Daily digest · 2026-08-25

Daily Digest, 2026-08-25

TL;DR: Agents ran a full intrusion by themselves: researchers say a multi-agent framework broke into Asian government systems and took thousands of personnel records, leaving a 160 MB archive from four days of work. The rest of the day is about controls that look solid on paper and are not: an agent forgets half its safety rules the first time its context is squeezed, and training a model on harmless facts makes it give up more personal data it had memorized. On the fix side, Anthropic now lets admins control which Claude connectors an agent may use from the company identity system, and Marimo patched a notebook bug that runs attacker commands the moment you open the file. Also worth reading: research on writing policy over data flows rather than single agent actions, which is aimed at exactly the step-by-step leaks nobody catches.

Top stories

• Dream Research Labs: Hermes and OpenClaw agents stole thousands of personnel records from Asian governments (GBHackers, 2026-08-25). A multi-agent framework compromised government entities, cracked employee credentials and set up persistent access, with researchers recovering 1,395 files generated over about four days. Government employee records were the take, and the volume came from agents running the chain end to end.
• Marimo patches a notebook flaw that runs MCP commands when a file is opened in edit mode (The Hacker News, 2026-08-25). A crafted notebook fires an attacker-supplied MCP command as a local subprocess on open, before any cell runs. Anything the local agent can reach, including customer data in the workspace, is exposed without the user running a thing.
• Anthropic makes Claude MCP connector authorization something admins provision through the IdP (GBHackers, 2026-08-25). Enterprise-managed authorization for Claude Enterprise MCP connectors is now generally available, so users no longer approve each connector themselves. Consent over which systems of record an agent may read moves to one place that can record and revoke it.
• RL on benign facts pulls more memorized PII out of a model (arXiv cs.AI, 2026-08-25). Reinforcement learning on benign factual data raises extraction of personal data the instruct model had already memorized, confirmed present before the RL stage. Extraction testing has to run after every post-training stage, not once at the end.
• Compaction drops half of an agent's safety rules on the first round (arXiv cs.AI, 2026-08-25). Across 20 production agent configurations, Claude Code's /compact on Sonnet 4.6 kept 53% of safety rules after one compaction. A rule like "never send this data outside the tenant" stops binding once it gets paraphrased mid-session.
• AgentFlow writes policy over data flows instead of single agent actions (arXiv cs.CR, 2026-08-25). A flow-centric policy language with runtime enforcement, built on the point that harm comes from sensitive data moving across a sequence of individually plausible steps. Per-action checks miss multi-step exfiltration; this is aimed at binding data read for one purpose to that purpose.

Also notable

• 91 Spring CVEs hit 209,569 components, one disclosure event bigger than most remediation programs can absorb
• OriginBlame locates which training records belong to one author, record- and token-level provenance so erasure is not wholesale deletion
• Relearning twenty forget examples undoes fourteen unlearning methods, sets a relearn-attack bar any erasure-by-unlearning claim must pass
• 481 public CLAUDE.md files measured against Claude Code's deny control, how often a written "do not" rule has no enforcement behind it
• Unit 42 tracks AI-enabled malware from brand abuse to agentic execution, which behavioral signals still fire on AI-authored code
• Taiwan charges nine over illegal AI server exports to China, including Nvidia and Super Micro staff charged personally
• JustAct regulates cross-organisation agents by policy including EU data protection and patient consent, consent terms as enforceable, auditable policy
• OpenAI reaffirms Zero Data Retention and previews Private Safety Processing, retention terms enterprises build DPAs on

Beyond AI

• CNIL sets out data protection rules for online collaboration tools in schools (CNIL, 2026-08-24). The French regulator published conditions and good practice for primary and secondary schools using cloud collaboration suites with children's data. The same conditions govern the AI features embedded in those suites, setting the baseline schools must meet before pupil data reaches a model.
• Ofcom fines a geoblocked porn site over age assurance (Biometric Update, 2026-08-24). Ofcom issued a Confirmation Decision against Fapello.com for failing Online Safety Act age assurance duties despite the site being geoblocked. Enforcement pushes platforms toward face- or behavior-based age estimation models, putting biometric inference inside a duty with penalties attached.
• New Zealand tables a bill requiring social media age checks for under-16s (Biometric Update, 2026-08-24). The bill targets platforms with at least one high-risk feature, naming endless scrolling and algorithmic recommendation. Recommender design becomes the hook that triggers a statutory identity-check obligation.
• EPIC and CFA publish an explainer on surveillance pricing (EPIC, 2026-08-20). The guide defines the terms in data-driven pricing debates and collects documented examples of predatory pricing, aimed at policymakers. It supplies the definitions state and federal regulators are using to write and enforce rules on pricing models fed by personal data.