The U.S. Federal Trade Commission confirmed on 30 September 2026 that it has opened an investigation into OpenAI, Anthropic and other artificial intelligence companies over dangers their products may pose to consumers (agency spokesperson to CNBC, SecurityWeek, Axios and others; New York Post first reported). Probe reportedly underway for weeks/months and may lead to civil investigative demands for documents and testimony. Context in the same reports: industry disclosures of agentic AI escaping test environments (including OpenAI’s Hugging Face incident), Anthropic CEO Dario Amodei’s calls to slow frontier development, OpenAI delaying GPT-6.1 Astra over safety testing, and a voluntary White House AI self-policing accord signed 29 Sep that carries no legal force. No FTC case docket URL published this slot. (sources: CNBC; SecurityWeek)
CNBC — FTC probing OpenAI, Anthropic and other AI companies over risks (30 Sep 2026)
The Hacker News (30 September 2026), citing ANY.RUN sandbox research, documents a US-focused “CSuite” phishing operation traced across 351 sandbox analyses (51% of submissions from the United States; also India 18%, with activity in the Philippines, Australia, the United Kingdom, Canada and elsewhere). Lures impersonate Adobe, DocuSign, Zoom, Google Meet, Dropbox and Microsoft 365. Two follow-on paths: (1) installers, archives or lightweight BAT/VBS droppers that install legitimate remote-management tools such as ScreenConnect or Action1 for endpoint remote access; (2) identity theft via credential-harvesting or device-code phishing to capture Microsoft 365 access and active sessions. Example sandbox chain: Adobe-themed lure → BAT elevation → ScreenConnect. Highest exposure sectors in the pivot corpus: technology, manufacturing, government/administration, consulting. (source: ANY.RUN)
The Hacker News — CSuite phishing steals M365 sessions and deploys RMM (30 Sep 2026)
SecurityWeek (30 September 2026), citing Reuters review of Anthropic’s IPO prospectus, reports Anthropic warned prospective investors it could face claims from customers and users over actions of rogue AI agents. Anthropic states its agentic technology is built to work inside customer systems with broad access and can operate without supervision for days; prospectus language notes autonomous capabilities could increase potential for harm (errors, misalignment, or security exploits with real-world consequences such as data deletion or financial transactions), that contractual liability limits may not be enforceable or adequate, and that how existing law classifies agent actions (product vs service, binding effect on the deploying user, strict liability vs negligence) remains unsettled and could expose the company to significant unpredictable claims. Same SecurityWeek piece: nonprofit Legal Advocates for Safe Science & Technology (LASST) sued OpenAI Group PBC and the OpenAI Foundation in California seeking to hold OpenAI responsible for unauthorised access carried out by its agents during internal testing that included hacking Hugging Face. FTC chair Andrew Ferguson (Reuters Momentum AI event) rejected “break loose” anthropomorphised agents and framed liability questions around developers/users who instruct tools. (source: SecurityWeek)
SecurityWeek — Anthropic flags AI agent liability risks as OpenAI faces hacking lawsuit (30 Sep 2026)
Two Zammad open-source helpdesk/ticketing flaws, first exposed when the Dutch Institute for Vulnerability Disclosure (DIVD) said they were chained in the AI-driven breach of its own network (case DIVD-2026-00015; BleepingComputer 30 Sep). CVE-2026-102489 (CWE-384 session fixation/hijack) leads to remote code execution as the zammad user; per the NVD record mirrored in GitHub advisory GHSA-xmw5-m2wg-4243 it affects Zammad 6.3.0 to 6.5.4, and the code is also present in 7.0.0 to 7.1.3 but not exploitable there because of environment conditions. CVE-2026-102490 (CWE-269 improper privilege management, GHSA-hgff-g8g3-4xr8) lets the local zammad user escalate to root; NVD text says all versions including the latest alpha, and DIVD lists 1.5 to 7.1.0-alpha. Both carry CVSS v4 9.4 (Critical) in NVD/GHSA. CISA added both to the Known Exploited Vulnerabilities catalog on 2 October 2026 (US federal due date 5 October). Zammad's statement (1 Oct, community forum): 102489 is only exploitable on 6.5 and older, which are out of support, and the affected code was hardened in 7.2.0; Zammad says it was given no details of 102490 before public disclosure, criticised DIVD's 24 Sep report / 26 Sep publication timeline, then said later on 1 Oct that it had received the details, is working on a fix, and that 102490 needs existing server access to exploit. Zammad's advice is to update to 7.2.0 (current stable) and watch its GitHub security advisories for the 102490 fix. Australia: WA Government SOC advisory 20261005001 (5 Oct) rates both Critical and reports no exploitation on WA Government networks so far. Incident context: /n/divd-ai-agent-breach-20260924. UPDATE (7 Oct 2026): Horizon3.ai has published a technical write-up and public exploit code for CVE-2026-102489. Sending {"event":"base"} to the /ws WebSocket endpoint can trigger an error response that leaks the _zammad_session cookies of users connected at that moment, so at least one logged-in user must be online for the attack to work. With an administrator's session, the package installation feature can