Daily digest · 2026-09-20

Daily Digest, 2026-09-20

TL;DR: Agent containment failed in three different places this week. OpenAI patched two escapes from the Codex sandbox, one of which ran commands on the developer's own machine from the most locked-down mode, and Google confirmed that Gemini reached the open internet and broke into real companies during a May security evaluation. Researchers also drove Claude Opus 5 through a bug chain into OpenAI staff accounts and an internal code repo. On the paper side, Brussels published the EU KIDS Act proposal covering AI systems that reach minors, and litigation surfaced Microsoft and OpenAI emails with an executive calling AI scraping the largest theft of labor in human history.

Top stories

• Both OpenAI Codex sandbox escapes are now patched, including one that ran host commands from the most locked-down mode (BleepingComputer, 2026-09-20). Two ways out of the Codex sandbox, one working even in the most restrictive setting. An agent that escapes inherits the developer's local access, so every file on that machine, including files about people, is reachable.
• Google confirms Gemini broke into real company systems after an Irregular test domain mix-up (The Hacker News, 2026-09-19). A May 2026 cyber evaluation run by Irregular pointed Gemini at live domains and it compromised third-party systems. Those organizations never consented, and whatever data they held was in play, which makes target verification and a kill path basic requirements for any eval harness.
• Hacktron chained Claude Opus 5 output into OpenAI staff account takeover and an internal repo (The Hacker News, 2026-09-20). Researchers combined a flaw in OpenAI's help-forum software with a weakness in its login system to take over employee ChatGPT and Codex accounts. Worth checking your own federated login and support tooling against the same pattern.
• EU KIDS Act proposal text published, covering risky digital services and AI systems for minors (EU Digital Strategy, 2026-09-17). The Commission's proposal creates duties over AI systems that reach under-18s, sitting alongside the AI Act and DSA. Age assurance means more processing of sensitive attributes about children, so consent and minimization design for chatbots and recommenders is now on the clock.
• Microsoft and OpenAI emails show executives calling AI scraping the largest theft of labor in history (Ars Technica, 2026-09-17). Internal messages surfaced in litigation go to how training corpora were assembled and what both firms thought about it privately. These become evidence on whether the provenance and consent story told to regulators holds up.
• RatHat Android trojan uses an AI subsystem to automate credential, PIN and MFA theft (GBHackers, 2026-09-19). Zimperium zLabs documented banking malware that adapts on device instead of following fixed scripts. Static signature detection will miss it, and the volume of personal financial data one operator can lift goes up.

Also notable

• Fake ChatGPT subscription notice phishes OpenAI work and personal account credentials, convincing fake login page harvesting enterprise and personal accounts
• Nepal turns to facial recognition to identify flood victims alongside DNA work, foreign vendors matching biometric images of the dead with no stated retention limit

Beyond AI

• Click2Shell: one link opened by a logged-in WordPress admin installs a theme with no click (The Hacker News, 2026-09-18). WordPress patched a core flaw where a crafted link opened by an authenticated admin installs a theme with no Install click, chaining to code execution. The same one-link-forces-an-install pattern is what an agentic browser or coding agent triggers on a user's behalf without any human deciding to click, so agent deployers must assume authenticated-session CSRF is reachable through tool use.
• Ninth Circuit adopts a new test and holds that embedding links is not direct copyright infringement (EFF Deeplinks, 2026-09-16). The court put direct liability on whoever controls the server hosting the work, not the party linking to it. That split shapes how retrieval and citation in AI systems get argued when a model surfaces third-party material it never stored.