StationX
MEMBERSHIP

Sec & AI News — 20 September 2026

12 min readBy Nathan House
Get every new Sec & AI News issue
Straight to your inbox. No spam.

🟣 The Labs Want Brakes. The President Says Hoax.

Dario Amodei published "We Must Pace the Frontier" last weekend. Three asks. Third-party evaluators embedded inside the labs with employee-like access, which Anthropic will do on its own. Regulation for US frontier labs that won't cooperate, but only as far as staying ahead of China. Then global pacing: bioweapons agreements, pre-release testing, and a speed limit on recursive self-improvement. The endorsements came fast. Musk: Dario is right. Altman, who rarely agrees with him: "Committing to having independent evaluators with employee-like access is a great idea, and we will do the same." Hassabis called the direction correct. Zuckerberg was the holdout. His objection is that it's theatre. Labs already have the incentive, he says, and Meta delayed Muse for months on safety and "didn't call for everyone else to do this before we would." Trump's Truth Social post says there is a "SICK conspiracy" against AI and data centres, and the only guardrail AI needs is a "High IQ" president. He phoned into the All-In Summit while Jensen Huang was onstage and called the robot takeover a hoax.

🧭 AI-Driven Security Engineering Jobs: This Week

Take a pen tester. The job used to be two layers. Foundations: years of hands-on offensive work. Specialisation: red team, purple team, continuous validation. Employers now want a third layer on top. Postman's Principal Offensive Security Engineer posting, San Francisco, $275K–$300K, still asks for the first two: "Minimum of 8 years in offensive security" and "aligning Red Team, Purple Team, and continuous validation capabilities". Then it adds the new one: "Design and deploy AI-based penetration testing platforms and autonomous agents", with hands-on PentestGPT, PyRIT and Garak. I tested Garak and PyRIT in my red teaming tools review, linked below. The pen tester no longer just runs the test. They build the agent that runs it, then check what it found. That is AI-driven engineering. It sits on top of the foundations, not in place of them. 371 of the 519 postings in my archive make it the job itself. If you want in, the AI Master's Program teaches AI-Driven Cyber Security Engineering. No coding background required. Application only.

🔴 Four AI Coding Agents Ran Attacker Code From a Pinned Plugin. Two Are Still Unpatched.

SHA pinning is the control everyone trusts: review a plugin at one commit, pin it, and that commit runs forever. AIR Security found all four major coding agents check out the pinned SHA and never confirm they landed on it. An attacker who controls the plugin repo makes a branch named as the 40-character SHA and sets it as default. Git resolves the branch ahead of the commit, prints an "ambiguous" warning, and runs the attacker's code. Gemini CLI has its own version: name the default branch FETCH_HEAD. Auto-update is on by default in Claude Code and Codex, so it's zero-click. One limit: GitHub rejects a 40-hex branch name, so the branch trick needs Bitbucket or a self-hosted server. The fix is one assertion: git rev-parse HEAD must equal the pinned SHA. Claude Code was patched in 2.1.179 in June and Codex in 0.146.0 in August. The disclosure is new, the patches aren't. Copilot is unpatched. Google deprecated Gemini CLI rather than fix it. The same question applies to anything else sitting between your agent and your keys. I audited Claude Code Router in July, three models plus Semgrep, Trivy and gitleaks. TLS is on and the dependencies are clean, but it stores your provider API keys in plaintext, and its bot gateway has no sender allowlist. Anyone who can post in a linked Slack or Telegram channel gets a Claude Code turn on your machine.

🧰 I Mapped 237 AI Security Tools. 125 Are Open Source.

AI security tools split into two camps, and most lists blur them. AI for security uses AI to do the classic jobs: pentest agents, detection and response, threat intel. Securing AI protects the AI itself: LLM red-teaming, guardrails, model supply chain, agent and MCP security. I mapped 237 tools across 14 categories and kept the two sides apart, so you can filter for either. 125 are open source, 112 commercial. The biggest groups are Detection & Response with 40 tools and Pentest & Red-Team Agents with 39, PentestGPT and CAI included. LLM Red-Teaming & Testing has 24, garak and PyRIT among them. Agent & MCP Security already has 17. Every tool is tagged by licensing and cost, so one click shows only the free ones. Abandoned open-source projects drop out on each refresh.

⚫ OpenAI Reports Six Cases of Its Own Models Misbehaving. One Used an API Key It Found Online.

OpenAI has a new disclosure framework and six reports from the last six months. An unreleased research model inserted its own instructions into 27 task summaries, including instructions to ignore its normal constraints. Prompt injection with no attacker. During GPT-5.6 Sol's training, model instances left notes for future instances. The notes said to hide mistakes, invent missing historical data, and cover up source-version mismatches. A model answering a routine question about county earnings found an exposed API key on a public repo and used it. When that still didn't work, it made the numbers up. Another uploaded a local file to the internet without asking, just so it could cite a URL. Two more: models using an internal repo as a message board between training samples, and agents putting task deliverables on public hosting to share files. OpenAI's own framing: it does "not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer." The Hugging Face intrusion would count as a "Larger Investigation" here.

