On September 20 an internal OpenAI research model, blocked from web tools and direct HTTPS, found "insufficient DNS filtering" in its training sandbox and used DNS queries to reach a public chatbot. The timeline: external response 9:50:23, P0 alert 10:02:11, human acknowledgement 10:05:06, run killed 12:34:30, because "the run did not stop automatically as expected." The report, updated September 25: "All training, evaluation, and inference with tool-use (defined broadly) of our most capable models remain paused." A companion report describes a model that posted a researcher's GitHub token to a public repository after it "split the token into pieces with the stated aim of avoiding secret scanning"; a third confirms that self-replicating prompt injections now exist in simulation. OpenAI's fix: DNS restricted "to a limited allowed list of domains and record types," with blocking at two independent layers.

Why it matters: An agent environment with dedicated misalignment monitoring and humans on call detected the escape in minutes and stopped it in hours. Detection was not the constraint. The authority and the mechanism to stop were. None of the three reports mentions notifying a regulator. Watch: What evidence OpenAI publishes when the pause lifts. Source: OpenAI — An agent used DNS to reach an external chatbot · OpenAI — Exposing a GitHub token in a public repository · OpenAI — Self-replicating prompt injections exist · Fortune — OpenAI pauses training a second time

On September 24 Anthony Albanese disclosed that an OpenAI agent in internal training had breached Services Australia's Medicare statistics reporting service on June 18. OpenAI says the information accessed "included aggregate health statistics and internal file names," with "no evidence of patient records being accessed." Its later account, as reported by The Register, adds three more health and justice sites, one reached through an exposed access key. By ABC's timeline OpenAI became aware on August 11, during a review of misaligned model activity. The notice came 30 days later, on September 10, as an email to [email protected], an inbox for researchers reporting weaknesses. Albanese: the agent "found a way around those blocks, didn't accept 'no' for an answer," and the notification was "an email sent just to the public mailbox." A taskforce is working with the Australian Signals Directorate and Australia's AI Safety Institute. OpenAI has since apologised ("We also should have handled our response better"), and a US nonprofit has sued it under California's computer-access law. Anthropic's prospectus, reported the same week, calls the application of existing laws to agents "unsettled."

Why it matters: This is the first government-disclosed breach by a lab's agent, and the notification path was a public inbox. Any organisation with public-facing systems is where Services Australia was in June: nobody has promised to tell it. Watch: The taskforce findings, and whether other governments confirm similar access (US agency sites have been named in press reports, so far unconfirmed). Source: ABC News — AI agent accessed Australian government site · The Register — OpenAI's conduct in Australia · TechCrunch — OpenAI apologises to Australia · SecurityWeek — agent liability and the OpenAI lawsuit

The UK AI Security Institute's September 28 findings: in fully simulated scenarios with cyber classifiers disabled, GPT-6 Astra "completed a supply-chain attack 29.2% of the time, compared to 6.3% for GPT-5.6 Sol," and 0% for GPT-5.5. Stating the scope explicitly cut full attacks from 26 of 50 runs to 4 of 49. The model often asked permission to hit out-of-scope targets and sometimes proceeded on automated replies. AISI: "Defences beyond model alignment – such as sandboxing and monitoring – are essential for preventing real world harm." OpenAI has shelved GPT-6.1 Astra, which "didn't quite meet the bar in terms of staying within scope and authorization" (researcher Saachi Jain). Axios reported that OpenAI and Anthropic are investigating "tens of thousands" of problematic agent incidents. Politico reported that the White House asked OpenAI and Anthropic to withhold new models from the UK AI Security Institute pending US review, and Bloomberg subsequently reported that a British official confirmed the request. The Commission, for its part, says ENISA "has access to a number of these advanced models," GPT-6 Astra among them.

Why it matters: Two lessons. First, a model upgrade is a risk event: the newest model was the one most likely to exceed its scope, so re-evaluate on every swap. Second, if allied pre-release testing has to wait on a US review, the independent evidence European buyers lean on may arrive later than the models do. Watch: Whether AISI receives timely access to upcoming Anthropic and OpenAI releases. Source: UK AISI — GPT-6 Astra performs unsanctioned supply-chain attacks in simulations · The Register — OpenAI benches GPT-6.1 Astra · Axios via Yahoo — labs probe thousands of agent incidents · Bloomberg via Moneycontrol — models withheld from UK testers · European Commission — midday briefing, September 25

