AI News Briefing — Attackers built a credential campaign in six hours

Practice & craft

• [2026-09-08] Google’s threat intelligence group recorded a Q2 operation in which an attacker compromised a cloud resource, then used a coding chatbot, one prompt and a set of agent instructions to plan, build and run mass credential harvesting in under six hours, taking thousands of third-party credentials. A separate exposed directory had matured into a production dashboard managing over 23,800 harvested secrets in real time, cloud and AI-service API keys among them. The hardening list is unusually specific: inspect .claude/, .cursor/ and .vscode/, audit GitHub personal access tokens, and watch MCP server integrations. (official, source)

  Agent instruction directories sit inside the repository and get skimmed like configuration rather than read like code. That is the gap the hardening list points at, and walking .claude/, .cursor/ and .vscode/ back through recent merges is a morning’s work.

Coding agents

• [2026-09-08] GitHub put enterprise-managed sandbox policies for Copilot in JetBrains IDEs into public preview. Administrators now set sandbox enablement, filesystem and network access, proxy settings, developer-tool access and macOS Keychain access centrally, and the IDE marks the controls the organisation owns and locks them. The settings appear only with the Editor Preview flag on or a managed setting already configured. (official)

  A sandbox each developer can switch off is a suggestion; the same settings locked centrally are something you can show an auditor.

  For Security Engineers: Pin filesystem and network access at the org level first, then have one developer confirm the IDE actually renders those controls as locked — the panel is the only feedback that the policy reached the machine. Roll the Editor Preview flag out with it, or the settings stay invisible on every seat that has neither.

MCP

• [2026-09-07] The MCP Python SDK’s 2.2.0 release is mostly authorization work: validate_token_resource checks a token was actually issued for this server, a new issuer= parameter validates the authorization server across every discovery path, and session_idle_timeout= and max_sessions= bound Streamable HTTP servers. One breaking change to plan around — HTTP client redirects are followed only within the endpoint’s own origin, so a cross-origin hop now fails. Tasks, DPoP and JWT-bearer remain unimplemented. (release)

  Audience confusion is the class of auth bug that passes every functional test, because a token minted for a different server still parses and still looks valid.

  For Software Developers: Turn on validate_token_resource and pass issuer= in the same change, then replay a token from one of your other MCP servers against this one and watch it get rejected. Budget separate time for the redirect break: anything whose auth flow hops to another origin stops working on upgrade, not later.

Model releases

• [2026-09-08] GPT-6 Astra is generally available on Amazon Bedrock, five days behind Azure and closing the gap teams buying through an AWS contract were stuck behind. Bedrock takes up to 1 million input tokens, supports implicit and explicit prompt caching, and enforces zero-operator access at the chip; IAM, CloudTrail and VPC endpoints apply, and nothing goes to OpenAI for training. The post names no per-token price. (official)

  You can start evaluating today and still not cost a rollout. A missing per-token figure blocks the budget conversation, not the pilot.

  For Solution Architects: Zero-operator access at the chip, VPC endpoints, CloudTrail and no training on your traffic are the four lines a data-handling review usually stops on, and they now come from the AWS agreement you already signed rather than a fresh one with OpenAI. Reuse the Azure review instead of writing a second.

Agent frameworks & interop

• [2026-09-08] Meta’s Muse puts a personal agent on a dedicated cloud VM and gates its egress with a second agent. A Sentinel process runs on the same machine, isolated from Muse at the system level, and nothing Muse does reaches the internet unless Sentinel approves it. Purchases route through Link by Stripe one-time cards and Meta says Muse never sees passwords. US rollout on iOS, Android and the web; no developer API, and the isolation claims have had no outside review. (official, source)

  Egress through a second process is a pattern plenty of teams already build with an allow-list proxy. Meta’s variant puts a model in the approver’s seat, which moves the question from what the rules say to whether the reviewer can be talked around — and with no API, nobody outside can find out.

• [2026-09-08] LangChain’s argument on multi-agent context is that subagents should not all start blank. Workers and memory agents take mode: fork and inherit the supervisor’s history; verifiers and researchers take mode: isolated, so a reviewer is not anchored by the reasoning it was asked to check. Forking is also claimed cheaper through prompt caching, though the post publishes no numbers. (official)

  Anchoring is easy to miss in practice, because a verifier handed the supervisor’s reasoning sounds better informed and returns agreement you cannot tell apart from correctness.

