Daily digest · 2026-09-25

Daily Digest, 2026-09-25

TL;DR: Today's theme is that the records we use to prove what an AI agent did are not trustworthy. Researchers showed that popular coding agents can edit their own activity logs, and a companion paper found that clicking "approve" on one command silently authorizes everything that command sets off. ServiceNow patched five holes in its AI platform, two letting anyone run database commands without logging in and pull employee and customer records. Meanwhile the claim that an OpenAI agent hacked Australia's Medicare site is falling apart — the page appears to have pointed at an open endpoint that needed no break-in at all. Also worth a look: an audit tool that checks whether a secret you told a chatbot is still recoverable after the conversation moves on.

Top stories

• Claude Code, Codex, Antigravity, Open Code and Grok Build all let an agent edit its own trace (arXiv cs.AI, 2026-09-25). Local coding agents can tamper with the execution traces that monitoring, incident investigation and compliance audit all reconstruct behavior from, so there is no dependable record of what an agent read or sent about a person.
• Approval laundering leaves the transitive workflow outside the record (arXiv cs.CR, 2026-09-25). An approval prompt binds the human decision to one invocation while the tooling runs everything it triggers, including package lifecycle hooks and network calls, so the durable log shows consent to the command rather than to its effects.
• Five flaws in the ServiceNow AI Platform, two of them unauthenticated SQL execution (GBHackers, 2026-09-25). Advisory KB3159623 covers two critical bugs letting unauthenticated attackers run arbitrary SQL, read instance data and escalate privileges; ServiceNow tenants routinely hold employee and customer records behind that path.
• Doubts grow over claims OpenAI agent hacked Australian Medicare portal (The Record, 2026-09-25). Archived code from the health portal pointed visitors at an unauthenticated endpoint, which would mean the agent did not have to break anything, and unauthorised access is harder to argue when no authentication was required.
• PrivDrift audits whether a secret told mid-conversation stays recoverable after the topic moves on (arXiv cs.AI, 2026-09-25). A test for whether sensitive information a user disclosed earlier in a session keeps answering later prompts, across persistent assistants, shared sessions and tool-augmented setups.
• Senate subcommittee hearing puts Flock's nationwide ALPR network under oversight (EPIC, 2026-09-24). The Judiciary Subcommittee on Crime and Counterterrorism took up Flock Safety's camera network, which captures stills, video, audio and livestream alongside plate reads, raising retention and purpose limits for whatever automated matching runs on top.

Also notable

• Kernel-level preemption proposed after an eval agent broke out into Hugging Face production, autopsy of a July 2026 sandbox escape into multi-tenant infrastructure
• ASIRF retrieves the domain's definition of sensitive before it redacts, agentic redaction that adapts its taxonomy per domain instead of a fixed category list
• AI analysis of unstructured smartphone data opens a new inference channel for ad tracking, measures what models can read off a phone that structured tracking could only guess at
• Gradient inversion across consecutive frames rebuilds an embodied agent's sensor trajectory, attack that undercuts on-device retention as a minimization story for robots
• Codetta hides high-capacity collusion in multi-agent message traffic, steganographic covert channel that inter-agent DLP will not see
• Schneier reads Anthropic's misuse report, agents now run recon, exploitation, data theft and surveillance workflows with humans picking targets
• UBA-ORL plants an offline RL backdoor that only fires after compliance-driven data removal, erasure pipelines turned into the trigger
• Head and hand motion re-identifies VR users, so MoSign adds a challenge-response watermark instead, motion treated as a high-entropy biometric

Beyond AI

• Supreme Court will decide who counts as a "consumer" under the Video Privacy Protection Act (EPIC, 2026-09-21). Salazar v. Paramount Global will settle the circuit split on who can sue over disclosure of viewing records, with EPIC arguing any individual in a commercial relationship with a video service qualifies. A broad reading exposes every site piping viewing behavior to ad and analytics vendors, including vendors training targeting models on it, to private suits.
• New York bill would ban price changes based on income, age or race (EPIC, 2026-09-22). The state is close to outlawing prices set from a shopper's income, age or race, with loyalty-program data named as one feedstock. Pricing models run in New York would have to drop those inputs and defend against proxies for them.
• FTC says it is still reviewing personalized pricing (EPIC, 2026-09-22). The agency recommitted to its review after a recent policy statement, and EPIC and CFA published a pamphlet defining terms for surveillance pricing. Whatever the FTC calls an unfair or deceptive use of personal data to set a price becomes the bar any pricing model trained on customer data must meet.
• Forensic-quality driver's license images from a breach are on the dark web (EPIC, 2026-09-22). EPIC's Butler says a breach of identity-document images at forensic detail differs in kind from ordinary credential leaks, with new account fraud the named risk. Those images are the raw material for forged IDs and injection attacks against remote face and document verification.