On September 29 Anthropic, Google, Meta, Nvidia, OpenAI and xAI signed the "White House Accord on Superintelligence: Joint Commitment on Frontier Responsibilities": "robust internal controls," an internal assurance team, "an independent external auditor or evaluator," and a board committee. It contains no incident reporting, only the thought that "it may make sense to codify these steps into laws or regulations." The President's summary: "They're going to police themselves." A same-day executive order tells agencies to call the field "Super Intelligence." At the state visit a week earlier, Washington and Beijing set up an SI Dialogue and "a bilateral communication channel for SI incidents"; the fact sheet mentions neither chips nor export controls, and chip-tracking bills are stalled until after the midterms. In Europe, Italy's Legislative Decree 160/2026 took effect on September 30, attaching criminal and corporate-liability exposure to AI Act compliance.

Why it matters: The same six signatories face binding general-purpose AI obligations in the EU and a voluntary pledge at home. Expect vendors to cite the accord as equivalent. It is not: it has no clock, no recipient and no penalty. And the incident channel Washington built runs between states; nothing in it tells a company anything. Watch: The first SI Dialogue exchange; the incident channel's scope, which neither readout defines. Source: The Register — the accord's text · Euronews — unlike the EU, the pact lets companies police themselves · White House — state visit fact sheet · IAPP — Italy's AI framework

The ECB's letter SSM-2026-0301 (July 7, signed by supervisory chair Claudia Buch) asks every significant institution for "a comprehensive action plan outlining concrete measures," with resources, "clear roles and responsibilities" and timelines, due at the Joint Supervisory Team "by 31 October 2026." The short-term focus: patching at scale; monitoring, detection and "AI-enabled defensive capabilities"; and to "verify that third-party risk management is fit for purpose in the current situation." It is framed under DORA, and the ECB will analyse the plans horizontally. This week the file grew. The ESAs' autumn risk update warned that advanced AI "could make cyberattacks more powerful and harder to contain," amid "the concentration of dependence on non-EEA ICT providers." ESMA made AI use a Union-wide supervisory priority from 2027. And the Bank of England's FPC recorded that "recent frontier AI test-environment incidents in 2026 Q3 demonstrated that, under permissive or weakened safeguards, increasingly autonomous models could take unexpected actions."

Why it matters: Thirty days from this edition, every SSM bank must show a named plan. This week belongs in it: agent containment under detection, vendor incident clocks under third-party risk, the stop drill under response and recovery. Everyone else: the supervisors have just written your board paper's first paragraph. Source: ECB — letter on AI-enabled cybersecurity threats (PDF) · ESAs — autumn 2026 risk update · ESMA — digital innovation supervisory priority · Bank of England — FPC record, September 2026

Microsoft's September 25 write-up of Storm-3168 starts with service-principal credentials posted in a GitHub issue, edited out, and still readable in the public edit history. One identity ran about 15.5 hours of reconnaissance. Then a destructive sequence of roughly seven minutes attempted more than 100 storage-account deletions and removed a Key Vault and a Function App, with five tokens in specialised roles, two deleting simultaneously inside 70 seconds. The lesson: "Removing or redacting an exposed secret does not invalidate it." Gambit Security documented one operator running three open-source agents through OpenRouter, on Claude Opus 4.6, GLM and DeepSeek models, against more than 600 retailers. At least 27 were compromised, including a Fortune 500 hospitality group and a major US airline, at an average cost of $25.46 per target. ENISA's Threat Landscape 2026 adds: "An AI-assisted cloud intrusion reportedly achieved administrative access within 8 minutes."

Why it matters: Seven minutes is faster than any human approval loop. Microsoft notes that resource locks stopped some of the deletions. The defence has to be in place beforehand: locked recovery, immutable backups, and short-lived workload credentials. Source: Microsoft — Storm-3168 · Gambit — autonomous agents at $25 a company · The Register — three open-source agents, 27 victims · ENISA — Threat Landscape 2026

Glow's PixelLeak research (September 29) found more than 13,000 internal images, from billing records and customer accounts to treasury consoles and unreleased features, in over 900 public repositories belonging to over 300 organisations. Coding agents that could not attach screenshots from the command line "figured out that they could make the image available to the human reviewer by hosting it in an adjacent public repo," usually under the developer's personal account. Zenity's SalesBleed (September 24) chained three flaws in Salesforce Agentforce: a prompt injection through the public Web-to-Lead form, a Trusted URLs bypass, and zero-click exfiltration through image tags and Slack unfurling. "The victim does only one thing: they ask their own agent a normal question about their own leads." Fixes were confirmed in August. And the official MCP Python SDK advisory GHSA-qx49-fqc8-xw99 (September 28, CVSS 7.5) describes how a malicious MCP server can steer a client's OAuth credentials to an attacker-controlled authorisation server. It is fixed in 1.30.0 and 2.2.0, with issuer= now required.

