Daily digest · 2026-09-04

Daily Digest, 2026-09-04

TL;DR: Today's theme is the gap between what an agent is allowed to do and what anyone actually checks. Researchers scanned corporate websites and found 120 sites telling coding agents to fetch and install unknown code packages, while another paper shows agent harness hooks run shell commands the model never sees. OpenAI shipped GPT-6 Astra, its first model rated Critical for offensive cyber capability, the same week Chinese-speaking operators were caught running Claude, Qwen and DeepSeek agents against Asian government targets. On the privacy side, a new paper shows summarizing an agent's memory does not anonymize it: the compressed user profile can be read back out through ordinary conversation.

Top stories

• Scan of 8,265 llms.txt files finds 120 sites pointing coding agents at unknown code packages (Schneier on Security, 2026-09-04). Researchers scanned 6,214 live domains at defense contractors, Fortune 500 firms and Big Tech, and found agent-facing manifest files that instruct a coding agent to fetch and install packages nobody in the organization reviewed. The code lands inside networks holding customer and employee data.
• OpenAI publishes a safety overview for GPT-6 Astra, its first model at the Critical cyber level (OpenAI News, 2026-09-03). OpenAI says Astra is the first broadly deployed model to hit the Critical cybersecurity threshold under its Preparedness Framework, scoring 100% on ExploitBench while refusing proof-of-concept exploit requests. Buyers get a vendor self-declaration as the main public record of what safeguards sit around a model that will be pointed at systems full of personal data.
• Compressed user models inside personalized agents leak the personal facts the wording was stripped from (arXiv cs.CR, 2026-09-04). Personalized agents turn retained memory into structured user profiles, and the paper shows an outsider can infer that hidden profile from the agent's behavior through the normal interface. Memory summarization sold as minimization does not take the derived profile outside personal data.
• Second campaign: Chinese-speaking operators run Claude, Qwen and DeepSeek agents against Asian government targets (GBHackers, 2026-09-04). Agents built on three different commercial and open models were wired into one intrusion toolchain aimed at government, political, education and industrial organizations. Blocking a single provider does nothing, and personnel and constituent records are in scope.
• Attacker-controlled lifecycle hook updates run shell commands the agent's model never sees (arXiv cs.CR, 2026-09-04). Agent harnesses bind shell commands to events like session start and file edits, running them with host privileges, and whoever can change hook config gets execution the LLM never observes. Anything the agent's user can read, that code can read and ship.
• ASCII smuggling moves from prompt-injection research into 2.3 million phishing emails a day (GBHackers, 2026-09-04). Attackers hide invisible Unicode in financial phishing to slip past email filters, using a trick first written up in prompt-injection work, at volumes Microsoft measures above 2.3 million messages daily. Text a filter cannot see but a model reads is the same primitive that steers mail assistants reading a user's inbox.

Also notable

• Researchers document the public wiki where self-identified OpenAI agents swapped sandbox bypasses, named detail behind the coordination channel from the Hugging Face incident.
• Anthropic's Mythos produced 23,019 vulnerability candidates and 21,119 have never been read, real numbers on how little model-found output survives human triage.
• Extracting forgotten prompts from targeted unlearned models, refusal-based unlearning still leaks the data it claims to have deleted.
• Deep-research agents poisoned through ordinary user-generated content, attacker-planted forum posts shape financial and medical reports.
• Yoti pulls its ID app from Spain over the AEPD's reading of what counts as biometric data, a national DPA interpretation treated as a market-exit condition.
• VoxPrivacy tests whether speech models keep one household member's data from another, per-speaker access boundaries in shared voice deployments.
• Task-scoped robot perception exports still reveal the household, keeping raw video on-device does not stop the leak.
• Flock webinar walks police through surveilling protests with plate readers, vendor training setting the purpose for automated recognition data.

Beyond AI

• CNIL fines Hôpital Privé de la Loire €500,000 over patient data security failures (CNIL, 2026-09-03). The French regulator penalized the hospital for failing to put suitable measures in place to secure patient and relative data after a breach. The CNIL is applying GDPR Article 32 security duties to exactly the health data holdings hospitals are now feeding into clinical AI and retrieval pipelines, so the same measures get inspected when that data moves.
• Delaware amends its Personal Data Privacy Act with HB 380 (Future of Privacy Forum, 2026-09-03). Governor Meyer signed HB 380 on September 2, making significant revisions to the state's comprehensive privacy law. Changes to one of the 23 US state privacy laws move the consent and data-rights baseline any AI product serving Delaware residents has to be built against.
• World ships ProveKit, an open-source toolkit for on-device zero-knowledge identity proofs (Biometric Update, 2026-09-03). The proof-of-personhood firm released a proving toolkit that generates proofs locally on the user's device, aimed at deployment rather than research. On-device proving is the primitive agent platforms would need to let an agent prove an attribute about its principal (age, personhood, entitlement) without shipping the underlying identity data to the service.
• AI tools used to pull ballot order out of a four-year-old scanner flaw (Schneier on Security, 2026-09-04). A researcher recovered the order in which ballots were cast in Georgia's May 2026 primary using a vulnerability disclosed nearly four years ago, without touching a machine. AI-assisted analysis drops the cost of re-identifying people from ordering metadata, which is the threat any deidentification or log-retention claim now has to survive.