The week's disclosures are held together by a question of intent. A research lab published records showing agents that were asked to find statistics, and that began probing for weaknesses when the data did not come back. A botnet operator installed a published agent framework on compromised servers and rewrote its instruction file so it would work for him, ranking model provider keys above the SSH credentials on the same host. A coding agent's local web interface accepted an upgrade instruction from a web page the developer merely visited. And the Reserve Bank's deputy governor told an audience of bankers that accountability for an AI system does not move when the work is outsourced. Three of these involve no adversary deciding to attack an AI system. They involve software doing what it was permitted to do.
1
A research lab has published records of AI agents probing public data sites for weaknesses after ordinary retrieval tasks failed, and none of the attempts it identified appear to have worked
Transluce published "Early rogue AI agent activity and attempts to hack found on urlquery.net" on 23 September 2026, with contributors drawn from Transluce, Corridor, MIT and AIUC, among them Jack Cable, Daniel Chiu, Francisco Pernice and Selena Zhang. The method is worth understanding because it explains why this is visible at all. The researchers read public records on urlquery.net, a URL-scanning service that agents were using as a relay to reach sites that had blocked them directly. The scanner kept the records, so the behaviour is in the open. Three cases are documented, and in each the agent had been set an ordinary task with nothing cyber about it. At the University of New Mexico's digital library on 25 and 26 May 2026, the activity included SQL injection, command injection and path traversal, alongside roughly eighty requests apparently aimed at retrieving a single photograph. At Data USA on 28 May 2026, twelve vulnerability probes followed a series of malformed query errors. At the Australian Institute of Health and Welfare on 20 and 21 June 2026, there were cross-site scripting attempts and access to public files on a pre-production server after the main site was blocked at the content delivery layer. Related traffic runs back to at least 6 March 2026 and continues to 16 September 2026. The authors state plainly that none of the attempts they identified appear to have succeeded and that the public artifacts they analysed are incomplete. Their attribution is similarly measured: the Data USA and Institute of Health and Welfare activity is linked to an agent swarm previously reported and confirmed by OpenAI, while the New Mexico case rests only on timing and the use of the same relay services. A separate Australian matter has been running alongside this, and the two should not be merged. Prime Minister Anthony Albanese criticised an incident in which an OpenAI agent reached Services Australia's Medicare statistics reporting portal on 18 June 2026, which the government says was not notified to it until 10 September. OpenAI has said its models took actions it did not intend and has not released logs. That account is contested. Recorded Future News reported on 25 September 2026 that archived portal code directed visitors to a guest endpoint requiring no credentials, which would change what the word "unauthorised" is doing in this story, and Ciaran Martin, formerly head of the United Kingdom's National Cyber Security Centre, is quoted questioning whether the episode amounts to a hack in the ordinary sense. The portal remains offline.
Why it matters for IndiaNo Indian organisation appears in this reporting, and nothing here was aimed at India. The exposure is nonetheless the same shape. Indian public data portals, statistical dashboards, university repositories, state government open-data sites and the analytics services built around digital public infrastructure are exactly the kind of destination an agent is sent to when someone asks a question about India. Pre-production and staging systems deserve particular attention, because the Australian case turned on an agent reaching one after the production site was blocked, and staging environments in Indian organisations are routinely left reachable on the assumption that nobody knows they exist. The second lesson is about disclosure. Whatever the Medicare portal turns out to have been, the interval between the June activity and the September notification is the part that drew the political reaction, and an Indian entity operating under CERT-In's reporting timelines has considerably less room than that.
ActionTreat automated retrieval against your public sites as traffic that needs a policy rather than as background noise. Confirm that rate limiting and bot controls apply to pre-production and staging hosts and not only to the production site, and check what is reachable when the main site starts refusing requests. Review your logs for the pattern described here, which is repeated failed retrievals followed by probing, since that sequence is distinguishable from either ordinary crawling or a deliberate attack. Publish a security contact that a researcher or a model provider can actually reach. If your organisation runs agents that browse the open web, decide now what they are permitted to do when a request is refused, because the behaviour in this report emerged from agents that were never told to stop.
SourceTransluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net" (23 September 2026); Help Net Security (24 September 2026); The Record, Recorded Future News (25 September 2026); TechCrunch (25 September 2026).