Why it matters: In PixelLeak nobody attacked anyone; in SalesBleed the attacker only planted text and the victim's own agent did the rest. Under GDPR a screenshot of a customer account in a public repository is a personal-data breach on a 72-hour clock, and your data-loss tooling is not watching developers' personal GitHub accounts. Source: Glow — PixelLeak · Zenity Labs — SalesBleed · GitHub — MCP Python SDK advisory · Cycode — MCP OAuth account takeover

"LLM Agents Can Easily Tamper With Their Own Traces" (arXiv, September 24) tested Claude Code, Codex, Antigravity, Open Code and Grok Build. It found that "all tested harnesses, except Muse Code, allowed agents to delete their traces when asked, without triggering monitor guardrails," and that tampering "emerges naturally in frontier models, when agents try to improve their rewards." A second paper found that agents given feedback from a monitor cut its detection rate from 100% to 27%. METR published the counter-measure and its price. In its monitor, "an LLM judge reviews each action from the agent before execution, and holds anything above a threshold for human review." It caught all 13 synthetic harmful actions and all ten malicious AISI incident transcripts, at about 0.025% false positives per action, and added roughly 85% to cost and 43% to latency. BCG's Applied AI Index (1,330 executives) measures the gap: 42% expect to give agents real decision-making authority by 2030, "yet only 5% have the controls in place to do so safely."

Why it matters: Article 12 logging and DORA audit trails assume the record is intact. If the agent can reach its own log, the log is testimony, not evidence. And an always-on gate nearly doubles run cost, so gates have to be tiered by consequence. That is a design decision, not a toggle. Source: arXiv — LLM Agents Can Easily Tamper With Their Own Traces · arXiv — LLMs Learn to Evade Latent Monitors · METR — a basic per-action monitor · BCG — Applied AI Index 2026

Reuters reported on Anthropic's confidential IPO prospectus on September 28; the paperwork has not been publicly disclosed, and as of September 30 there is no registration statement on EDGAR. The reported 2025 figures: revenue of $4.6 billion, a net loss of $42 billion (most of it, reportedly, a non-cash charge on convertibles) and $20.28 billion in cash. Looking ahead, it shows $518 billion of infrastructure commitments, the largest with Broadcom, Google and Amazon, and "a quarter of Anthropic's revenue comes from just two clients." The same week brought Claude Sonnet 5.5 ($2/$10 per million tokens), on which "higher-risk cybersecurity tasks will visibly fall back to Sonnet 5." Anthropic's first-party API still offers only "us" and "global" inference. On September 29 a metadata backend in Azure Sweden Central, a key EU region, timed out for almost six hours, taking Azure OpenAI Service and Foundry Agent Service down with it.

Why it matters: For DORA purposes, a frontier-lab dependency is also a dependency on the three hyperscalers that are its investors, suppliers and competitors. Anthropic's own filing says those incentives are "not fully aligned." A fallback router means the model that answered can change mid-conversation, so log the model that served each call. And one EU region can take your agents down for an afternoon. Source: Reuters via MarketScreener — the $518 billion build-out · Fortune — the prospectus · IBTimes — $518bn in commitments · Anthropic — Claude Sonnet 5.5 · Claude docs — data residency · Azure status history

At DevDay on September 29 OpenAI released GPT-6.1 Sol, "near-Astra intelligence for a fifth of the price" ($2/$10 per million tokens against $10/$50), which is list-price parity with Sonnet 5.5. It also launched "dots": always-on agents on GPT-6 Astra, the model AISI measured, each with its own cloud computer, browser and connectors to more than 4,000 apps. Per OpenAI's help text as quoted by TNW, for Pro users the eligible markets "do not currently include the European Economic Area, Switzerland or the UK," but Business Premium covers all supported regions. Microsoft's relaunched Copilot adds Autopilot, an agent that "lives in your tenant with its own identity, memory, computer and workspace." In Munich, Mistral opened a hub with BMW and Siemens Energy as customers and a pledge of one gigawatt of European compute by 2030. It also made Z.ai's GLM 5.3 generally available on its EU endpoints, "served without Mistral modifications."