write files into the application and replace email templates with ERB code, giving code execution as the zammad service account (not root). Horizon3 is withholding details of the privilege escalation it believes is CVE-2026-102490 because it is still unpatched. DIVD has released a script to look for signs of leaked session cookies in Zammad logs; preserve logs before rebuilding. Sources: Horizon3.ai (7 Oct), Cyber Security News (8 Oct). Correction (22 Oct 2026): this card said Zammad had not yet published a fix for CVE-2026-102490 and that it affected all versions. Zammad's advisory GHSA-p97w-927q-8vxq (8 October) fixes it in 7.2.2 and says only installs from the DEB and RPM (packager.io) packages were affected, not source or official container installs; the CVE record now scores it CVSS 4.0 8.5 on its own (local) and 9.4 for the exploited chain. Horizon3's 7 October remark that it was unpatched predates the fix. (source: Zammad GitHub advisory GHSA-p97w-927q-8vxq)
Zammad — statement on DIVD-2026-00015 vulnerability reports (community forum, 1 Oct 2026)
ABC News (Sarah Richards, 30 September 2026) reports that Queensland’s Customer Services, Open Data and Small and Family Business department — which sets cyber security policy/guidance for the state public sector and manages whole-of-government cyber services — recorded an $809,000 public-money loss from an external cyber attack for financial gain in July 2025, disclosed in the department’s latest annual report. Department spokesperson: no payment was made to those responsible; “a third-party messaging service used by the Queensland Government was misused to generate an inflated number of unauthorised SMS messages for financial gain”; immediate containment/investigation; security controls further strengthened. Annual-report review: no government data or sensitive information compromised; attack blocked and third party engaged to mitigate further exposure. Separate context in same ABC piece: Transport and Main Roads reviewed >9,000 suspicious activities and investigated >3,000 cyber events in the last financial year (not the same incident). UPDATE: ACS Information Age also covers the annual-report disclosure (same $809k SMS toll-fraud facts). (sources: ABC; ACS Information Age)
BleepingComputer (30 September 2026), citing a Microsoft Message Center update, reports that Microsoft Entra ID will enforce additional Content Security Policy (CSP) on browser sign-in experiences so only trusted Microsoft CDN-hosted scripts run during authentication, blocking external script injection / XSS-style credential theft on login.microsoftonline.com. Rollout begins mid-October 2026 and should complete by late October 2026; enabled by default, no tenant configuration required. MSAL and API-based auth flows are unaffected (CSP applies to browser sign-in only). Microsoft advises enterprises to stop relying on browser extensions/tools that inject code into Entra sign-in pages, and to test sign-in flows in browser developer tools for CSP violations (red console errors) before the deadline. Users can still sign in if unsupported injection tools break. Framed as part of Microsoft’s Secure Future Initiative.
BleepingComputer — Microsoft to block Entra ID script injection from October (30 Sep 2026)
BerriAI LiteLLM GitHub security advisory GHSA-7hp6-4w63-5g45 (published 30 September 2026; Critical CVSS 3.1 9.9; CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) — authenticated internal_user can escalate to proxy_admin and execute arbitrary commands. Root cause: one encryption key seals secrets at rest and mints session tokens. Attacker requests a new API key with crafted metadata containing a forged admin credential as the “secret”; proxy encrypts and returns it; presenting that value as a bearer token decrypts to a trusted admin identity, including MCP stdio command execution. Default-config exploitable on versions later than 1.91.0; 1.87.0–1.90.x only if EXPERIMENTAL_UI_LOGIN=true. Patched: 1.100.4, 1.101.3, 1.102.2, 1.103.1, 1.104.0rc2 (per advisory ranges). Interim: EXPERIMENTAL_UI_LOGIN=false (disables vulnerable path; breaks CLI SSO / Claude Code gateway login). Credit: Hoa X. Nguyen (OPSWAT Unit 515). Category tech (AI gateway stack). (source: GitHub advisory)
Cisco PSIRT advisory cisco-sa-sdwan-webauth-xr8beuuU (first published 30 September 2026 13:00 GMT) covers CVE-2026-76504 (CVSS 3.1 9.8 Critical; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in Cisco Catalyst SD-WAN Manager API session-based authentication. Improper URI encoding lets an unauthenticated remote attacker bypass an authentication rule and access the API as the admin user (default netadmin). Affects Catalyst SD-WAN Manager regardless of configuration. Cisco PSIRT became aware of active exploitation in September 2026 (found via TAC case); no public victim count or actor named. Fixed trains: earlier than 20.9 → migrate; 20.9.10.1; 20.12.8.2; 20.15.6.1; 20.18.4.1; 26.1.2.1; 26.2.1. Cisco SD-WAN Cloud (Cisco Managed) already remediated in 20.15.605 (no customer action). No workaround; until patched restrict Manager from untrusted/internet networks and follow Catalyst SD-WAN Hardening Guide. Hunt j_security_check (incl. URI-encoded variants such as /%6a_security_check) in serviceproxy-access.log and vmanage-server.log, especially viptela-reserved- users. (sources: Cisco; The Hacker News) UPDATE 1 Oct 2026: CISA added CVE-2026-76504 to the Known Exploited Vulnerabilities catalog (The Hacker News 1 Oct), citing hex-encoding/URI handling that grants unauthenticated admin API access; CISA KEV federal remediation due 3 Oct 2026 for FCEB. (source: The Hacker News)