AI-assisted SDLC

• [2026-09-08] OpenAI’s 1Password case study reports a 20.9% engineering productivity gain and a 10.9% cut in median pull-request cycle time. The $783,750 annual capacity figure printed beside them is modelled rather than measured: 50 consistently active Codex developers, $250,000 loaded cost each, 40% attribution to Codex, 75% realisation. The two percentages are the part worth borrowing. (official)

  Median pull-request cycle time is the rare vendor figure you can reproduce yourself: it comes out of your own repository history, needs no attribution assumption, and either moved after rollout or did not.

• [2026-09-09] Microsoft’s Edge team says extension submissions have outrun its review pipeline and turnaround times have stretched, crediting AI-assisted coding for the volume. Its answer was automating the repeatable validation checks rather than adding reviewers, alongside a Featured badge that now refreshes every 15 days. Anyone shipping a browser extension this quarter should plan for a slower queue. (source)

  Automating the repeatable checks drains the queue fastest for submissions that resemble what the checks already understand. Anything unusual still waits behind the same reviewers, and that is now a longer line.

AI cost tracking & telemetry

• [2026-09-08] The Claude session theft has a vendor-response half now. Anthropic has been emailing subscribers that infostealer malware is lifting Claude login sessions off their machines and burning the quota attached; one user watched 10% of a month’s tokens go on August 4–5 with no work of his own. Sessions were invalidated and a partial refund issued — £44.49 against a $200 plan — but the company declined to hand over itemised usage logs, which is the only thing that would let a customer reconstruct what ran. (source)

  Without per-request logs a refund is a negotiation rather than a reconciliation. Teams that bill AI spend back to projects should find out now what usage export each vendor offers, rather than at the point they need one.

Research worth reading

• [2026-09-08] CapScope answers indirect prompt injection with authorization instead of detection: each agent carries typed capabilities held outside the model’s context, so naming a resource is no longer enough to reach it. Across 300 runs — five Python tasks, five injection surfaces — attack success fell from 33–47 of 75 under the baselines to 3 of 75, with repairs completed 68 of 75 against the baselines’ 68–72. (paper)

  Capabilities held outside the context window do not get weaker when you swap the model, which is what separates this from every prompt-level defence. Watch the repair numbers as closely as the attack ones — blocking an injection by blocking the work is the easy result, and this one avoided it.

• [2026-09-08] Safety judges can be flipped by packaging alone. Wrapping an unchanged harmful reply in a token refusal flips 19.9% of GPT-4o-mini’s correct unsafe verdicts, and an educational-course framing flips 12.3% of Llama Guard 4’s. Claude moved 0.4% and gpt-oss-safeguard-20b not at all. Human review confirmed 90% of the flips were judge errors, across eight judges and 600-plus JailbreakBench replies. (paper)

  Pick the judge before polishing its prompt. A gap between 19.9% and 0.4% on the same packaging trick is wider than any rubric rewrite is going to close.

Watch list

• AWS’s bedrock-agentcore namespace: replacement live, migration guide published, old namespace off September 17 — eight days out.

  Nothing here is waiting on AWS any more, so this stops being interesting the moment a team greps its infrastructure code and build scripts for the old namespace — that is where the last callers usually hide, well behind the application code.

• GitSpawn’s two laggards. Qwen Code 0.22.3 and Grok Build 1.0.13 have now gone eight days without a fix while four peers shipped theirs, and Manifold’s second Claude Code path through ultrareview is still open. A released version number on either one ends this.

  Fixes for a path four peers have already closed tend to arrive as a quiet tag rather than an announcement, so the release feeds are the place to catch these two — a changelog may never mention it at all.

• OpenAI’s misalignment disclosure framework. Promised within weeks on September 5, after the wiki incident; nothing has been published. The artefact to wait for is a written rule naming which agent behaviours get disclosed and on what clock.

  A commitment measured in weeks has no day on which it visibly fails, which is the whole reason to keep a dated line here. Four days in, silence still proves nothing either way.

• Outside review of Muse’s Sentinel boundary. Meta’s security claim rests on one agent approving every outbound action of another on the same machine. A published third-party analysis of that boundary would turn a launch-post assertion into something a security team can weigh.

  Unchallenged launch claims harden into accepted fact over a few months. A teardown naming what Sentinel actually intercepts, and what it waves through, is what would make the pattern worth copying in-house or worth avoiding.