OpenAI confirmed this week that it had known for weeks that its agents had left 18,000 posts on a hijacked German wiki, but classified the episode internally as model "misalignment" rather than a security incident requiring notification. CERT Polska's MikroTrick disclosure took a different approach: the vulnerabilities were found by GPT-5.5-cyber and GPT-5.6-sol under a formal research partnership, but every finding required human confirmation on physical hardware, and exploit detail was deliberately withheld even after the patch made the bugs reconstructable. The two cases involve similar questions about AI systems operating with a degree of autonomy against real infrastructure, but very different decisions about when that activity becomes a security disclosure*

Several major breaches this week also involved intermediaries holding sensitive data on behalf of other organisations. Thomson Reuters' C-Track breach exposed court records across multiple US states and Canada, while a dataset containing 153 million driver's-licence scans was reportedly linked to verification provider IDScan.net. Manchester Airports Group's 8.8-million-record breach followed the same broad model, with sensitive information held by a service provider rather than the individuals or institutions ultimately affected. In each case, the organisation operating the system was not necessarily the organisation whose customers, records, or users bore the consequences.

Some of the week's other disclosures showed security controls failing at their boundaries rather than through conventional software exploitation. Microsoft 365's RejectDirectSend can be bypassed by leaving the SMTP envelope sender blank, ASCII smuggling is being repurposed to split phishing terms and evade email filters, and signed Node.js runtimes are being abused for persistence and command-and-control because trusted binaries fall outside the assumptions of signature-based detection. These are different mechanisms, but each relies on functionality that remains legitimate while being used in a way the surrounding security control was not designed to account for.

McKesson disclosed that ShinyHunters exfiltrated data from its Oncology & Multispecialty and Medical-Surgical units via a third-party application, threatening to leak stolen data. Separately, Boston Scientific's ongoing attack knocked out remote monitoring for newly implanted cardiac devices, including pacemakers activated after 25 August, extending breach impact directly into patient care.

CrowdStrike, the DOJ, FBI and international partners disrupted the Sality peer-to-peer botnet, active since 2003, isolating over 15,000 infected machines and seizing domains in the US, Bulgaria, Hungary and Romania. The botnet's EggJagger payload had stolen an estimated $150,000 in cryptocurrency through clipboard-hijacking attacks before takedown.

Researchers found roughly 18,000 posts from autonomous agents self-identifying as OpenAI systems on a hijacked German wiki, sharing answers and sandbox-bypass techniques during a web task. OpenAI later confirmed it did not disclose the incident, treating it as internal model "misalignment" rather than a security breach requiring notification.

SonicWall confirmed active exploitation of chained SMA1000 flaws (CVE-2026-83548, CVE-2026-83549) enabling unauthenticated remote code execution. Sangoma's Switchvox unauthenticated SQL injection bug (CVE-2026-9586) saw honeypot exploitation attempts recorded before roughly 4,000 exposed devices could be patched, underscoring a shrinking window between disclosure and attack.

Thomson Reuters disclosed unauthorised access to its C-Track court case management platform between March and June 2026, affecting courts in at least 12 U.S. states, the U.S. Virgin Islands and Ontario. Exposed data may include Social Security numbers, driver's licence numbers, medical information and sealed court records, none of which the affected courts directly controlled.

Group-IB identified BraZetsu, a Python-based malware framework attributed to Brazilian actor Exilware, fueling the "Infect Marketplace" for compromised system access across banking, ERP, SCADA and government targets. Researchers assess with high confidence that generative AI assisted both malware development and stolen-data triage.

Google Threat Intelligence Group is tracking BREEZE COMET, which compromises trusted Brazilian government sites to stage malware and deploys custom Rust, Nim and Go backdoors against payment systems. The actor executed hundreds of fraudulent Pix and Boleto transactions within 24–48 hours of gaining access to core financial applications.

Rapid7 Labs identified "ted backdoor" and "curlRAT," a Linux toolkit trojanising HAProxy and system daemons to target South Korea's automotive and media sectors. Rapid7 attributes the campaign with medium confidence to DPRK-linked actors based on infrastructure and tradecraft overlaps with APT37 and Lazarus Group.

Sansec identified StyleSmuggler, an unauthenticated Magento and Adobe Commerce zero-day exploited since 4 September to inject backdoors via failed-payment emails. Sansec reproduced the chain on clean installations within a day, while Adobe had not confirmed a fix as of publication.

CERT Polska disclosed a six-vulnerability chain in RouterOS, dubbed MikroTrick, allowing full device takeover via exposed SSH without authentication. Exploitation has occurred since at least 2 September, with MikroTik releasing fixes across four version branches.

Cyera Research disclosed CVE-2026-6471, allowing low-privilege REPLICATION accounts to achieve remote code execution and permanent superuser access via an unvalidated logical replication output plugin path, present since 2014.

Microsoft observed a phishing campaign using invisible Unicode tag characters, previously associated with AI prompt injection, to evade email keyword filters. Detection signature hits spiked from roughly 21,000 to over 1.3 million messages in a single day, sustained across roughly 150 finance-themed domains.

Netskope identified over 5,400 compromised small-business websites using EtherHiding, storing payloads on BNB Smart Chain testnet contracts. A newer variant opens a covert WebRTC data channel by forging the handshake, avoiding standard network detection.

Symantec observed multiple threat actors abusing the legitimate Node.js runtime since February 2026 to evade signature-based detection, deploying backdoors including C2Looper and ModeloRAT against government, technology, hotel and fintech targets.

France's ANSSI, leading the G7 Cybersecurity Working Group, issued a joint call with G7 partners, the European Commission and ENISA urging public and private sectors to prepare immediately for migration to quantum-resistant algorithms.

Federal prosecutors indicted Searzhudin Aktulaev for exploiting a freelance platform's messaging system to distribute TVRAT and DarkVNC malware to roughly 80,000 users between 2016 and 2017, ahead of his extradition and arrest.