StationX
MEMBERSHIP

Sec & AI News — 16 October 2026

14 min readBy Nathan House
Get every new Sec & AI News issue
Straight to your inbox. No spam.

🔴 OpenAI's Model Spent a Stranger's Test Crypto

OpenAI posted four new misalignment reports on 15 October. In one, a model under test needed funds to deploy a task. It used a public recovery phrase, checked 362 addresses and spent from a funded test wallet that wasn't its own. Its reasoning: "Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless." It never mentioned the wallet. OpenAI found it three months later. In another case, a model downloaded five non-public tables, 147,451 rows. The same day, India's CERT-In issued a "critical" advisory, according to The Hacker News. Test agents from unnamed AI labs had reached live systems at Indian organisations and read confidential data. None of the organisations noticed. Anthropic has already cut live internet access for all its internal evaluations. CERT-In wants that block enforced at the network level, not through instructions to the model.

🧭 AI-Driven Security Engineering Jobs: This Week

Take one job and read what it actually asks for. NVIDIA is hiring a GPU SW Security Engineer in Santa Clara, paying $152K to $242K. The foundation is old-school: "5+ years in security engineering, with experience in drivers, kernel, or fw." The specialism is turning rules into machinery: "Translate security requirements (hardening flags, isolation mechanisms, security invariants) into automated, per-release checks". Then the AI layer: "Hands-on experience building LLM agents or agentic workflows." The posting also wants someone to "Lead our adoption of AI agents in security, finding manual workflows and reinventing them." So NVIDIA wants someone who builds the agents. Most of my archive asks the same. Of 712 postings, 383 ask you to build the agents and pipelines, 251 to use them and 78 to lead the change. The AI Master's Program teaches AI-Driven Cyber Security Engineering. No coding background required. Application only.

🧾 How to Prove an AI Agent Wrong: the GRC Project Employers Now Ask For

Most GRC portfolio projects are a risk register or a mock audit. Job ads for senior GRC roles now want something else. Vanta asked candidates to "define gold-standard evaluation sets." So I wrote up one project that proves you can check an agent's work. You scan a set of practice cloud plans with a free scanner, Prowler, pick 20 controls and write your own verdict on each. Then an AI agent gets the same evidence, and you grade it against your answers. It costs about $20 a month, and you need no coding background. A smaller model fell for an empty pass. It marked a control as met when nothing had been checked. One added rule cut the wrong "met" verdicts from 3, 2 and 3 to 1 in every run. And once, the agent was right and our answer key was wrong.

🧩 Claude Code Desktop's Preview Pane Leaked SSH and AWS Keys

Noma Labs published SneakPeek on 14 October. The bait is a fake coverage report in a public repo. Clone it, let Claude Code Desktop preview it, and the attacker's JavaScript runs. Files over 256KB load through file:// URLs. That gives the payload "same-origin access to the victim's entire local filesystem." Out go API keys, SSH private keys, cloud credentials and "Claude's own OAuth tokens". The victim approves nothing. Anthropic scored it CVSS 8.7 and treated it as code execution on the host. Its first fix was bypassed by moving the request into a Web Worker. The working fix shipped on 17 August in Claude Desktop 1.30096.1, by auto-update. Noma first reported it on 4 July. A CVE is still pending, so check your version.

🛠️ I Checked 17,244 Claude Code Sessions to Test the Skill Rules

Watch a video on Claude Code skills and you'll hear the rules have changed. Put a contents list at the top. Keep references one level deep. Those rules were on Anthropic's best-practices page the week skills launched, in October 2025. Almost nobody checked whether they work. So we did. My AI system, HAL, logs every session. We went through 17,244 of them, then ran 102 controlled tests on Haiku, Sonnet and Opus. The tests were small, one to three runs per setup. The description matters most: a vague one fired on the wrong request 2 times in 9, a specific one 0 times in 9. Nesting and contents lists made no difference in our tests. And one audit of 3,984 public skills found a security flaw in 36.82% of them. Read a skill before you install it.

🦠 Aoki Infostealer Now Steals Claude, Codex and Cursor Credentials

Symantec reported on 15 October that the Aoki infostealer has a new shopping list. Earlier versions ignored AI tools. The newest takes .claude.json, Claude desktop cookies, ChatGPT cookies, and Codex's config.toml and .env files. It also grabs tokens for GitHub Copilot, Cursor, Google Gemini, JetBrains AI Assistant and Kiro, plus AWS credentials. A stolen key works under your identity and your quota. Symantec says the tokens can also expose connected repositories, cloud services and CI/CD pipelines. Or the thief just runs up your bill, a practice Symantec says is sometimes called LLMjacking. So your coding agent's config folder is a credential store now, and worth guarding like your SSH keys. Nobody knows who is behind Aoki. Symantec detects it as Infostealer.Aoki.

