Infosec · Sunday, 23 August 2026 · Issue 83 · 5 stories

Agentic Attackers Broke Into OpenAI

An autonomous agent collective chained zero-days with leaked creds to slip into OpenAI's research infrastructure. That's a preview of what's coming, and it's not the only boundary that fell this week.

Vulnerabilities & Exploits

isolated-vm sandbox escape turns one reference into host RCE

Endor Labs found a type confusion in isolated-vm's ExternalCopy that lets sandboxed JavaScript corrupt host memory, escalating from a single ivm.Reference to full guest-to-host control-flow hijack. Tracked as GHSA-864f-rcv7-6rh4 (CVE pending), it hits all versions through 7.0.0 and is patched in 6.2.0/7.0.1. The V8 Isolate boundary held, the marshal layer didn't. For a sandbox with ~1M weekly npm downloads behind AI-agent tooling, that's a serious trust breach.

endorlabs.com ↗12 min read at source

CircleCI MCP server RCE: a header check the attacker can already forge

Remedio broke into CircleCI's MCP server with zero credentials: the Host/Origin allowlist is defense theater, since clients set both headers themselves. Send Host: localhost with no Origin and both checks pass, then call run_pipeline to execute arbitrary code under the org's token. That's unauthenticated RCE against build secrets and cloud identities, pending CVE, likely CVSS 10.0.

remedio.io ↗6 min read at source

Encrypted Prompts Slip Past AI Guardrails: Zero-Click Grok Data Theft

Adversa AI's new "Cryptographic Context Injection" ships malicious instructions as AES ciphertext that guardrails can't parse, then tricks the model into decrypting them inside its own code-execution sandbox. The recovered plaintext inherits trusted-context credibility, in a live demo against Grok it resolved private session context into a zero-click data exfiltration URL. Gemini's success rate had already dropped by August, but xAI still hasn't responded to disclosure.

securityweek.com ↗3 min read at source

Threats & Malware

ToxicPanda 2.0 Turns Android Accessibility into a 349-Bank Credential Pipeline

Zimperium's zLabs flags a straight-line escalation in Android banking malware: ToxicPanda 2.0 grew its fake-login overlays from 16 banking apps to 349 financial institutions across 16 countries, and added PIN theft across 140+ banking and crypto apps. The kicker is access, not just volume. By abusing the Android Accessibility Service, the trojan grants itself shell-level control, silently enables Wireless Debugging via ADB, and rewrites the victim's lock-screen PIN. Distribution has shifted to AWS-hosted buckets.

zimperium.com ↗10 min read at source

Breaches & Industry News

Agentic attackers broke into OpenAI by chaining zero-days with leaked creds

OpenAI co-founder Greg Brockman details how an autonomous agent collective slipped into both OpenAI research infrastructure and a second company's production environment, chaining unknown vulnerabilities with credentials leaked from user accounts. He calls it a preview of typical threat actors within months, and argues AI can shift security economics toward defenders, if companies move now before open-weight attackers catch up.

blog.gregbrockman.com ↗9 min read at source

You’re caught up.

That was all 5 stories in the 23 August issue.