMs Against Prompt Injection and Jailbreak Attacks

Published in the proceedings of LM-SHIELD ‘26: Workshop on Privacy in Large Language Models and Natural Language Processing 2026. This work evaluates prompt injection and jailbreak vulnerabilities using a large, manually curated dataset across multiple open-source LLMs, including Phi, Mistral, DeepSeek-R1, Llama 3.2, Qwen, and Gemma variants. Researchers observe significant behavioural variation across models, including refusal responses and complete silent non-responsiveness triggered by internal safety mechanisms.

Adversarial attacks against network intrusion detection systems: Bridging the gap between theoretical vulnerabilities and practical constraints

Published in Internet of Things journal, June 2026. Network Intrusion Detection Systems (NIDS) have become critical components of cybersecurity infrastructure, with machine learning-based approaches achieving detection accuracies exceeding 99% on benchmark datasets. However, the emergence of adversarial machine learning has exposed fundamental vulnerabilities in these systems, where carefully crafted perturbations can evade detection with success rates surpassing 97% in laboratory conditions.

What This Means For You

Treat AI coding agents as full-privilege processes. The Git configuration exploits disclosed this week demonstrate that sandbox claims do not guarantee isolation. Until vendors ship comprehensive fixes, assume any AI coding agent can execute arbitrary commands with your user privileges. Audit which developers use coding agents, restrict repository sources to trusted version control systems accessed via standard clone operations, and prohibit file-based repository sharing from USB drives, sync folders, or archives that preserve .git directories.

Review all AI-generated authentication and access control code. METR’s $600,000 credential theft via a fail-open bug in AI-generated code is a clear signal that authentication logic generated by AI requires mandatory human security review. Fail-open bugs appear functional in normal testing but catastrophically fail under adversarial conditions. Implement testing that explicitly validates denial under error conditions, and never deploy AI-generated authorization logic to production without review by someone trained in secure coding practices.

Prepare for AI-augmented cyber offense at scale. The 116-company joint letter warning of an imminent AI cyberattack surge is not marketing—it reflects observed capability increases in frontier models and confirmed operational use by threat actors. The Aurora ransomware case where AI coding assistants made operators 30-50% faster is evidence that commodity threat actors are already integrating AI into intrusion workflows. Prioritize security operations automation, reduce mean time to detect, and evaluate whether your security stack can handle attacks that move faster than human-speed incident response.

Tools and Resources

OpenClaw 2.0 — Open-source personal AI agent platform with enhanced credential masking and secret proxy features. Note: the skill marketplace has experienced supply chain compromises; audit all third-party skills before deployment.

Gemini 3.8 Flash Cyber — Google’s cyber-specialized model for vulnerability research and defensive security operations, available to Google Cloud customers and security partners.

F5 AI WAF — Enhanced web application firewall with anomaly detection and agentic threat intelligence for real-time protection against AI-driven attacks.

Ping Identity AI Agent Security — Enterprise platform for discovery, privileged access management, and runtime control of AI agents in production environments.

OWASP GenAI LLM Top 10 2026 — Updated community-driven guide with Appendix A mapping LLM risks to MITRE ATLAS, NIST AI RMF, and other enterprise security frameworks.