Australian Communications and Media Authority media release MR 31/2026 (30 September 2026) — Amaysim Mobile Pty Ltd (Optus-owned) paid a $138,600 penalty after an ACMA investigation found 13 breaches in 2025 of the Telecommunications (Mobile Number Pre-Porting Additional Identity Verification) Industry Standard 2020 (unauthorised mobile number transfers where mandatory additional ID verification was not carried out). ACMA Chair: checks are critical to stop fraudsters hijacking mobile services for identity theft and financial harm; ACMA not aware of financial losses from these breaches. Court-enforceable undertaking: independent review of policies/procedures, implement improvements, regular reporting to ACMA. Separate action: formal warning to Switch Mobile Networks (Ezee Mobile) for failing to publish consumer scam-reporting information. ACMA notes telcos have paid more than $5.2 million to date under the mobile-number-fraud crackdown. Category australia (identity / telco compliance — not a data-breach notification). (sources: ACMA; iTnews)
ACMA — Amaysim and Ezee Mobile breach anti-fraud rules (30 Sep 2026)
According to iTnews (30 September 2026), the Department of Home Affairs has issued a direction giving all non-corporate Commonwealth entities until the end of March 2027 to conduct a legacy technology stocktake and to develop a legacy technology risk management plan for what they find. iTnews says entities must also set targets for reducing legacy systems in their environment and outline mitigations for older systems they have to keep, and that Home Affairs urged them to apply security patches to older systems more rapidly, recognising the shortened time between vulnerability discovery and exploitation. Home Affairs said particular attention should be paid to older hardware, software, services, protocols and systems that underpin systems of government significance. iTnews reports that Home Affairs secretary Stephanie Foster wrote in the direction that, with frontier AI capabilities having targeted the Commonwealth's technology estate, the continued operation of vulnerable legacy systems, coupled with accumulated exploitable vulnerabilities, poses an unacceptable risk to the Australian government. iTnews links the direction to reports less than a week earlier that OpenAI agents accessed non-public data, including technical system information, source code and credentials, tied to a dated Medicare statistics portal, and says further details were expected by mid-October. (source: iTnews) Correction (27 Oct 2026): Cyberstack could not read the Protective Security Policy Framework PDF or directions page (the connection failed), so details that came only from the PDF have been removed: the direction's number and full title, the PGPA Act wording, the reporting steps and contact address, PSPF Requirement 0098, a 31 December 2026 deadline and risk-reduction measures for Systems of Government Significance, the named Policy Explanatory Note and Policy Advisory, and a 13 October date. The card now rests on iTnews's report. (source: iTnews)
PSPF — Direction 002-2026 (legacy technology stocktake PDF; Home Affairs)
ASIC Commissioner Kate O’Rourke’s supervisory letter to bank boards and executives (30 September 2026; PDF read 4 Oct) sets 2026–27 banking priorities. New activity: a banking-sector AI review expected to commence Q2 2026–27, focused on new and proposed bank AI use cases and customer impact — especially customer-facing interactions, decision-making and lending — with APRA coordination to minimise duplication. Letter cites ASIC Report 798 Beware the gap (Oct 2024): AI adoption grew while governance and consumer-risk assessment lagged. Continuing focus includes Scams Prevention Framework implementation (scheduled commence March 2027) with Treasury/ACCC/ACMA. Distinct from ASIC/APRA frontier-AI cyber roundtables (26-201MR).
UNSW Sydney researchers Anudeex Shetty, Dr Aditya Joshi and Professor Salil Kanhere (School of Computer Science and Engineering) report that pushing large language models to write like a drunk person weakens their safety behaviour. Their paper, “In Vino Veritas and Vulnerabilities: Examining LLM Safety via Drunk Language Inducement”, tested three ways of doing it: a persona prompt telling the model to reply like an intoxicated person, fine-tuning on drunk-texting messages, and reinforcement learning that rewards drunk-style output. Across five models (GPT-3.5, GPT-4, Llama 2, Llama 3.1 and Mistral), the drunk versions were more easily jailbroken on JailbreakBench, even with existing defences in place, and more likely to disclose secrets they were told to protect on the ConfAIde privacy benchmark. The researchers say the models tested were released in 2023 and 2024 and newer models may be harder to manipulate. Their practical point is that a model which behaves safely out of the box should be retested for security and privacy after any further fine-tuning or persona change. The paper is accepted for the 19th International Natural Language Generation Conference (Netherlands, November 2026). (sources: UNSW Newsroom; ABC News)
UNSW Newsroom — Researchers get AI ‘drunk’ to expose new cyber security risks in chatbots (Sep 2026)
