Daily digest · 2026-09-01

Daily Digest, 2026-09-01

TL;DR: Today's theme is cheap offense and expensive assumptions. Forescout rebuilt a working attack on industrial controllers using Claude in hours for a few hundred dollars, and the head of the Financial Stability Board named frontier AI cyber risk the most immediate threat to the global financial system. On the incident side, the eval nonprofit METR lost an API key and about $600,000 in model credits, and attackers are actively exploiting a remote code execution bug in Langflow to steal cloud credentials. Legally, Austria's Supreme Court ruled that credit agency CRIF broke EU data protection law by repurposing bought address data, and Sony's suit against Anthropic is using staff chat logs about pirated book libraries as evidence on training sources. Both cases turn on the same question: can you document where your data came from and why you were allowed to use it that way.

Top stories

• Forescout ported a WAGO PLC exploit between models using Claude in hours for a few hundred dollars (SecurityWeek, 2026-09-01). Researchers moved a remote code execution exploit from one PLC model to another with model help, at trivial cost. OT patch decisions that rested on "no public exploit exists for our model" need rerating.
• Financial Stability Board chair calls frontier AI cyber risk the most immediate threat to the financial system (The Record, 2026-09-01). Andrew Bailey told banks and their technology providers to plan for simultaneous disruption across multiple firms sharing the same dependencies. Supervisors will now expect concentration-risk mapping for AI providers, which is also where customer data sits.
• METR discloses stolen API key and roughly $600,000 in consumed AI credits (The Hacker News, 2026-09-01). An attacker took a model-provider key from the nonprofit that runs frontier agentic evals and burned through the credits; METR says no sensitive information was exposed. Eval partners hold keys with real reach into frontier accounts, so scoping and rotating those keys is a vendor-risk question, not a housekeeping one.
• Attackers exploit a Langflow RCE flaw (CVE-2026-0768) to steal cloud credentials (GBHackers, 2026-09-01). VulnCheck reports live exploitation aimed at cloud credential theft and command-and-control setup. Langflow instances sit beside the data and keys an AI application uses, so code execution there reaches whatever personal data the pipeline handles.
• Sony suit quotes Anthropic staff chats praising Z-Library as evidence on training sources (Ars Technica, 2026-08-31). Sony's complaint cites internal employee messages to argue torrented material fed model training. Internal chatter about dataset sourcing is discoverable, which makes dataset approval gates and retained comms the actual evidence trail.
• New Jersey requires the state to disclose facial recognition use in prosecutions (EPIC, 2026-08-26). In State v. Miles the New Jersey Supreme Court held prosecutors must disclose any investigative use of face matching and explain how it was applied. Agencies now need per-case records of when the system ran and against whom.

Also notable

• Function hijacking attacks target the calling layer of MCP and function-calling models, attack class at the tool-invocation path that prompt filters never see
• Backdoored model code steals API keys and personal identifiers out of local fine-tuning runs, training code, not just weights, is part of the supply chain
• Dormant adversarial behaviors in open-weight LLMs activate on benign finetuning, planted behavior that switches on only after a customer tunes the model
• Proof-of-Execution Memory checks agent memory claims against what actually ran, fabricated memory entries can retire a safety check the agent thinks it did
• Rolling an agent back to a checkpoint does not roll back its external effects, rollback is not deletion and not containment
• Repeated deletion requests collapse a model's ability to keep learning, continual unlearning degrades plasticity as erasure requests accumulate
• Behavioral biometric embeddings leak gender and other demographic attributes, an auth template doubling as a demographic profile pulls special-category data into scope
• Dark Reading: rules an agent knows are not a security control, policy text in a prompt versus enforcement outside the model

Beyond AI

• Austrian Supreme Court: CRIF broke GDPR purpose limitation by scraping address-publisher data (noyb, 2026-09-01). The OGH held that the credit reference agency's practice of collecting personal data from address publishers breaches purpose limitation, and noyb says a class action can now follow. The ruling sets a purpose-limitation standard for repurposing bought or scraped personal data, which is the same argument a scoring or training-data pipeline has to survive.
• California passes AB 1709, a near-total social media ban for under-16s, and EFF asks Newsom to veto (EFF Deeplinks, 2026-08-31). The legislature passed a sweeping under-16 social media ban; EFF wants a veto, arguing it cuts young people off from information. Enforcing an age line at California scale pushes platforms toward AI face-based age estimation applied to every user, the same biometric inference state privacy rules then govern.
• UK Digital Verification Services Trust Framework v1.0 comes into force (Biometric Update, 2026-08-31). The framework hit version 1.0 and took effect, providing certification for qualifying private-sector identity providers. Certification becomes the baseline an AI-driven identity or age-assurance vendor must meet to sell into UK regulated checks.
• EPIC files four amicus briefs against DOJ's demand for state voter rolls (EPIC, 2026-08-27). EPIC asked the First and Seventh Circuits to reject the Justice Department's demand for complete state voter files as unlawful. If courts block federal aggregation of those rolls, the pool of records available to the AI analytics platforms ICE is procuring shrinks.