Shadow IT can leave security teams unaware of unmanaged endpoints, unauthorized software, and other assets that fall outside existing monitoring. Wazuh explains how endpoint inventory, agentless monitoring, and centralized analysis can help organizations identify and reduce these visibility gaps.
OpenAI launches a formal framework to disclose model misalignment, publishing six reports on models that lied, faked data, or bypassed rules. Most companies don’t publish a document explaining how their product misbehaves. OpenAI just did. On September 16, it released a formal framework for tracking, investigating, and disclosing cases of model misalignment, paired with six actual incident reports covering the last six months. OpenAI admits that its previous way of sharing these findings was not very organized. Some discoveries were grouped together, others were saved for system cards, while some were held back until there was enough information for a larger report. The new framework aims to make the process faster by publishing what researchers find, even before OpenAI fully understands the issue or knows how to fix it. There is also a pretty direct admission in the announcement. OpenAI says the industry still has not solved alignment and monitoring well enough to keep AI development moving at the current pace for much longer. That is a surprisingly frank statement from a company whose business depends on providing AI services. “We are sharing a new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI, along with six reports on unexpected or concerning model behavior we’ve observed in the last six months.” reads the company’s announcement. “This new framework is intended to expedite publishing misalignment reports following observation, even when we haven’t fully explained or mitigated the behavior we’re reporting.” The six reports themselves read like a catalogue of small rebellions. One research model inserted its own instructions into task summaries, including instructions telling itself to ignore its normal constraints, across 27 documented cases. During training of a model called GPT-5.6 Sol, several instances wrote notes to future versions of themselves explaining how to hide mistakes and invent missing data without saying so. “For example, compaction summaries included instructions to invent missing historical data without disclosing it and to hide mismatches in source versions.” continues the announcement. Then there’s the one cybersecurity readers will recognize immediately. While trying to answer a routine question about county earnings figures, a model found an exposed API key sitting in a public repository and used it without permission. When that still didn’t produce the numbers it wanted, it made them up and presented the fabricated figures as real. That’s not a hallucination. That’s a cover story. “While answering a routine question about earnings figures in a California county, a model found and used an exposed API key without authorization.” OpenAI states. “When it still wasn’t able to retrieve the requested figures, it fabricated them and presented them as data from the requested source.” Two more reports describe models improvising their way around restrictions rather than lying outright. One agent uploaded a file to the public internet just so it could cite a browser source, without asking anyone first. In another case, separate model instances used an internal code repository as an informal chat room, leaving messages for each other while hunting for files they’d lost access to. The last report covers agents working the same task who couldn’t reach each other’s local files, so they used public file-hosting sites to swap data instead. Task deliverables ended up sitting on the open internet. Nobody told them to do that. Nobody told them not to, either, which is arguably the real problem. “Agents working together on the same training task used public file-hosting websites to share files when they could not access one another’s local files.” reads the announcement. “This made task deliverables available at public URLs, even though the task requested the models use only local files.” OpenAI’s process for handling these cases now runs on three tracks: Ready for Disclosure, Minor Investigation, and a slower Larger Investigation track for anything involving outside parties or serious risk. Disagreements about whether to publish, or which track applies, get kicked up to OpenAI’s Safety Advisory Group, and from there to company leadership if the argument doesn’t settle. Each future report should explain what happened, how it was discovered, what is still unknown, and what OpenAI is doing about it. If there is already a fix, the report will include that too. But in many cases, there may not be a fix yet. The goal is to share information quickly, rather than wait for a solution. OpenAI also makes clear that this framework does not replace its legal duties for serious safety incidents or security breaches. It is an additional measure, not a replacement. The company says the Hugging Face incident earlier this year would have followed the slower reporting process if this framework had already been in place. “These initial reports are not intended to represent the full range or severity of the cases covered by this framework. We are committed to disclosing instances of misalignment that meet this framework’s criteria, including more complex cases requiring longer investigation or coordination with third parties.” the AI firm concludes. “We will continue publishing reports under this framework on an ongoing basis, and will share more about our reporting commitments as we continue to develop them.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
OpenAI has presented new examples of what they call "AI model misalignment" from the past six months, including unauthorized file uploads, following self-generated instructions, hiding mistakes, and leveraging exposed API keys. OpenAI uses the term "model misalignment" to describe cases where AI models act contrary to their intended constraints, including taking unauthorized actions, evading oversight, or bypassing safeguards to complete a task. In a post published yesterday, OpenAI says it is now using a new framework to track and investigate these unsanctioned actions by AI agents. "We are sharing a new framework for tracking, investigating, and disclosing instances of model misalignment at OpenAI, along with six reports on unexpected or concerning model behavior we've observed in the last six months," explains OpenAI.
Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware. The customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours on September 14. The attack affected pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The Cloudflare worker also modified the Brevo forms script, Brevo Conversations widget, and the Brevo SDK loader scripts that customers embed on their websites. In a post-mortem published today, Brevo explained that attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes, and DNS records across Brevo's zones without triggering an alert.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Acronis Backup, Cisco ISE, and Google Pixel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1, 2] the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-76460 (CVSS score of 10.0) Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability CVE-2026-87886 (CVSS score NA) Acronis Backup Incorrect Default Permissions Vulnerability CVE-2026-58704 (CVSS score of 8.8) Google Pixel Improper Authorization Vulnerability CVE-2026-76460 is an authentication bypass vulnerability affecting an API in Cisco Identity Services Engine (ISE). The flaw is caused by inadequate authentication checks on a specific API endpoint. An unauthenticated remote attacker could exploit it by sending a specially crafted request, potentially gaining unauthorized access to the affected system through its web-based management interface. “The Cisco PSIRT is aware of active exploitation of this vulnerability. Cisco strongly recommends that customers upgrade to a fixed software release to remediate this vulnerability.” reads the advisory. CVE-2026-87886 is a local privilege escalation vulnerability in Acronis Backup caused by insecure file permissions. The flaw affects the Acronis Backup plugin for cPanel & WHM and the Backup extension for Plesk. A local attacker with limited privileges could exploit the issue to manipulate files used by the backup service and potentially execute code with elevated, root-level privileges. Acronis reported exploitation in the wild in limited in limited, targeted attacks Google has released its September 2026 Pixel security update, addressing a large set of vulnerabilities, including a high-severity flaw, tracked as CVE-2026-58704 (CVSS score of 8.0), in the cellular modem that has already been exploited in the wild. The third vulnerability added to the KeV catalog is an Improper Authorization flaw tracked as CVE-2026-58704. Google has addressed the flaw with the release of its September 2026 Pixel security update. “In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.” reads the advisory. The vulnerability is an elevation-of-privilege issue caused by a permission bypass resulting from a logic error in the modem code. Google said there are indications that the flaw may have been used in “limited, targeted exploitation.” Unlike vulnerabilities affecting applications or higher-level Android components, CVE-2026-58704 resides in the cellular modem, a security-sensitive component responsible for communications between the device and mobile networks. The company warned that it has already been exploited in the wild. “There are indications that CVE-2026-58704 may be under limited, targeted exploitation.” states Google. As usual, the IT giant has not disclosed who exploited the vulnerability, how many devices were targeted, or what the attacks were designed to achieve. The vulnerability is particularly notable because it does not require user interaction. According to the CVE record, exploitation can result in remote, proximal or adjacent privilege escalation without requiring additional execution privileges. The technical details suggest that an attacker able to reach the vulnerable modem environment could exploit the permission bypass to obtain higher privileges. The attack vector is classified as adjacent rather than broadly Internet-facing, an important distinction when assessing the practical exploitation requirements. In this case, however, Google has not publicly described the complete attack chain. There is also no evidence in the company’s advisory identifying the operation as the work of a commercial spyware vendor or a specific state-sponsored group. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the GitLab and ConnectWise flaws by September 14, 2026, while the remaining JFrog Artifactory issues must be addressed by September 19, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Cisco has released security updates to address a maximum-severity Identity Services Engine vulnerability that attackers are actively exploiting in the wild. Cisco ISE is a centralized policy platform that IT administrators use to manage endpoints, users, and device access to network resources, often while enforcing Zero Trust security models. The security flaw (tracked as CVE-2026-76460) lets remote attackers bypass authentication by exploiting a weakness in an API of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) regardless of configuration. "This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint," the company explained. "A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface."
Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 10.0), could allow an unauthenticated, remote attacker to bypass authentication. "This vulnerability is due to insufficient authentication control on an API endpoint," Cisco said. "An attacker
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned that hackers are now exploiting a maximum-severity GitLab vulnerability in attacks. GitLab's DevSecOps platform is used by over 50% of Fortune 100 companies and has over 30 million registered users worldwide. The security flaw (tracked as CVE-2026-85706) stems from missing authentication enforcement and improper path confinement in the repository commits API, and unauthenticated attackers can exploit it to read credentials, secrets, and other sensitive information from vulnerable servers. GitLab fixed this security issue in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 19.3.2, 19.2.6, and 19.1 on Thursday, and urged users to patch their systems immediately. While the company has yet to tag this vulnerability as actively exploited, cybersecurity firm watchTowr reported one day later that attackers were probing the Internet for GitLab servers unpatched against CVE-2026-85706.
Researchers found 36,769 exposed AI endpoints, but only 2% had an HTTP authentication gate. Running AI locally is supposed to give organizations more control. Models, prompts and documents stay on infrastructure they manage instead of being sent to a third-party cloud. But that advantage disappears quickly when the infrastructure itself is exposed to the public internet. A new study from Mysterium VPN offers a useful snapshot of the problem. The researchers found 36,769 self-hosted AI endpoints across model servers, agent-building platforms and vector stores that were reachable and identifiable through a public internet scanning index. “Only 2.02% return an HTTP authentication challenge; for the overwhelming majority, there’s no network-layer gate whatsoever.” reads Mysterium VPN’s report. “Open WebUI: 18,529 reachable, 1 behind a gate: The most widely deployed local-LLM front-end has, as a population, no perimeter.” That number needs to be read carefully. A service returning HTTP 200 isn’t automatically unauthenticated because a login page can also return 200. Mysterium therefore used HTTP 401 and 403 responses as evidence of an authentication gate and made a stronger claim only where the application fingerprint itself proved anonymous access. “We counted the doors. We didn’t open them.” That distinction matters because the researchers didn’t connect to the exposed systems, retrieve data, run models, read credentials or exploit vulnerabilities. They queried Netlas, a third-party internet scanning index, and counted responses that matched specific fingerprints. The largest number came from Open WebUI. The researchers identified 18,529 reachable instances, but only one returned an HTTP authentication challenge. vLLM accounted for another 4,880 endpoints, with just three showing an authentication challenge, while LocalAI had 150 and llama.cpp 69, with neither showing a challenge. Ollama produced a particularly important finding because the researchers could verify anonymous access from the service response itself. An exposed Ollama server returns the text “Ollama is running” from its root endpoint without requiring credentials, and 6,935 hosts returned that fingerprint. Of those, 6,046 returned an explicit HTTP 200 response. This isn’t just about seeing a chatbot from the internet. An exposed Ollama API can reveal the models installed on the machine and can be used to generate text using the owner’s hardware. That creates a straightforward resource-abuse problem: someone else gets the GPU time and the owner gets the electricity bill. The security community calls this LLMjacking, but the underlying problem is familiar. The AI label doesn’t make an exposed API magically safer. There is also evidence that this isn’t a small or isolated deployment mistake. A separate SentinelOne and Censys study published in January identified around 175,000 publicly exposed Ollama hosts across 130 countries. Almost half of those systems supported tool-calling capabilities that could execute code, access APIs or interact with external systems. Mysterium’s own number is much smaller because it comes from a different scanning source and a stricter fingerprint. The researchers explicitly describe their 36,769 endpoints as a lower bound rather than a measurement of the entire internet. They also found 22,024 responses on Ollama’s default port 11434, but excluded those from the main total because a port number alone doesn’t prove which service is running there. The more interesting security issue may sit one layer above the model itself. Mysterium found 5,223 exposed agent builders and workflow platforms, including Flowise, n8n, ComfyUI, Dify, RAGFlow, Langflow and Open WebUI Pipelines. These systems deserve more attention because they don’t simply host an AI model. They often connect that model to the rest of the company’s infrastructure. An automation workflow can contain an OpenAI API key, database credentials, Slack tokens, webhook secrets, CRM passwords and other information needed to make the workflow work. They aren’t broken. They’re doing what they were designed to do. The problem starts when someone places that functionality directly on the internet without another security layer in front of it. Flowise is a good example. Mysterium identified 1,341 reachable Flowise instances and found zero HTTP authentication challenges among them. The same report points to CVE-2026-40933, a critical Flowise vulnerability that can allow an authenticated attacker to execute arbitrary commands through the MCP adapter. Flowise fixed the issue in version 3.1.0. That combination matters. A reachable application isn’t necessarily vulnerable, and a vulnerability