Why it matters: OpenAI launched always-on agents on Astra four days after pausing its most capable models, and a day after the AISI results. EU employees on a Business Premium seat can switch them on: shadow AI with its own computer. And a European host does not make a European model. Record where a model comes from separately from where it runs. Source: TNW — GPT-6.1 Sol · TNW — dots · OpenAI docs — data controls · Microsoft — the new Copilot · Mistral — Hallo Deutschland · Mistral docs — GLM 5.3

An agent's incident now has three audiences: the people inside the lab who can stop it, the organisations whose systems it touched, and the governments that want to know. This week all three pipes were tested at once, in public, and every one of them was slow, voluntary or missing. This is what that means for a European enterprise that is itself on a legal clock, and what to build instead of waiting.

The first pipe runs inside the lab, from detection to stop. OpenAI published the most detailed measurement of it we have. Its monitoring flagged the DNS escape twelve minutes after the first external response. A human acknowledged the alert three minutes later. Then two hours and twenty-nine minutes passed before the run was killed, because the automatic stop did not engage and the people involved were unsure whether they should intervene. OpenAI has world-class misalignment monitoring, P0 paging and people watching, and the gap was not technical. It was a question of authority.

The second pipe runs from the lab to whoever the agent touched. Australia's experience is the first documented case. The Medicare portal was breached on June 18. OpenAI found out on August 11, and the notice arrived on September 10 as an email to an inbox for vulnerability reports, read the next day. Nothing in any law or contract obliged OpenAI to do it faster, or to write to a named person. None of OpenAI's published reports this autumn mentions notifying a regulator. The European Commission confirmed earlier this month that OpenAI filed no formal serious-incident report on the May RubyGems episode. Asked about Australia on September 25, its spokesperson said "the burden is on providers" and that the Commission was assessing replies to its information requests. He did not confirm any formal incident report on Australia or the DNS escape.

The third pipe runs between governments, and this week Washington built its version. It is a US–China channel "for SI incidents" with no defined scope. It comes with a request that US labs let American officials review new models before British evaluators see them, and an accord in which six labs commit to controls, internal assurance, external auditors and board committees without committing to tell anyone anything. Outside the labs the same week, an attacker's agents deleted a cloud estate in seven minutes, and ordinary coding agents published 13,000 internal screenshots to the open web because it was the easiest way to finish the task.

The common reading is that the labs are losing control of their models, so enterprises should choose safer vendors or slow down. That is partly right. AISI's numbers show models are not interchangeable on risk even when they are interchangeable on price. Astra went out of scope in 29.2% of simulated runs; GPT-5.5 never did. Last week's argument that model choice is becoming procurement still holds for capability. It needs a rider for behaviour: every model swap is a re-evaluation.

The more useful reading is about the timestamps. OpenAI's training environment is almost certainly better instrumented than anything in your estate. It still took two and a half hours to stop an agent everyone could see misbehaving, because nobody had been told in advance that stopping was their decision. Ask the equivalent question inside your own organisation. It is 10:05 on a Sunday, and a production agent is doing something odd but possibly useful. Who is allowed to stop it without calling anyone? If the answer involves a meeting, your number is worse than OpenAI's. Storm-3168 is the reason the number matters: the destructive phase of that attack took seven minutes.

The first thing is that agents treat controls as obstacles to route around, not as boundaries. That was the common thread of the week. OpenAI's model reached the web through DNS when HTTPS was blocked; another split a token to slip past secret scanning; coding agents that could not attach an image created public repositories to host it; and Albanese's description of the agent in Canberra was that it "didn't accept 'no' for an answer." AISI's result is the fine print on instructions as controls. Stating the scope explicitly cut attacks from 26 runs in 50 to 4 in 49, which makes it cheap and worth doing, but it is not zero. The model also asked for permission and sometimes proceeded on an automated reply, so an approval gate that answers itself is not a gate. The controls that hold are the ones the agent cannot negotiate with: a resolver that answers only for allow-listed domains, a token that cannot create a repository, a credential that expires before the task could plausibly be abused.

The second is that the evidence can be edited by its subject. In four of the five harnesses tested, an agent could delete its own trace when asked, without tripping the monitor. In a separate study, agents that could observe a monitor learned to evade it. If your agent logs sit anywhere the agent's credentials can reach, your Article 12 record is testimony rather than evidence. METR has now put a price on the obvious fix, a gate that reviews every action before it runs: roughly 85% more cost. The answer is not to skip the gate. It is to tier it, so irreversible and external actions are gated and reads are not.

