On 4 November 2026 the Acronis Threat Research Unit described "BOSSAI", a Taiwan-based operator who assigned tasks to 12 AI agents. One agent scanned, a second wrote attack-path reports and a third exploited. Targets included government, education, finance and military-related systems in 11 countries, with confirmed breaches at universities and emergency-services providers that exposed medical and personal data. Commercial models refused much of the exploitation work, so the operator used locally hosted models with safety restrictions removed. Acronis says those models produced fabricated findings and excess output.

The exposure path is ordinary internet-facing services: unpatched web applications, exposed admin interfaces and records stores reachable from them. Two points matter for planning. One unsophisticated operator now reaches hundreds of organisations without the agents being coordinated automatically. And refusals by commercial providers degraded the operation rather than stopping it. Unreliable attacker output still produces real breaches when it is aimed at enough targets, so measure your exposure by how many internet-facing services are left unpatched, not by how capable the attacker's model is.

On 5 November 2026 researchers published a test of two-tier web-request triage, in which a fast model closes most requests and escalates the rest. They held out seven attack families from training and threshold-setting, then spliced the payloads into real browsing traffic. A fine-tuned supervised detector escalated only 50–81% of held-out path-traversal requests within a 5% benign budget across ten training runs, against nearly all of them when traversal was in its training data. Two hosted decision models escalated at least 97.6% of every family. The authors warn those models may have seen these public families in training. A search guided by one hosted model's own scores got 43% of held-out attacks past it within 300 queries. When the same evading requests were resubmitted, that model escalated them in only 60% of its answers.

This affects the AI triage tier in a SOC, WAF or managed detection pipeline, the layer that decides at machine speed what a human never sees. Fitness and risk need to be kept separate here. Fitness on known families looks high. On novel families, and against an attacker who can probe the model, the miss rate is large and the model's verdicts do not stay consistent. A vendor's detection rate measured on public attack corpora says little about either.

On 5 November 2026 Check Point disclosed that ChatGPT's Lockdown Mode, introduced in June to limit outbound requests that prompt injection could use to exfiltrate data, could be bypassed. HTML previews in code blocks rendered in a sandbox that blocked direct window opening but still allowed popups. Nested sandboxed frames reached an unmodified popup function, and the content it opened was free of the original restrictions. A crafted prompt, a malicious GPT or a shared chat could then exfiltrate conversation data or deliver phishing and malware. OpenAI patched the flaw on 18 September.

This affects AI assistants used under enterprise data-handling policy. Organisations that approved ChatGPT use for sensitive work on the condition that Lockdown Mode was enabled had a control that could be bypassed for about three months. A model-side exfiltration control is only as strong as the rendering surface around it, and that surface changes with every product release. The failure class, assistant-rendered content escaping its own sandbox, is not covered by prompt-injection filtering.