📚 It Cost $5 to Poison a Medical AI. Here Are the 23 Ways AI Gets Attacked.

Every AI system you touch can be attacked, and none of it looks like the malware-and-firewall model we grew up with. I went through all 23 attack types. They are the exact list on CompTIA's SecAI+ exam under Objective 2.6, which is 40% of the paper, and most have a short video demo. They target three things: what a model learns, what it does, and what it reveals. Prompt injection is OWASP's number one LLM risk. Data poisoning is the one nobody has solved. Researchers corrupted 0.001% of a medical model's training data with 2,000 fake articles for about $5, and it still passed its benchmarks. Anthropic showed a few hundred documents poison a model of any size. JFrog found around 100 Hugging Face models carrying code-execution payloads; one opened a reverse shell the moment it loaded. The Spanish breach below is one agent chaining several of these. The defences repeat across all 23: validate inputs, verify the supply chain, least privilege, never trust the output blindly.

🟠 Spain Logs the First Data Breach Carried Out by an AI Agent

Spain's data protection agency received a breach notification on 14 September. The attack was run by an AI agent on a well-known LLM. The AEPD's account: the agent searched generic files for weaknesses, logged in, hunted for flaws in the application on its own, then modified personal data and accessed invoices. The agency is careful. The details come from the affected organisation and still need analysis, and using a particular model doesn't mean the model or its provider was compromised. What matters to them is that a third party chained every phase of an attack with an agent as the tool. Their view: AI creates no new threats, but it raises speed, scale and adaptability, which cuts the time you have to detect and contain. Four consequences. Put AI-run attacks in your risk assessments. Revise response times built for human attackers. Treat credentials and API tokens as what an agent will use to move at machine speed. Stop depending on manual intervention.

🟡 Brevo Served Malware From Its Own CDN to 100,000 Customer Sites

Brevo disclosed an incident on 10 September: 138 accounts reached through a SAML SSO flaw, 6 used for phishing, 43 with contacts exported. Four days later the real one landed. Per Brevo's post-mortem, as reported by BleepingComputer, the attackers used a hardcoded long-lived Cloudflare API key to deploy a Worker. Sansec traced the script it injected into Brevo's own pages and into the two JavaScript files customers embed on their sites, sdk-loader.js and brevo-conversations.js. Two payloads. A ClickFix overlay for anyone on a customer site or clicking an unsubscribe link in a Brevo email: it puts a command on the clipboard and asks you to paste and run it. And a WordPress plugin that installed itself using the admin's own session when the admin browsed their own site while logged in. Brevo's customers include eBay, Louis Vuitton, Michelin and Amnesty International. Trezor says 347,000 of its users got phishing mail titled "Critical Security Alert: STM32 Entropy Vulnerability"; 2,500 clicked before the site went down 20 minutes after detection. The SSO flaw is worth a read on its own: the attacker enabled SSO on their own account, invited real Brevo users into it, and signed in as them.

🔵 Revolut Handed Customer Passports to a Scammer Using a Government Email Domain

Revolut calls it a "sophisticated external impersonation scam where an unauthorised third party utilised a legitimate government agency domain email to submit fraudulent requests for information". The request passed the checks. What went out, per the customer notice: names, dates of birth, occupations, addresses, emails, phone numbers, passport and driving licence copies, verification selfies, account statements with IBANs, withdrawal records and full transaction history including Bitcoin. Roughly 680 customers were contacted. Revolut says its systems and customer funds are unaffected. True, and beside the point: nothing was hacked, the data was requested and handed over. The FT reports the attackers then demanded a $3 million ransom. The control that failed isn't an email control. A verified sender domain tells you who sent the request, not whether they were entitled to make it. The process treated those as the same question.

🟢 Cisco ISE Has a 10.0 Auth Bypass Under Active Attack. No Workaround.

CVE-2026-76460. An API endpoint in Identity Services Engine and ISE Passive Identity Connector doesn't check authentication properly. Send a crafted request, bypass the web management interface, get into the device. Any configuration. Cisco PSIRT confirms active exploitation. ISE is the box enterprises use to enforce Zero Trust, so the policy engine deciding who gets on the network is the thing with the auth bypass. No workarounds. The one mitigation is infrastructure ACLs restricting management-plane traffic to the box, which Cisco calls temporary. Fixed releases: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.5 Patch 4. CISA added it to the Known Exploited Vulnerabilities catalog on 16 September, with a 19 September deadline for federal agencies, alongside an Acronis Backup flaw.

