On 27 September 2026, references to an always-on assistant called “o” briefly surfaced on OpenAI’s site, alongside a “-o” email suffix and a spot in the $100 Pro plan. Ahead of DevDay on 29 September, work out what an agent that reads and writes your mail does to your attack surface.
On September 23, 2026, Google shipped Gemini CLI 0.61.0, which requires human confirmation before the agent edits a build file or runs a command shaped by untrusted content. Developers using a coding agent should update and leave those confirmations on: for now, they are the best defense against indirect prompt injection.
On September 17, 2026, Lasso Security showed that SynthID-Text watermarking, required by the EU AI Act for provenance, changes how AI agents call tools and hold safety refusals, especially under prompt injection. Treat provenance compliance as a model-behavior change: re-evaluate and red-team with watermarked content.
An Adversa researcher showed that encrypting malicious instructions with PBKDF2 and AES-256-GCM is enough to bypass Grok’s guardrails, which decrypt the payload and then execute it as their own tool output. xAI was told in June, and the assistant was still leaking users’ names, locations, and chat histories on August 20.
A preprint from Anthropic and EPFL demonstrates that payloads can spread from one AI agent to the next through the persistent SOUL.md prompt files, with a 55% infection rate. The defense fits in one paragraph: a refusal instruction in the system prompt drives propagation to near zero.
CVE-2026-73678, scored CVSS 10, lets an attacker with no account run system commands on the MindsDB platform through the Anton agent’s scratchpad tool. If you expose a MindsDB instance, cut public access before even waiting for a patch.
Two independent security research teams have demonstrated that Atlassian's Rovo AI assistant can be prompted to exfiltrate Jira and Confluence data to an attacker-controlled server. One attack path was fixed server-side on July 8, 2026 — the other remained open on August 8 with no fix announced. Atlassian Cloud admins must audit Rovo permissions immediately.
On July 28, 2026, researcher Håkon Måløy published the first public demonstration of a document-borne AI worm capable of silently altering financial reports and self-propagating through Microsoft Copilot for Word. After 144 days of coordinated disclosure and two attempted fixes — including a model upgrade to GPT-5.6 — the vulnerability class remains exploitable.
