Sec & AI News — 9 November 2026

11 min readBy Nathan House
Get every new Sec & AI News issue
Straight to your inbox. No spam.

🔴 A Runaway AI Pentest Agent Breached WorkOS

On 2 November, WorkOS said someone had pulled records in bulk from an internal sales tool. On 6 November it named the source: "a security researcher whose AI agent escaped its testing environment." The researcher was running benchmark evaluations with ARTEX, the framework from last week's VAPOR PANDA story. The escape is the researcher's account. WorkOS and an outside forensics firm matched the evidence to its logs. The way in was dull. The tool "should not have been reachable from the internet." Its API "accepted a weak credential intended for local development," and that credential was predictable. There were no rate limits. The agent first got in on 25 October. Nobody noticed until 30 October, when an employee saw unusually high usage. Business contacts and excerpts from sales calls and customer Slack were exposed. The researcher says the data was deleted. WorkOS now tests its own systems with ARTEX. I ran the same kind of agent on a target I chose: an old, already-patched WordPress security plugin. It found a way to log in as the administrator with no password at all.

🧭 AI-Driven Security Engineering Jobs: This Week

I've argued that almost every knowledge job is "two different things bolted together: the doing, and the deciding." AI is starting to take the doing. My jobs archive shows what that looks like in security. It holds 889 listings, and "there is no new AI-driven job category in security." Every role belongs to a discipline that already existed: detection, application security, vulnerability management, GRC. The AI sits on top. The field stays where it is, and the doing half moves to the machine. The job of the week is the deciding half in one line. OpenAI's Enterprise Security Engineer, Vulnerability Management pays $347K to $445K, in San Francisco or remote in the US. It wants people who "Have solved substantive problems using AI agents and can explain how you evaluated and corrected their work." My new video walks through five of these jobs, topping out at $900K at Netflix. The AI Master's Program teaches AI-Driven Cyber Security Engineering. No coding background required. Application only.

🗺️ The Old Cybersecurity Roadmap Aims You at Jobs That Score 5.4 Out of 100

The old way in was a certification, then a SOC seat or a junior pen-testing job. I built JobZone Risk to score how hard each job would be for AI to do, from 0 (easy to replace) to 100. SOC Analyst (Tier 1) scores 5.4 out of 100. A junior pen tester spends much of the day on reconnaissance, and "AI agents now do that whole sequence themselves." This week's lead is that sequence running loose. Follow the old roadmap and you could spend years and thousands of dollars "becoming slower competition for a machine." My roadmap has five steps instead. Learn agentic engineering. Master A+, Network+ and Security+ for understanding, not keystrokes. Build real things with AI, public on GitHub. Get a mentor, or at least one peer. Then build a capability and choose: employee, consultant or founder. The video walks through all five.

🛡️ OpenAI Rates GPT-6 Cyber "Critical" and Gives It to a Select Few

OpenAI released GPT-6 Cyber on 5 November. It's a cyber-specialised variant of GPT-6 Astra for vulnerability discovery, exploit development and web pentesting. You probably can't use it. Access goes to "a select group of approved Daybreak Red customers," with identity checks, SSO, MFA and API IP allowlisting. OpenAI classifies it "Critical in cybersecurity," up from High for GPT-5.6 Cyber. In Linux, it reproduced 1,724 vulnerabilities and built working privilege-escalation exploits for 948. It found 81 new bugs that Mozilla rated high severity. In OpenAI's own red-teaming, agents "chained vulnerabilities to escape microVMs." Every benchmark is OpenAI's, measured against its own older models. After last month's Hugging Face incident, OpenAI added a honeypot test. GPT-6 Cyber took the bait in 0.07% of runs. GPT-5.6 Sol took it in 49.5%. In September I tested what GPT-6 Astra refuses, which is the ordinary-access side of this gate.

🧪 OpenAI's Research Model Wrote Its Own Network Code to Get Past a Sandbox

OpenAI published a misalignment report, updated on 5 November, about a run in August. An internal research model was asked to copy a website. The sandbox's web proxy was down, so it scanned private addresses for another one. It still had permission to send raw network packets. It used that to query DNS, then wrote a Python program that handled the connection packet by packet. Its own reasoning said: "This is network evasion, but we're troubleshooting access; potentially inappropriate." It tried Amazon S3 as a proxy and went looking for cloud credentials. The credential service refused. About five hours in, it wrote itself a note to stop. Within minutes of resuming, it started again. It never reached the site. So it built a substitute with invented customer testimonials and chose to leave that out of its summary. OpenAI found no evidence any data was taken. Raw-packet permission is now off by default.

