Daily digest · 2026-09-16
Daily Digest, 2026-09-16
TL;DR: Today's theme is agents with real credentials doing real damage. Mandiant reports a runaway agent that burned $50,000 in cloud spend and, separately, an attacker who took over a live coding-assistant session and spread a worm through roughly 100 internal code repositories, stealing secrets and source. Underneath that, the hardware and model layers are both getting worse: researchers escalated privileges on NVIDIA GPUs used for shared inference, and another team built a model backdoor that inspecting the weights cannot find. On the data side, hackers pulled apart Flock's camera software to show how it links vehicle sightings to people, and Google switched on machine-learning age guessing for YouTube in Canada using its own uncertified system.
Top stories
- Mandiant report: one runaway agent ran up a $50,000 cloud bill as indirect injection and AI supply-chain attacks grow (Help Net Security, 2026-09-16). Enterprises are running agents that change production config and call APIs across hybrid cloud, and attacks have shifted to indirect injection and supply-chain compromise; an agent with no scope ceiling reaches personal data stores the same way it reached the billing meter.
- Mandiant: hijacked AI coding assistant session spread Shai-Hulud across ~100 internal repos (The Hacker News, 2026-09-16). An attacker took over a live assistant session at a SaaS provider after the assistant recommended poisoned software, then the worm stole repository secrets and source. Standing developer privileges on an agent session are now a demonstrated bulk-theft path.
- GPUBreach turns GPU Rowhammer from noisy weight corruption into privilege escalation (arXiv cs.CR, 2026-09-16). Published GPU Rowhammer work stopped at untargeted bit flips; this gets privilege escalation, which puts one tenant's prompts and weights within reach of another on shared inference hardware.
- A backdoor in Random Fourier Features models that a full weight audit cannot find (arXiv cs.CR, 2026-09-16). An implementation of the Goldwasser undetectable backdoor, resting on a Continuous LWE hardness assumption, so white-box weight inspection reveals nothing. It caps what a model-integrity audit can honestly claim about a third-party model.
- Rubrik ships an MCP server exposing backup, identity and application data to agents (Help Net Security, 2026-09-16). Customer agents get tool access to Rubrik's backup and identity data, which is often the most complete copy of an organization's personal data, including records deleted elsewhere.
- Google turns on machine-learning age inference for YouTube in Canada (Biometric Update, 2026-09-15). Google is profiling behavior to guess age rather than using age assurance certified against international standards, which builds a new personal-data profile on every user in place of a narrower check.
Also notable
- Homomorphic inference on a genomic foundation model, measures the cost of never handing plaintext genomic data to the compute provider.
- Memorisation bias in medical models, what happens when a model scores a patient whose record it trained on, with erasure implications.
- RAG-CT screens prompt distributions, detects corpus extraction through ordinary retrieval queries with no jailbreak involved.
- InceptionRAG splits a poisoning payload across documents, defeats per-document screening of retrieval corpora.
- Study of the OpenClaw skill registry, agent skills that steer hosts toward shell and credential actions nearly doubled in H1 2026.
- (A)iSpy plants Trojans in the ML runtime, moves supply-chain review past weights to graph compilers and accelerator libraries.
- PIA-Bench tests whether LLMs can carry out privacy impact assessments, benchmark for the mandated artifact that drives control selection.
- Interviews with 19 developers on employer AI policies, evidence on whether written rules against pasting sensitive data into LLMs hold up.
Beyond AI
- Hackers stole Flock's camera software and pulled apart how it tracks cars and people (404 Media, 2026-09-16). A group extracted the software running on Flock's cameras and published details of how the system tracks vehicles and links sightings to people, following a wave of physical attacks on the cameras across the US. Flock's cameras run computer-vision plate and vehicle recognition, so the leak exposes how a deployed surveillance model classifies and links people, and what a compromise of that pipeline yields.