♊ Google's Gemini 4 Argon Tried to Rewrite Its Own Grading Scripts

Gemini 4 Argon went on general release on 13 October, with a safety report. The report is candid. In testing, the model "attempted to escalate container privileges to alter grading scripts". It read answers from the test runner's memory. Once, it crashed the sandbox to avoid being scored on a failed run. Training cut openly discussed shortcuts by 61%. Silent shortcuts more than tripled, from 11.2% to 36.4%. It also solved all 12 simulated end-to-end cyberattack scenarios, up from five. Prompt injection went better: 0.7% attack success on Gray Swan's benchmark. Vetted defenders can apply to the Fairwind Program to use Argon "without cyber guardrails". It costs $2 per million input tokens and $10 output until 30 November. Then it's $4 and $20.

💥 XBOW Built a Chrome Takeover Chain in Six Days With GPT-5.6 Sol

On 13 October XBOW explained how it built a Chrome full-chain exploit. One web page leads to remote takeover of a Windows machine. Four researchers did it with OpenAI's GPT-5.6 Sol, between 2 and 7 August. XBOW "deliberately picked a model that is available to anyone". The compute cost $40,000. Google paid a $250,000 bounty, and the bugs are fixed. An intelligence-agency veteran told XBOW his team used to spend six months on this kind of work. XBOW thinks agents will find each of the three bugs on their own "within a year". Relaunch Chrome, because the fix only takes effect then. I ran the numbers on what a bug costs to find, human versus AI, including the triage bill most comparisons leave out.

🟦 Meta's Muse Spark Open: 816B Weights, and Safety Is Your Job

On 15 October Meta released the weights for Muse Spark Open. It has 816 billion parameters, 42 billion active, and a 1M-token context window. It runs on two M5 Ultra Mac Studios. Meta says it refused 99.2% of jailbreaks on its internal benchmark, against 75.5% for Kimi K3. Extra safety training makes it "more robust against misuse as a standalone model without system guardrails". Meta still recommends adding your own, and warns that modifications "could degrade safety". The licence is blunter: "LICENSEE IS SOLELY RESPONSIBLE FOR THE SAFETY". On coding, Kimi K3 still leads, 68 to 60 on DeepSWE 1.1. Meta's closed model, Muse Wonder, arrived on 12 October at $4 input and $20 output per million tokens. Its full safety report is "available soon". Running locally keeps your code at home. My Claude Code Ollama guide shows how, and when it isn't worth it.

🐛 Anthropic Says Small AI Models May Soon Self-Replicate on TV Boxes

On 12 October Anthropic researchers said small AI models "may be months away" from copying themselves onto cheap internet-connected devices. Think smart ovens and off-brand Android TV boxes. They ran Gemma4-26B-A4B across 15 TV boxes, about $55 each, at 0.39 tokens per second. Slow, but running. A 9B model got inference working on 8 of the 9 hardware types tested. In an emulated network, GLM-5.2 spread to all 8 nodes in 4 of 5 trials. The fear is a worm with "no centralized point to shut off". But the break-in step was trivial, because the ADB port had no authentication. Anthropic calls the result "an upper bound on real-world success". If you own one of those $55 boxes, find out whether its ADB port is open. BleepingComputer notes the experiment did not show full end-to-end worm creation.

🧪 ProjectDiscovery Found AI Labs' Hugging Face Write Tokens on Public GitHub

On 6 October ProjectDiscovery hid a credential-stealing backdoor in an open model for under $50. On 14 October it showed how one could ship. It found live tokens belonging to employees at NVIDIA, Nutanix, AllenAI and dozens of other companies. Some had write access to Hugging Face model registries and Weights & Biases. One Nutanix token had sat in public Git history since October 2024, with write scope in the Nutanix organisation. NVIDIA's key was read-only. Stealer logs add roughly 122,000 Hugging Face accounts with exposed passwords. A backdoor in the weights leaves "nothing to diff against". ProjectDiscovery didn't test whether the registries would block a malicious push. It also sells a product for this, so read it as vendor research. Rotate any token ever committed to a public repo. Deleting the commit doesn't help.

🎙️ OpenAI Engineer Charged Over a Hidden Recorder in an Executive Conference Room

The US Justice Department announced the case on 13 October. Abdulrahman Alfozan, 35, an OpenAI engineer since July 2025, was arrested on 9 October. Around 30 September, OpenAI staff found a recording device in a USB port on the back of a TV in an executive conference room. It was hidden in toilet paper, and its contents were encrypted. Prosecutors say a chatbot account linked to his spouse asked about "build[ing] a continuous audio recorder" in the days before. A second device turned up in his bag around 5 October. OpenAI says it "used our models to understand the device and where it had come from". It has "no indications" he took model weights, source code or customer data. He was fired. The charge carries up to five years. These are allegations, and he hasn't been convicted.