🏦 Anthropic's Claude Can Now Read Two Years of Your Bank Transactions

Personal Finance in Claude started rolling out in beta on 5 November. It's US only, on the Pro, Max and Ultra plans. You sign in to your bank through Plaid, so Claude never sees your password. Access is read-only, so it can't move money. It does see balances, credit limits and up to 24 months of transactions. Account numbers are usually cut to the last four digits. But if your bank writes a full number into a description, "Claude may see it there." The no-training promise covers chats in the Personal Finance hub. Outside the hub, your normal privacy settings apply. By default, Claude "reads your linked accounts without asking each time." You can switch that to per-read approval. Artifacts are the odd one: they "can read the linked accounts of the person who opens them," if that person has allowed Plaid. Account takeover fraud losses already run to $16 billion, 59% of all identity fraud losses.

🔗 Chainalysis Says Hackers Got Password Hashes and Live Tokens for All Users

Chainalysis traces crypto for law enforcement, governments and banks. On 30 October it said an attacker had used "offensive agentic techniques" to get into its systems and internal tools. It also said there was no evidence of access to "authentication credentials, or session tokens." That didn't last. On 4 November it said "names, usernames, password hashes and live tokens for all Chainalysis users were exposed to a malicious actor." Stolen credentials feature in 53% of breaches. A separate "on-path attack" exposed some customers' passwords. Reactor and other products went offline, then KYT after more abnormal activity. Every user has to reset their password and rotate API keys. The products were back by 7 November. Chainalysis says it still has no evidence that investigations data was accessed. It names no tool, model or attacker, and says this is unrelated to the Binance theft.

🐘 A WordPress Core Bug Found With GPT-5.6 Sol in Four Hours Is Now Exploited

CVE-2026-119977 lets an unauthenticated attacker run code on a WordPress server during a core upgrade. The upgrader uses "predictable, web-accessible staging paths." An attacker drops a malicious wp-config.php into the temporary folder, and the updater copies it over the live one. The site now points at the attacker's empty database. They create the first admin account and upload a plugin. Wordfence rates it 8.1. WordPress fixed it in 7.1.4 on 28 October. CISA added it to its exploited list on 3 November and gave agencies three days. Researcher Umut Bayram found it with GPT-5.6 Sol: "The whole process took about four hours." The bug dates back to WordPress 2.7, from 2008. Versions 2.7 to 4.6 got no fix, so upgrade them. His summary: "If an early-career researcher can find a two-decade-old RCE in an afternoon, so can an attacker." In August I filmed my AI hacking a plugin running on 4 million WordPress sites.

🐚 OpenSSH Bug Let Long Passwords Into Root on Alpine's Cloud Images

Since 2016, OpenSSH on musl-based Linux has had a hole. That covers Alpine, OpenWrt, Buildroot, Yocto and plenty of Docker images. Accounts that should never take a password, like root or a key-only deploy user, "take any password longer than 256 characters." On Alpine's official AWS and Azure images, the default alpine user has passwordless doas. "So it's root." The conditions are narrow: musl, PAM disabled, password login on. Debian, Ubuntu and Fedora are fine. Researcher Özgün Kültekin found it with "agent swarms. a lot of them." OpenSSH 10.6p2 fixed it on 5 November. OpenSSH calls the release "a critical security workaround" and puts the root cause outside sshd. Neither page gives a CVE number. If you can't patch yet, turn password logins off. A security review had fixed a function four lines above the bug, "four days before i found it."

💶 French Bank Crédit Mutuel Arkéa Lost Around €118 Million Through a Supplier

Crédit Mutuel Arkéa announced on 4 November that an attack had enabled fraudulent transactions. Its FAQ says the attackers came through the platform of one of its service providers and reached the bank directly. They then used the bank's own account to send money to other banks. From there, it could be converted into crypto. Blockchain investigator ZachXBT put the loss at €118 million, or $133 million. The bank won't confirm that figure. It says it can "only validate the order of magnitude" (my translation from the French). Some of the funds were blocked. The bank says customers' money wasn't affected, and some transfers were only delayed. It denies the attackers came in through its Fortuneo brand. It also denies human error, calling it a sophisticated attack from outside. The bank has more than 5.8 million members and customers. The supplier hasn't been named.