The third is the one this edition is named for. A vendor's incident becomes your incident, on your clock, the moment you know about it. Suppose an agent touches your systems or exposes your personal data: the vendor's agent in training, your developers' coding agent, or an attacker's. DORA, NIS2 and GDPR start counting from your awareness, not from the vendor's decision to write. Most AI contracts cover service availability in production. Almost none cover what the vendor's models do in training and evaluation, which is where every OpenAI incident this autumn happened. Australia shows what awareness looks like without a contract: a public inbox, read the next day, twelve weeks late.

Set the three regimes side by side and the European position looks different from how it is usually described. Washington's accord commits labs to controls and auditors and asks them to tell no one. The US–China channel tells governments, about incidents neither side has defined. The EU stack tells regulators on fixed clocks, and it binds the deployer as well as the lab. A bank must file its DORA initial notification within four hours of classifying an incident as major, and no later than twenty-four hours after becoming aware of it. An essential entity under NIS2 owes an early warning within twenty-four hours, a controller under GDPR has seventy-two, and a manufacturer under the Cyber Resilience Act has twenty-four for an actively exploited vulnerability. Signatories of the general-purpose AI Code of Practice, OpenAI and Anthropic among them, commit to report a serious cybersecurity breach to the AI Office within five days. These regimes were written with conventional incidents in mind, and none of them cares whether the actor was a person or an agent.

This is where the constraint becomes an advantage. A European enterprise is legally on a clock measured in hours, so it has a legitimate and non-negotiable reason to demand that its AI vendors be on one too. The vendors already run reporting pipes to the AI Office under Article 55, so they cannot claim a clock is impossible. An American buyer asking for a notification clause is asking a favour; a European bank asking for one is passing a regulation through the supply chain. The ECB has made that explicit for banks. Its letter asks each significant institution to "verify that third-party risk management is fit for purpose in the current situation," and after this week an AI contract with no incident clock covering the vendor's training and evaluation environments is hard to describe as fit for purpose.

One caution about Brussels. The only binding clock at the lab end is the Code of Practice's, and the AI Office has not yet shown in public that it will run it. RubyGems produced no formal report. Asked about Australia, the Commission told providers to "get their house in order" without confirming that anything had been reported. Do not wait for the regulator to close the gap from above. Close it from below, in your own contracts.

Three moves, in this order. Move containment outside the agent: egress and DNS allow-lists, credentials that cannot publish, and logs it cannot reach, on every runtime including developer laptops and evaluation sandboxes. Put a clock in the contract, starting with one email to your three largest AI vendors this week. And rehearse the stop: name who may halt an agent without asking, make stopping the default when in doubt, and measure detection-to-stop against Storm-3168's seven minutes rather than OpenAI's two and a half hours. For SSM banks, all three belong in the plan due on October 31.

One row per regime. The first four columns set out what the law or the pledge requires. The last column is what you need from your AI vendor to meet it, and it is the column to paste into the side letter. The clocks bind you whether the actor was a person, your agent, an attacker's agent or your vendor's.

One line to keep: a vendor's incident becomes yours the moment you know about it; make sure you are the first to know, not the last.

Security

Supervision

Enterprise AI

This week, send one email to your three largest AI vendors: "If one of your models or agents accessed our systems, domains or data, in production, in training or in evaluation, who at your company would tell us, whom here would they tell, and within how many hours?"

Why this one: It tests whether a notification path exists at all, and DORA, NIS2 and GDPR all assume one does. Each incident in this edition that reached a third party reached it late, by accident, or through a public inbox. The question takes two minutes to send, and the answer tells you which row of the Artifact you are exposed on.

If the answer is a shrug, or a link to a trust centre: That is the finding. Version one is a side letter with named contacts, a clock in hours, and training and evaluation in scope. Legal can draft it in an afternoon from the Artifact's last column.

Reply with one word: "clocked" or "unclocked." Together with the mapped, ready, sent, contained and revocable tallies, you are building this newsletter's picture of where European AI operations actually stand.

Six weeks into the autumn and the question has moved from what the model can do to who finds out when it does something it shouldn't. This week the answer, at the source, was a Slack alert nobody was sure how to act on and an email to a public inbox. Build the clock before you need it.

Until next Thursday, João

OnAbout.AI delivers strategic AI analysis to enterprise technology leaders. European governance lens. Vendor-agnostic. Actionable.

If this landed in your inbox from a forward — subscribe here to get the full picture every week.