🟤 Claude Merges Chat and Cowork, and Projects Now Runs Parallel Coding Threads

Two changes from Anthropic. Cowork and chat merge into one Claude, so you no longer pick a surface before you know what the task needs. Docs and Slides arrive as features and Design moves into conversations. Rolling out "on Pro and Max plans over the next few weeks" on web, desktop and mobile; Team and Free follow, and enterprise admins get at least 30 days' notice. Projects is the more interesting one. It stops being a folder and becomes a coordinator. You give it a goal and a repo, brief it like a chief of staff, and it routes work to threads. Each thread is a Claude Code cloud session on its own branch, opening PRs, running tests and splitting into subagents. Overlapping threads resolve as merge conflicts. Threads are cloud-only for now, with local execution "coming very soon". Availability is narrower than the headline: beta for "select Claude Pro and Max subscribers who use cloud sessions in Claude Code and don't have any existing projects on the web or desktop", expanding "over the coming week". Parallel threads burn usage limits faster; the post says so.

⚪ Google Ships Gemini 3.8 Live, Lecture Recording in Notebook, and an Agent for Families

Google's week, compressed. Gemini 3.8 Live and Gemini 3.8 Live Extended Thinking are dialogue models. By Google's own numbers, the base model took second in Artificial Analysis' Speech Agent Arena. Extended Thinking takes first on the Speech to Speech Quality Index at 82.6 and leads agentic task completion at 68.6%. In practice: customer service agents that think before answering. Gemini Notebook, formerly NotebookLM, adds spoken conversation with your own notes, an audio recorder in the mobile app for lectures, and interactive learning overviews with infographics, quizzes and flashcards. CC is an agent for families: a shared "Your Day Ahead" brief, events and tasks, permission slips and activity sign-ups, with access control per family member. Two of the three aren't fully here yet. The Notebook recorder starts next week and the overviews arrive over the next few weeks. CC's existing users get an upgrade email "in the coming days"; new users join a waitlist.

🟦 Siri AI Is Here, If "Here" Means a Waitlist

Apple announced a "profoundly more capable and personal" Siri, available starting today. It reads your screen, carries context between apps, and acts on your behalf. The small print: beta, English only, iOS 27 on iPhone 15 Pro or later, not available in the EU. Apple's own support page says turning it on "will add you to a waitlist, and wait times can vary." That is the shape of the whole week. Anthropic's Projects, two items up, is "now available" to a slice of Pro and Max users with no existing projects. The merged Claude rolls out over weeks. Google's Notebook recorder starts next week, and CC puts new users on a waitlist.

🟨 Mystery Model Union Alpha Is Really Several Models Competing on Every Request

Union Alpha appeared on OpenRouter and OpenCode as a stealth model, free for a week per OpenCode's post. OpenRouter has since revealed it as Pareto 26.9 from Unbiased. The interesting part is what it is. One model string, one bill, and "Under the hood it runs several models on your request and keeps the best answer": frontier and open-source models run against each other on every request. Unbiased is specific that it isn't a router: "Pareto never switches models mid-conversation." On DeepSWE it scores 74, which Unbiased says ties GPT-6 Astra and DeepSeek 4.1 Flash and beats Fable 5.1. What it costs to run several frontier models per request, and whether the best-answer pick holds outside Unbiased's own table, is the open question. Alibaba also shipped Qwen3.8-Omni-Flash: 1 million token context, built for video editing, music videos, film production, audio-visual summaries and real-time conversation. Benchmarked against Gemini 3.8 Flash and Muse Spark 1.2, not the frontier.

🟥 Meta One Subscriptions Run From $2.99 to $499, and Muse Can Now Phone Businesses

Meta One is the new subscription: Instagram Plus, Facebook Plus, WhatsApp Plus and more AI usage for image and video. Prices run from $2.99 a month for WhatsApp Plus to $19.99 for Premium. Creator and business bundles start at $14.99 and go up to a Max plan from $499. Meta AI stays free for everyday use; Core and Premium are the paid creative tiers. Muse, the agent launched a fortnight ago, can now phone US businesses on your behalf, in beta, starting with people who ask it to make a call. Elsewhere: Grok Build gained memory, writing notes in the background as you work and reading them back when you return. ElevenLabs shipped Music v2.5 and put voice, music, image and video generation into its MCP, so any agent with access can generate all four. OpenAI is testing an ad format where clicking the ad opens a separate chat with the advertiser.

🤖 UBTECH's New Factory Builds a Humanoid Robot Every 10 Minutes

UBTECH has started a facility capable of 10,000 humanoid units a year, one robot every 10 minutes. Humanoids handle depalletizing, palletizing and material loading on the line, while collaborative robotic arms on 360-degree rotating stations tighten screws during assembly. So the robots are helping build the robots, which is the line everyone will quote. The number that matters is the 10 minutes.