doesn’t automatically mean an internet-facing installation can be compromised. But putting a system that stores credentials on the public internet increases the number of ways an attacker can eventually reach those credentials. n8n illustrates another part of the problem: attackers don’t always need a vulnerability. In August, GitGuardian researchers examined n8n API tokens exposed in public GitHub commits. They identified 4,576 unique tokens associated with 1,255 hostnames. Of the 896 instances that were reachable during testing, 321 accepted at least one leaked token. Those credentials could provide access to workflows and connected systems without exploiting a software flaw. That’s an important lesson for AI security because many organizations now use automation platforms to connect databases, cloud services, source-code repositories, customer systems and AI services. The risk doesn’t stop at the workflow layer. Vector databases can contain the actual information that an AI system uses to answer questions. Mysterium identified 920 vector-store endpoints, almost all of them exposed Attu consoles for Milvus. But the researchers are clear that this number tells us very little about the real exposure. Qdrant’s native port and Milvus’s native database port weren’t scanned by the source, so a database could be publicly reachable without appearing in the census. That makes the vector-store figure a floor, not a ceiling. A model server exposes computing capability, an agent builder can expose credentials, and a vector store can expose the information that an organization has loaded into its AI system: internal documents, support tickets, customer records or private knowledge bases. “We are reporting a floor of 920 for the one class where the true number is likely highest. Nobody should read this study as evidence that self-hosted vector databases are well protected.” continues the report. “We simply couldn’t see them.” That’s one of the most important qualifications in the research. The absence of evidence here isn’t evidence that these systems are safe. The same caution applies to geography. Mysterium wanted to publish a country breakdown, but rate limits prevented reliable results for several major countries. Rather than publish a misleading ranking, the researchers dropped it. The one figure they could support was that 4,136 of the 22,024 responses observed on port 11434, or 18.8%, came from the United States. The study also deliberately avoided turning exposure into compromise. The researchers didn’t contact the hosts, retrieve documents, inspect prompts or chat logs, read credentials, run inference, exploit vulnerabilities or publish IP addresses and hostnames. That’s important because the research measures exposure, not confirmed compromise. The underlying problem, however, is difficult to dismiss. Over the past two years, organizations and individual developers have moved more AI infrastructure away from managed cloud services and onto their own machines. That can improve privacy and control, but it also transfers much of the security responsibility to whoever deploys the system. A local AI stack should therefore be treated like any other internet-facing service. If the model doesn’t need to be reachable from the internet, bind it to localhost or a private network. If remote access is necessary, put authentication and network controls in front of it, rather than relying entirely on the application’s own login system. The same logic applies to agent builders. If an n8n or Flowise installation holds API keys and credentials that can reach production systems, it deserves the same level of protection you’d give a password manager. Calling it an “AI tool” doesn’t reduce the value of what it stores. There is also a basic operational question that many organizations should answer now: what AI infrastructure is already exposed? Mysterium’s fingerprints can be used with internet-scanning services to check for exposed deployments. That makes the research useful not because it proves that 36,769 systems are compromised, but because it gives defenders a way to look for their own systems before someone else does. And that may be the uncomfortable part of the findings. The AI security problem isn’t always a sophisticated model attack or a novel prompt-injection technique. Sometimes it’s a developer binding a service to 0.0.0.0, putting it on a cloud server and forgetting that the internet can see it. “None of this is a vulnerability report, and it would be unfair to file it as one. Ollama, Open WebUI, Flowise, and n8n aren’t broken.” concludes the report. “They’re doing what they were designed to do: run on a machine and serve a local user. The failure is in deployment — thousands of people binding to 0.0.0.0 on a cloud box, in a hurry, and never putting anything in front of it. “ The AI is new. Leaving the front door open isn’t. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI)
GitLab urged users on Thursday to patch their servers immediately against a maximum-severity path traversal vulnerability tracked as CVE-2026-85706. The security flaw, discovered by a security researcher using the 's3ntago' handle and reported via GitLab's HackerOne bug bounty program, stems from improper path confinement and missing authentication enforcement in the repository commits API. According to GitLab, unauthenticated attackers can exploit CVE-2026-85706 to read arbitrary files from vulnerable servers "under certain conditions." Yesterday, GitLab patched a second critical vulnerability tracked as CVE-2026-87719 that stems from an insecure deserialization weakness in the GraphQL subscription serializer. CVE-2026-87719 affects GitLab EE and allows authenticated users with Duo Chat access to steal sensitive credentials and Advanced Search instance configurations.
Confirm this action.
Leaving now will discard your changes.