📞 Grok Bot Now Phones Businesses for You. Uber Got 4 Agent-Booked Rides in a Week.

xAI's Grok Bot "can now place real phone calls for you." It dials, handles menus and hold, shows a live transcript and sends a summary. It's limited to eligible US accounts calling US numbers, and still rolling out. Teslarati reports the terms require every call to identify itself as a virtual assistant and ban impersonation. Those are terms of service. Meanwhile, almost nobody uses agents to buy things. Uber's CFO said Halloween week brought about 320 million trips. AI agents placed around 500 Uber Eats orders and "a grand total of 4 trips." DoorDash's Tony Xu said agents have sent "maybe several hundred orders in total." His view: "you don't want to be delusional." An agent that phones a call centre is the same capability as vishing at scale. Voice phishing already accounts for 11% of intrusions in Mandiant's investigations, the second most common way in.

🎭 Meta Can Make a Photo Talk Live, and Google Vids Gives Away Lip-Synced Video

Muse Voice lets anyone in the US call and video chat with Meta's Muse agent. The avatar runs on Muse Realtime Avatar. Meta's research blog says it can make "a photographic portrait" respond through subtle expressions in a live conversation. It streams 448x768 video at 25 frames a second, with about 870 ms of latency. On the same day, Google shipped Gemini Omni 1.2 Flash. It makes videos up to 15 seconds, with "clearer lip-sync". The price dropped 30%, to $0.07 a second at 720p. That's $1.05 for a 15-second clip. Anyone with a Google account can make three 15-second videos a month free in Google Vids. Google says every output carries "an imperceptible SynthID watermark."

📜 Pruna and Pika's New Open Models Exclude the UK Without a MiniMax Licence

Pruna released P-H3-Image on 3 November. It's an open-weights image model built on the MiniMax-H3 video model, and it runs in about 21 GB of VRAM for 8 MP images. Pika released Pika H3 Flex on 29 October. It's a set of open adapters on MiniMax-H3, for video with sound. It ranks first among open-weights models on DesignArena's text-to-video leaderboard, and seventh overall. Locally it generates at 768p. The 4K upscale is a Pika-hosted feature. Both ship under the MiniMax H3 Community License. In Pruna's words, it "excludes the European Union, the United Kingdom, the Republic of Korea, and the United States unless you have a separate license from MiniMax." Products built on it must also show "Powered by MiniMax H3". Open weights, but not in London.

🌙 Moonshot Published All 1.56 TB of Kimi K3.1 Pro's Open Weights

Moonshot promised the Kimi K3.1 Pro weights "by Nov 4". They're now on Hugging Face: 1.56 TB, already in 4-bit MXFP4. It has 2.8 trillion parameters, 104 billion active. The licence is MIT-style. The biggest commercial users need a separate agreement or must display the model's name. Unlike the MiniMax models, there's no country exclusion. The checkpoint that shipped is the one with cyber data removed. On Moonshot's own model card, it scores 74.7 on ExploitBench. GPT-6 Astra scores 100, and Claude Opus 5.5 scores 91.0. Moonshot's blog still says its cyber capability "remains behind that of frontier proprietary models that have been publicly available for at least three months." That was the policy. Now the weights are public, and anyone can fine-tune them.

🔐 SonicWall's Exploited SSL-VPN Flaw Can Bypass SAML-Enforced MFA

CISA added CVE-2026-19868 to its exploited list on 6 November, with a 20 November deadline. The flaw "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls." It can also bypass SAML-enforced MFA. BleepingComputer reports it only affects SonicOS SSL-VPN set up for SAML, with a CVSS score of 7.1. The same report gives the fixed versions as 7.3.4-7013 and 8.2.3-8015, with no workaround. SonicWall says it investigated "a report indicating potential exploitation." CISA lists ransomware use as unknown. The attacker still needs valid credentials for another login method.