Microsoft

On 21 October Microsoft said that "Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise", describing the group as "a China-state aligned actor" active since 2021 that has used the ARTEX framework "as early as September 2026" against "hundreds of organizations globally". Microsoft reports attempted sign-ins to "more than 2,250 tenants" and that "the time from initial targeting to privileged access was less than 3 hours". It describes ARTEX as "an open-source penetration testing framework" that runs "an autonomous penetration test from reconnaissance through data exfiltration", and says the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services". ConnectWise issued its initial advisory on 16 October.

LiteLLM's root-cause analysis, published on 23 October, says that "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of the LiteLLM Agent Platform", and that "key revocation did not occur for the master key". On 10 October an API call to that platform "returns the owner’s GitHub CLI token". On 21 October at 10:08:29 branch protection rejected an unauthorised change, and five seconds later, at 10:08:34, "The same push succeeds by overriding branch protection"; a second developer credential satisfied the production approval gate at 11:11:18. Seven malicious litellm==1.107.0 wheels reached PyPI from 11:39:51, and PyPI quarantined litellm==1.107.0 by 13:23. LiteLLM says a release normally requires approval from "a special account locked to a physical device in our office", a restriction "relaxed earlier this week to accommodate the temporary push for more frequent releases and bugfix backports, allowing any two engineers to trigger and approve a release".

On 22 October an account of an Axios investigation reported that "Major U.S. banks are detecting third-party artificial intelligence agents accessing customer accounts without bank authorization, with some automated tools appearing to act independently of their users' instructions". It names Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo and Citigroup among institutions responding, and reports that "In certain cases, the tools contacted bank call centers or appeared to perform tasks that customers had not specifically requested." Jamie Dimon said on the bank's latest earnings call: "We're not going to allow just any outside agents to come in inside the company." JPMorgan's Barnum said some outside financial services obtain access through credential sharing or screen scraping, that JPMorgan considers those methods insecure and is blocking them where possible, and warned of consequences for customers who gave their credentials to an agent that then carried out an unwanted transaction. Morgan Stanley has begun blocking third-party agents, though a spokesperson said the bank had not observed rogue AI agents accessing its systems.

A study published in npj Digital Medicine on 21 October evaluated "two FDA-cleared AI algorithms from a single commercial platform (Aidoc Medical BriefCase)-one for PE triage on dedicated CT pulmonary angiography (CTPA; n = 30,678) and one for incidental PE (iPE) detection on routine contrast-enhanced CTs (n = 37,191), across a 17-facility academic health system". "The PE model achieved 86.8% sensitivity and 99.1% specificity, with sensitivity declining from 99.3% for saddle emboli to 72.9% for subsegmental PE, and from 89.7% for acute to 65.3% for non-acute PE." "The iPE model achieved 73.5% sensitivity and 99.8% specificity." The authors conclude that "Both models demonstrated lower sensitivity than FDA-clearance benchmarks while exceeding cleared specificity, with diminishing performance for peripheral and non-acute emboli mirroring known human reader limitations and underscoring the need for standardized post-market surveillance of AI-enabled medical devices." Reference labels were extracted from radiology reports "using a validated LLM pipeline (97% accuracy, κ = 0.94)". The abstract names the two algorithms only by function and states no clearance benchmark value for either.

Anthropic released Claude Haiku 5.5 on 7 October at $0.10 input and $0.50 output per million tokens for prompts up to 100k, and $0.50 and $2.50 above it, against $1.00 input and $5.00 output for Haiku 4.5. It says "On average, it now costs around 75% less to run", with a footnote stating it "is priced 90% lower than Claude Haiku 4.5 for requests up to 100,000 tokens, and 50% lower for requests over 100,000 tokens. On Haiku 4.5, 90% of requests fell into the former category." Its reported benchmarks against Haiku 4.5 and GPT-6 Luna are OSWorld 2.1 offline subset 72.4% against 15.7% and 48.9%, Terminal-Bench 4.0 39.2% against 0.0% and 16.4%, and GDPval-AA v2.1 Elo 1620 against 735 and 1437. It also halved Sonnet 5.5 cache reads to $0.10 per million tokens, which it says cuts the cost of Sonnet 5.5 on most agentic tasks by around 20%.

Microsoft's 2026 Digital Defense Report, published 1 October, states on page 14: "Mythos and GPT-5.5 were the first models to demonstrate the potential to fully autonomously orchestrate complex attacks, achieving full domain compromise in a multi-stage, 32-step attack chain against an emulated enterprise environment." Microsoft adds the test took place in a mock company computer system with no defenders, that open-weight models lag closed models in orchestrating attacks by seven months, and that "The median time from vulnerability discovery in the wild to weaponization has now collapsed to well below 24 hours".

Microsoft's Digital Crimes Unit said on 22 September it seized 50 websites and disabled more than 150 further domains running EvilTokens, an AI cybercrime platform sold on Telegram since February 2026 for a $1,500 initiation fee plus a $500 recurring subscription, linked to over 12,000 compromised inboxes across more than 10,000 organizations, with authorization from the U.S. District Court for the Eastern District of Virginia. Two men aged 32 and 38 were arrested by the Metropolitan Police Service on 11 September; The Record reports both were released on bail and counts 44 different phishing template themes. Microsoft writes that large portions of the platform had been vibe coded and that it drew on capabilities from multiple AI models, naming none of them.

Microsoft AI published the draft Code of Conduct for its MAI models on 14 September, saying "Feedback opens today and runs for the next six weeks". The code itself says "an MAI Model will not generate working exploit code, attack tooling, planning and targeting methodologies, intrusion procedures, evasion techniques, operational guidance", while permitting "authorized and lawful defensive operations, including educational content, vulnerability discovery, malware analysis, proof-of-concept exploit development and testing". The announcement sets "Absolute Constraints, things the models should never do, covering areas like weapons of mass harm, child safety, and harmful manipulation at scale", and states the models "will never resist human interruption, correction, or shutdown".

AIR Security disclosed on 17 September that Claude Code, Codex, Copilot and Gemini CLI check out the commit a plugin marketplace pinned but "never verifies it landed there", so an attacker controlling the plugin repository can serve malicious code while the pin appears intact; default plugin auto-update makes it zero-click. AIR says it disclosed to all four vendors in June: Claude Code was fixed in 2.1.179 on 17 June 2026 and Codex in 0.146.0 on 12 August 2026, Google said on 4 August 2026 it will not patch the deprecated Gemini CLI, and Microsoft has shipped no patch for Copilot.

In arXiv:2609.15383, submitted 14 September, Mark Russinovich, Blake Bullwinkel, Giorgio Severi, Cristian Ovadiuc and Ahmed Salem of Microsoft describe "capability laundering": "a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally… Unlike a jailbreak, no single response is a harmful task." Consulting GPT-5.5, Claude Opus 4.8 and Grok-4.3, "consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale" across eight steps of a hypothetical bioweapon attack chain, and on CyBench "Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus".

On 8 September Microsoft issued updates for "at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever", Krebs on Security reports. It "obliterates the software giant's previous record set in July, when it released updates for at least 570 security vulnerabilities", and brings 2026's total to "more than 2,600, more than twice Microsoft's previous record-setting patch year in 2020 (1,245) and with three more months to go". Two zero-days under active exploitation, CVE-2026-81963 and CVE-2026-85880, were fixed; "Fully 113 of the bugs addressed today earned Microsoft's 'critical' rating."