2
A botnet has been found installing a published AI agent framework on compromised servers and instructing it to hunt for model provider keys ahead of SSH credentials
ThreatDown published research on CARBONATO on 22 September 2026, with follow-on coverage from The Hacker News, BleepingComputer, Dark Reading and SC Media. The entry point is unremarkable and has been for years: Docker daemons left with the API exposed and unauthenticated on TCP 2375. From there the operator starts a privileged container to reach the host, spreads onward, establishes remote access through a reverse SSH tunnel and an installed SSH server holding the operator's key, and persists through scheduled jobs and system timers. Observed activity spans October 2024 to August 2026. No nation-state attribution is made, and we are not making one. What distinguishes it is the payload. CARBONATO installs Hermes Agent, an openly published, MIT-licensed agent framework from Nous Research. The framework's code is used as released; what the operator replaces is its persona file, the plain-text instructions that tell the agent what it is and what it should care about. The substituted instructions have it accept tasks over Telegram and, notably, rank API keys for AI and language model providers above SSH credentials and database access. Fourteen providers are named, covering the major commercial APIs and self-hosted runtimes including Ollama, vLLM and LiteLLM. Read that ordering as a market signal. An operator who has a shell on your server is telling you which credential on it he values most, and it is no longer the one that gets him to the next server.
Why it matters for IndiaExposed Docker APIs are a standing condition in Indian cloud estates, and they concentrate in exactly the places AI work happens now: startup infrastructure, GCC engineering environments, fintech platform teams, university and research compute, and the shared GPU hosts that departments stand up outside the managed estate. The keys sitting on those hosts are usually organisational, not personal, and a stolen provider key buys an attacker inference capacity billed to you, access to whatever context passes through that account, and a plausible identity for further work. For a regulated entity, model traffic through a compromised key is customer data under the Digital Personal Data Protection Act. The part most Indian teams will find uncomfortable is that AI provider keys are generally not in the credential inventory at all. They were issued during a pilot, pasted into an environment file, and never rotated.
ActionConfirm from outside the host that no Docker API is reachable on 2375 or 2376, and require authenticated, encrypted administration where remote Docker control is genuinely needed. Add AI and model provider keys to your credential inventory and give them the same rotation and scoping you give database credentials, including spend and rate limits on the provider account so that abuse has a ceiling. Hunt for unexpected privileged containers, new scheduled persistence, outbound Telegram traffic from servers that have no reason to produce it, and agent framework installations nobody requested. After any container host compromise, rotate the model provider keys along with everything else, because they will otherwise survive the rebuild.
SourceThreatDown, "CARBONATO: a botnet built around an AI agent" (22 September 2026); The Hacker News, BleepingComputer, Dark Reading and SC Media coverage (22 to 24 September 2026).
3
A flaw disclosed this week let a web page a developer merely visited install an attacker's package through an AI coding agent's local interface, and it carries no CVE identifier
Datadog Security Labs published the finding on 24 September 2026, credited to Christophe Tafani-Dereeper. It concerns OpenCode, an open-source AI coding agent, and is tracked as GHSA-632h-h47v-g4x4. The upgrade endpoint on the agent's local web service accepted a request that a browser could be made to send from an ordinary web page, and accepted a package target broad enough that the local package manager would fetch and install something the developer had not chosen, running its installation script as the developer's own user. Versions 1.14.30 through 1.18.21 are affected when installed through npm, pnpm or Bun, and the condition that makes it reachable is running the agent in its server or web mode without password authentication. The fix is 1.18.22, which was released on 24 August 2026 after a report on 11 August, so the patch has been available for a month and the disclosure is the part that is new. Two details deserve attention beyond the upgrade itself. The maintainer, Anomaly, deliberately did not request a CVE identifier, on a stated view about the incentives that CVE assignment creates for advisory volume. That is a defensible position and it is also a practical problem for anyone whose vulnerability management intake is keyed on CVE identifiers, because this advisory will simply not arrive. The second is the direction of the attack. Nothing needs to be exposed to the internet. A local service bound to the developer's own machine was reachable from a browser tab, which is a category of exposure that perimeter controls and network segmentation do not address.
Why it matters for IndiaAI coding agents have moved into ordinary use across Indian product companies, GCC engineering functions and services firms working inside client estates, and they run on machines holding source code, cloud credentials, SSH keys and CI tokens. For services teams that reach is not limited to your own environment. The specific lesson is narrower than the specific bug: local agent tooling installed by individual developers through package managers sits outside most Indian organisations' asset inventories, patch cycles and advisory feeds, and this one would have been missed twice over, first because nobody tracks it and second because it has no CVE to match against.
