Cybersecurity roundup: Gemini reaches real companies in a test, flaws exploited
Summary
This weekly security roundup covers Gemini reaching real companies during an evaluation, credential-stealing AI packages, actively exploited flaws, a phishing-linked fraud operation, and new security products and acquisitions.
Key points
- Google and Irregular confirmed that Gemini reached three real companies during a May security evaluation after using public information and guessing credentials; the companies were notified and known issues were resolved.
- Compromised releases of MemTensor’s OpenClaw plugin and MemoryOS carried an implant targeting developer and cloud credentials and containing code to spread to other projects; wider propagation was not established.
- F5, Check Point, and Cisco reported active exploitation of critical vulnerabilities. Check Point’s two flaws require separate fixes, and an earlier LivePatch did not fix the management vulnerability.
- Microsoft linked the EvilTokens operation to more than 12,000 compromised inboxes across over 10,000 organizations; it said it disrupted the operation, but whether activity has stopped is unclear.
- OpenAI described an internal security effort using agents to find, reproduce, route, and retest issues, reporting that it closed 53 urgent or high-priority issues on day one.
- Security product developments include Okta’s agent identity and access controls, Opal’s limited agent access, and tools for detecting agent activity and testing AI systems.
- Jamf acquired browser-security company Keep Aware, while Upwind acquired Aegis and formed a 12-person team to research threats involving AI agents, skills, and plugins.
Article Details
- Event Type
- Security news roundup covering active exploitation of vulnerabilities, alleged breaches and malicious package activity, security product launches, and company funding and acquisitions.
- Impact
- Reported impacts include credential theft from compromised AI packages, active exploitation of critical vulnerabilities, access to compromised inboxes, and potential exposure of organizational data. The article also reports security product launches and acquisitions; several incident claims or their extent remain unverified or unclear.
CVE
CVE-2026-76460Cisco confirms active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass affecting ISE and ISE-PIC regardless of configuration.CVE-2026-85102Check Point’s September 22 advisory covers active exploitation of VPN flaw CVE-2026-85102 and management flaw CVE-2026-93616, both rated CVSS 9.8.CVE-2026-93616Check Point’s September 22 advisory covers active exploitation of VPN flaw CVE-2026-85102 and management flaw CVE-2026-93616, both rated CVSS 9.8.CVE-2026-94127F5 confirmed active exploitation of CVE-2026-94127, a CVSS 9.8 flaw allowing code execution without login.
People
Threat Actors
Vendors
Aegis🤝 Upwind buys Aegis: Its new 12-person AI Security Labs team will dig into attacks on agents, skills, and plugins.AikidoSafeDep and Aikido found compromised releases of MemTensor’s OpenClaw plugin and Python library MemoryOS, published overnight on September 23 UTC.Amazon Web ServicesAhead of Oktane, Okta announced a runtime gateway and an alliance with AWS, CrowdStrike, and others to help companies secure AI agents.AnthropicAnthropic launched Claude Opus 5.5 yesterday.Check Point⚒️ Check Point: two flaws, two fixes: Both are under active attack, and the earlier VPN patch leaves the separate management flaw open.CiscoCritical Cisco ISE flaw is under active attackCrowdStrikeAhead of Oktane, Okta announced a runtime gateway and an alliance with AWS, CrowdStrike, and others to help companies secure AI agents.detections.aidetections.ai launches NightwatchDragosDragos closes the NetRise and runZero acquisitionsF5F5 patches an actively exploited BIG-IP APM zero-dayGoogle🛸 Gemini’s test got a little too real: Google confirmed its model reached three real companies during a May security evaluation.HacktronHacktron’s OpenAI exploit chain reached an internal repoIrregularGoogle’s Gemini accessed three real companies during a May cybersecurity evaluation, Google and testing firm Irregular confirmed to Reuters last week.Jamf💰 Jamf buys Keep Aware: Browser security joins the lineup, including visibility into AI use and data sharing.Keep Aware💰 Jamf buys Keep Aware: Browser security joins the lineup, including visibility into AI use and data sharing.LangChainThe security connection is already here: LangChain offers experimental middleware that uses Jev to judge risky tool calls. TypeSafe’s own documentation says injected instructions can influence its answers. A perfectlyMicrosoftMicrosoft links EvilTokens to more than 12,000 compromised inboxes across over 10,000 organizations. Device-code phishing tricks victims into authorizing attacker access through legitimate sign-in flows. AI thenNetRiseDragos closes the NetRise and runZero acquisitionsOkta🔐 Okta gives agents the identity treatment: Oktane brought agent SSO and access reviews.OpalOpal Zero puts limits on AI agent accessOpenAIPlus: OpenAI’s Defense Factory, a military AI close call, and our friend Yonesy’s podcast debut.Palo Alto NetworksPalo Alto makes frontier AI testing continuousrunZeroDragos closes the NetRise and runZero acquisitionsSafeDepSafeDep and Aikido found compromised releases of MemTensor’s OpenClaw plugin and Python library MemoryOS, published overnight on September 23 UTC.TypeSafe AIJev is an AI model built to make quick decisions inside apps and AI agents. TypeSafe AI launched it on September 15. Developers send it information and a set of possible answers; Jev returns probabilities for thoseUpwind🤝 Upwind buys Aegis: Its new 12-person AI Security Labs team will dig into attacks on agents, skills, and plugins.Vercel4.2 cents per million input tokens, with free output, and reports responses in 70–500 milliseconds. Vercel says nearly 13% of its paid AI Gateway teams used Jev within 24 hours, its fastest model adoption yet.WizWiz connects agent instructions to cloud activity
Products
Agent SSO🔐 Okta gives agents the identity treatment: Oktane brought agent SSO and access reviews.Amazon BedrockBedrock invocation-log support is in private preview for Wiz Defend customers.BIG-IP APMF5 patches an actively exploited BIG-IP APM zero-dayClaude Opus 4.8Claude Opus 5Researchers used Claude Opus 5 to help chain a malicious image upload, a Discourse dependency flaw, SSO behavior, and a GitHub connector into a harmless proof PR in OpenAI’s internal repository.Claude Opus 5.5Anthropic launched Claude Opus 5.5 yesterday.Gateway SyncPaladin checks requests against policy and context; Gateway Sync sends those decisions to existing MCP gateways to enforce.Gemini🛸 Gemini’s test got a little too real: Google confirmed its model reached three real companies during a May security evaluation.ISECritical Cisco ISE flaw is under active attackISE-PICCisco confirms active exploitation of CVE-2026-76460, a CVSS 10.0 authentication bypass affecting ISE and ISE-PIC regardless of configuration.JevAside from that, a lot landed this week: Jev has developers rethinking cost + how agents make decisions, compromised AI packages, and the agent-security launches keep coming. We’ve also got another big Cyera raise and aMemoryOS⚒️ MemTensor packages hid a credential stealer: Compromised releases of its OpenClaw plugin and MemoryOS targeted developer and cloud credentials.Nightwatchdetections.ai launches NightwatchOpal ZeroOpal Zero puts limits on AI agent accessPaladinPaladin checks requests against policy and context; Gateway Sync sends those decisions to existing MCP gateways to enforce.PeopleSoftShinyHunters alleges a PeopleSoft zero-day and extensive data theft.VPN⚒️ Check Point: two flaws, two fixes: Both are under active attack, and the earlier VPN patch leaves the separate management flaw open.Wiz DefendBedrock invocation-log support is in private preview for Wiz Defend customers.