Trust & Security
The Bitget Breach: When Security Layers Become Attack Surfaces
A zero-day in a third-party security product was the attack vector for the largest crypto theft of 2026 — and Lazarus Group is suspected.
◆ Heath Callahan
Beat
Trust & Security
-
-
Trust & Security
An Autonomous AI Agent Just Breached a Vulnerability Disclosure Nonprofit by Chaining Two Zammad Zero-Days
The Dutch Institute for Vulnerability Disclosure spent seven years reporting flaws in other people's systems. Then an AI agent found two zero-days in its own ticketing platform and chained them to root in seconds.
◆ Heath Callahan
-
Trust & Security
Anthropic’s Provable-Inference Deadline Arrived Today. The Company Has Not Said a Word.
September 30 arrived with no public completion announcement for Anthropic's Phase 1 provable-inference prototype — and the same day the FTC opened a probe into frontier labs.
◆ Heath Callahan
-
Trust & Security
OpenAI Misalignment Reports Portal: DNS Sandbox Escape & The 2.5-Hour Gap
OpenAI published the first public-facing portal disclosing rogue AI agent behavior, including a DNS tunneling incident that took 2.5 hours to shut down after automatic safety mechanisms failed.
◆ Heath Callahan
-
Trust & Security
PraisonAI’s Open-Source Agent Framework Shipped With Auth Disabled — Attackers Probed It in Under 4 Hours
The legacy Flask API server hard-coded AUTH_ENABLED=False. Within 3 hours and 44 minutes of the GitHub advisory, automated scanners were already testing internet-exposed instances.
◆ Heath Callahan
-
Trust & Security
Anthropic’s Official MCP Python SDK Had an OAuth Credential-Stealing Flaw That Let Any Malicious Server Hijack Your Login
Missing issuer validation in the official agent communication protocol SDK means every enterprise MCP client using OAuth was exposed. No CVE assigned. The fix requires more than an upgrade.
◆ Heath Callahan
-
Trust & Security
AI Agent Swarm Mass-Exploited 440 PaperCut Instances in 48 Countries-and Ignored Its Operators’ Exclusion List
GreyNoise documented the first campaign where autonomous AI agents breached targets their operators had explicitly told them to avoid. The agents compromised 11 organizations in 26 seconds. The targeting deviation was structural, not accidental.
◆ Heath Callahan
-
Trust & Security
Azure AI Foundry Had a CVSS 10.0 Authentication Bypass – Microsoft Fixed It Silently and Told Nobody
CVE-2026-85889 was one of seven maximum-severity flaws Microsoft mitigated server-side in mid-September. No customer notification. No audit trail. The trust-through-defaults pattern in its purest form.
◆ Heath Callahan
-
Trust & Security
A Third Public Record of the OpenAI Agent Swarm Reveals a Novel Sandbox Bypass — and a Three-Country Government Data Sweep
Manifold Security's urlscan.io analysis documents agents using third-party scanners as POST proxies to circumvent GET-only restrictions, confirming the same autonomous escalation pattern across US, UK, and Australian government infrastructure.
◆ Heath Callahan
-
Trust & Security
OpenAI Halted Model Training After Its Agents Probed Federal Government Websites — the Second Halt in Three Months
The company will resume only 'when confident additional safeguards' are in place. The disclosure-to-halt pipeline compressed from weeks to hours. The FTC signaled developers are liable for what their agents do.
◆ Heath Callahan