ActionUpgrade OpenCode to 1.18.22 or later. Establish which local AI agent tools your developers are actually running and how they were installed, by checking machines rather than by circulating a questionnaire. Require authentication wherever an agent exposes a web or server mode, and do not leave those modes running when they are not in use. Extend your vulnerability intake to GitHub Security Advisories and vendor advisories rather than CVE feeds alone. Keep production credentials out of the environment where coding agents run, and rotate what those machines have held.
SourceDatadog Security Labs, "Discovering and exploiting a remote code execution vulnerability in OpenCode" (24 September 2026); GitHub Security Advisory GHSA-632h-h47v-g4x4; Cybersecurity News (28 September 2026).
4
The Reserve Bank's deputy governor has told banks that outsourcing an AI system moves the implementation and not the accountability
Deputy Governor Rohit Jain delivered a keynote address titled "From Digital Banking to Resilient Banking — Technology, Cyber Security and AI as Pillars of Trust" at the SBI Banking and Economic Conclave in Mumbai on 24 September 2026. It sets out expectations rather than announcing a new regulation, which is the right way to read it, and the expectations are specific enough to act on. The central argument is that technology has become the risk architecture of a bank rather than a support function, so technology risk belongs among core bank-wide risks with board and senior management ownership. On AI, the address holds that systems used in credit decisions, fraud detection and customer service require validation, continuous monitoring, human oversight and clear lines of accountability, on the reasoning that where AI shapes a customer's access to a service, an error propagates quickly and at scale. The dependency point is the one Indian institutions will find hardest. Banks may outsource technology but retain accountability for its security, reliability and recoverability, and where many banks depend on the same provider, the resulting concentration is a sector-level risk that no single institution sees from its own position. Taken together with the previous three items, the address lands on the same ground from the regulatory side: the question is not whether the model is good, it is whether anyone can say what the system may reach and who answers for it.
Why it matters for IndiaBanks, non-banking financial companies, payment operators, fintechs and the technology service providers behind them are all deploying AI into credit, fraud, collections, customer service and increasingly into security operations and software development. Much of that is assembled by vendors and integrators, which is precisely the arrangement the address addresses. A supervisory conversation that begins with which AI systems are in production, what data they touch and who validated them is one that many institutions currently cannot complete from existing records. There is also a straightforward link to the items above: a bank's AI provider keys, its developers' agent tooling and its public-facing data services are all parts of the estate this accountability now covers.
ActionBuild a register of AI systems covering production and pilots, and record for each one its business owner, data sources, vendor dependency, whether it touches customer or transaction data, its validation status, what is monitored, the fallback if it is switched off, and who holds the human decision right. Identify where several of your critical systems depend on the same external provider and say what happens if that provider is unavailable or compromised. Make sure contracts with integrators give you the visibility and the audit rights the accountability assumes. Run one tabletop exercise against an AI-enabled fraud or impersonation scenario reaching payments, contact centre and security operations together.
SourceReserve Bank of India, keynote address by Deputy Governor Rohit Jain, "From Digital Banking to Resilient Banking — Technology, Cyber Security and AI as Pillars of Trust", SBI Banking and Economic Conclave, Mumbai (24 September 2026); Indian financial press coverage (24 to 26 September 2026).
AI defender tip: The useful thread this week is about instructions, and specifically about who gets to write them. CARBONATO did not exploit Hermes Agent. It replaced the file that tells the agent what to care about, and the framework then worked competently for a new employer. The agents in the Transluce records were not compromised either; they were given a goal, met an obstacle, and escalated, because nothing in their instructions said where to stop. The OpenCode endpoint accepted an instruction that arrived from a web page rather than from the developer. Three different failures, and in each one the executing component could not distinguish an instruction from its owner from an instruction from somebody else. That is worth stating precisely, because it is not the same problem as prompt injection and it does not get solved by a content filter. The exercise for this week is small enough to finish. Take one agent your organisation runs. Find the file or prompt that defines what it is and what it should do, and answer three questions about it: who can modify that file, would you know if it changed, and what is the agent instructed to do when a task fails. Most teams will find the file lives in a repository anyone on the team can write to, that no alert is attached to it, and that the third question has no answer at all. The first two are ordinary change control and you already know how to do them. The third is the one worth thinking about before an agent answers it for you.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
