Hacktron disclosed on September 19, 2026 that Claude Opus 4.8 failed across multiple sessions to build a working exploit chaining a libheif memory-corruption bug in OpenAI's Discourse forum (CVE-2026-32882) with a weakness in OpenAI's SSO login flow — but Claude Opus 5, released July 24, 2026, produced a working exploit within hours of a fresh session, and the researchers reached OpenAI staff ChatGPT/Codex accounts and an internal GitHub repository in under 72 hours from initial bug discovery. OpenAI confirmed a fix roughly 14 hours after the report and paid a $6,500 bounty on September 1.

The exposure path is any SSO integration linking a lower-trust surface — a support forum, a community portal — to production developer identity (GitHub, internal repos, CI). A single image-processing library bug in that lower-trust surface became an enterprise-wide identity breach because the forum and the developer account shared a trust boundary. The more durable signal is that the same exploit chain went from "a strong model can't finish it" to "a fresh model instance finishes it in hours" purely from a vendor-scheduled model upgrade — a capability threshold that arrives on the model provider's release calendar, not the defender's.

Cisco Talos disclosed CLOSEDQUORUM on September 22, 2026 — the first publicly documented Windows implant that delegates its next tactical action to a live query of four commercial LLMs (DeepSeek, Qwen, Mistral, Gemini), executing whichever of "steal data," "inject code," or "establish persistence" wins the vote, rather than following fixed operator commands. Talos released CAIRN alongside it, an open-source framework that identifies this class of AI-integrated malware from file metadata alone, without executing the sample.

Endpoint detection tuned to fixed C2 behavior patterns will miss a malware family whose decision logic changes at runtime based on an external LLM API response — the artifact to hunt for is an unexpected process calling a commercial model API endpoint, not a static beacon signature.

Cisco disclosed CVE-2026-76460 on September 17, 2026, a maximum-severity authentication-bypass flaw in an Identity Services Engine (ISE and ISE-PIC) API that lets an unauthenticated remote attacker reach root-level privileges with no workaround available. Cisco PSIRT confirmed active exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 16 with a three-day federal patch deadline that has since passed.

ISE is the network-access-control and identity policy engine authenticating and segmenting everything else on the network — a root compromise here can rewrite authorization policy for every device ISE governs, including the identity signals feeding AI-agent access decisions elsewhere in the estate.

Arista disclosed on September 22, 2026 that CVE-2026-93952, a CVSS 10.0 flaw affecting VeloCloud Orchestrator deployments that use certificate-based authentication between edge devices and the orchestrator, is under active exploitation. An attacker with access to the public portion of an edge authentication certificate can send unfiltered input to the web interface to bypass authorization; Arista said the issue "was discovered externally and is known to be actively exploited," with intrusions installing a backdoor script (vcnode.js) and persistence files under system directories.

VeloCloud Orchestrator centrally manages SD-WAN edge devices across a distributed enterprise network and is exposed to the internet by design for edge provisioning — a bypass here gives an attacker centralized control of WAN routing and traffic across every site the orchestrator manages.