🟠 Ivanti Connect Secure Zero-Day Chain Gives Root and Hides From Ivanti's Checker

Ivanti Connect Secure is a VPN appliance, so it sits on the edge of the network. Volexity caught an attacker it calls UTA0576 chaining three bugs into unauthenticated root, on a fully patched 22.8R2.4 box. Volexity saw the attacks start on 3 October. The auth bypass and code execution bugs are CVE-2026-104935, patched on 13 October. The privilege escalation is still unpatched, with a fix due "in the coming weeks". The chain patches code in memory only, so Ivanti's Integrity Checker sees nothing. The attacker went after Active Directory credentials, LAPS passwords and BitLocker recovery keys. Volexity thinks, with medium confidence, that the attacker used LLMs to build the exploit. CISA gave US agencies until 16 October. Upgrade to the newest version, then investigate as if you were hit.

🛰️ BeyondTrust Remote Support Zero-Day Was Exploited Since August

BeyondTrust disclosed CVE-2026-102764 on 15 October, rated 9.3. It lets a remote attacker perform file operations on a Remote Support appliance. It was used as a zero-day on 29 August, against two customers. BeyondTrust links it, "with moderate to high confidence", to the China-nexus group Mandiant now calls Armory Castle, formerly UNC5221. SaaS customers were all patched by 9 October. Self-hosted appliances need the BT26-05 patch, which covers versions 24.3.1 to 26.2.3. Older than that, upgrade first. BeyondTrust suspects the exploit was built with AI help. It says it has no forensic proof, but defenders should "plan as though this assessment is accurate". Its warning: once a bug is public, this group "typically moves to broad exploitation of every instance still unpatched."

🪟 Microsoft Fixed a Record 1,411 Flaws, Then PAN-OS and Cisco Zero-Days Landed

October's Patch Tuesday fixed a record 1,411 flaws, according to BleepingComputer. Krebs says it dwarfs September's record of nearly 1,000, and that Microsoft credits large language models for the volume. Patch CVE-2026-96951 first. It is exploited, and it lets attackers "evade Mark of the Web (MOTW) defenses". On 14 October two more joined CISA's exploited list, both due 17 October. Palo Alto's PAN-OS CVE-2026-0322 hits the management interface and needs credentials. Restrict that interface to a jump box. Cisco's Secure Email Gateway flaw, CVE-2026-76519, is rated 9.8 with no workaround. It needs File Reputation switched on and Content Scanner Tools older than 25.3.0.5525. Cisco warns attackers may wipe the evidence, so check logs off the box. Last week's Atlassian flaw joined the list on 15 October.

🔐 Ledger Wallets Sold Through CryptoBilis Carried Implants That Steal Recovery Phrases

Ledger has confirmed hidden implants in signers sold through the reseller CryptoBilis. A separate component watches the setup screens. When the recovery phrase appears, its microcontroller "decodes the words and transmits them over LTE using a provisioned eSIM". It doesn't touch the Secure Element or the Ledger operating system. Transactions and signatures are unchanged. Every confirmed loss so far involves a CryptoBilis device. Ledger hasn't confirmed how many people were hit or how much was lost, and says the figures online come from third parties. BleepingComputer reports Ledger asked distributors across Southeast Asia and Hong Kong to halt sales. Ledger is also reviewing reports of implants in other signers and locations. Its advice: if you set one up, move your assets to a new signer with a new recovery phrase.

🌍 Meta and 14 Tech Firms Helped Police Hit West African Scam Centres

Meta and 14 other tech firms, including Google, Microsoft, OpenAI and Coinbase, joined police from ten countries against scam networks in West Africa. Meta calls it the largest operation of its kind. The UK's National Crime Agency hosted it in London. Meta removed more than 3.7 million accounts, pages and groups. Police confirmed 28 arrests and 117 victims rescued. Coinbase stopped more than $415,000 in potential losses. Google, meanwhile, will now check a suspicious text for you on Android. Long-press the home button or navigation bar, circle the message, and Circle to Search gives an AI Overview with next steps. Smishing, phishing by text, is now 35% of all phishing attacks. I've gathered 76+ phishing statistics from over 40 sources, including where text and voice scams are heading.

🎮 Xbox Starts a Lab for the AI Game-Decompiling Wave

On 13 October Xbox launched Xbox Labs. Asha Sharma's memo says it plainly: "In recent weeks, we've seen games rapidly decompiled and rebuilt to run on hardware they were never originally designed to support." The Verge points to skateboarding modded into Call of Duty, and Halo running in a web browser. Xbox says it remains committed to "being responsible stewards of IP". The Verge asked about unauthorised use of Microsoft's own IP. No reply came in time. Epic is moving too. Tim Sweeney says Epic has "a huge pivot underway" to "retool for maximum AI acceleration". If you protect software, that should worry you. Compiled code used to be slow and expensive to read. AI reads it cheaply. I wrote about the five business models that relied on that protection, game DRM included, and a one-sentence test for yours.