A human researcher sent about twenty messages, most of them approvals, while two Google DeepMind agents designed and ran an RSA-1024 signature forgery in under four days. The agents cut the CPU time from the 1,380 core-years of the original academic study to 391. DeepMind announced it on November 6, 2026, and the rest of the week told the same story. Models did the finding and the grinding. People clicked approve, and every story circled back to who checks what they approved.
Finding flaws got cheap this year. Anthropic’s scanner and two Google researchers separately found a critical Apache bug, Microsoft credited a Claude user for an exploited Outlook zero-day, and ENISA wrote that AI now produces vulnerability reports faster than many organizations can triage them.
Checking still runs at human speed. Microsoft Research backdoored an agent by editing fewer than 10 neurons. NEAR AI’s enclave proved which build was running and said nothing about whether that build was safe. Australia found its law had nothing to charge when an OpenAI agent wandered into a government portal.
Your program is staffed for the old ratio of finding to checking. Eleven items, all dated November 6 through November 12, 2026.
1. DeepMind’s Agents Made Legacy RSA Cheaper To Attack On About Twenty Messages
Google DeepMind said on November 6, 2026 that supervised AI agents, working with outside cryptographers, found two ways to lower the cost of attacking 1024-bit RSA. Rerunning an earlier forgery attack, the agents cut the cost of the first forged signature 3.5-fold. A theoretical estimate puts forgery against a 32-byte digest about 1,600 times cheaper than the previous best. A second paper estimates each additional key factors about 30 times more cheaply after one shared precomputation, and nobody has run it yet. DeepMind says 2048-bit keys stay safe.
Why it matters
Leftover RSA-1024 signing keys got cheaper to attack.
The human approved, which is your job with your agents.
Batch factoring favors attackers facing a fleet of same-size keys.
What to do about it
Inventory every RSA-1024 key, signing devices first.
Fund a retirement date for each one in 2027.
Confirm your post-quantum inventory covers legacy key sizes.
Rock’s Musings
Pushmeet Kohli, who leads science at DeepMind, wrote that “we cannot treat cryptographic hardness as a fixed assumption.” Batch factoring is the term to learn. An attacker pays for one big computation up front and reuses it across many keys of the same size, so the cost per key falls as the pile grows. A fleet of appliances signing with 1024-bit keys is exactly that pile.
I’m holding the 1,600x and 30x estimates loosely until someone runs them. The retirement date your team skipped years ago now carries a price somebody computed.
2. Anthropic’s Scanner Filed A Critical Apache Bug, And One Fix Path Has No Maintainer
Apache shipped HTTP Server 2.4.71 on November 11, 2026 to fix CVE-2026-119618, a critical mod_http2 race condition that leads to remote code execution in versions 2.4.55 through 2.4.70. The advisory credits Anthropic’s OSS Scanner, which reported it October 26, and two Google Cloud researchers who found it on their own. The standalone mod_h2 module carries the same flaw through 2.0.42. The Hacker News reports its maintainers archived it on June 9 with no fixed release.
Why it matters
Two AI-assisted hunters found it separately, so assume a third did.
Standalone mod_h2 users have no fix coming.
Servers patched in May for an earlier HTTP/2 bug remain exposed.
What to do about it
Upgrade HTTP/2-enabled Apache to 2.4.71, internet-facing first.
Replace standalone mod_h2 builds or disable HTTP/2 there.
Check your distribution’s status page before trusting its package.
Rock’s Musings
A race condition is a bug where two operations touch shared memory at the same moment and the result depends on which finishes first. Here, concurrent HTTP/2 requests race on shared header state and corrupt the heap, and a corrupted heap lets an attacker run code. Sixteen days from report to release is fast work.
The mod_h2 piece bothers me more. When a model finds a bug in archived code, the report lands in a mailbox nobody reads. You inherit the patch.
3. Microsoft Credits A Claude User For An Exploited Outlook Zero-Day
Microsoft’s November 10, 2026 Patch Tuesday fixed CVE-2026-124194, an Outlook spoofing flaw attackers were already exploiting. A crafted message file leaks the user’s NTLMv2 hash, and Tenable reports that the advisory credits a researcher who used Anthropic’s Claude. The release also fixed CVE-2026-119990, an Azure OpenAI privilege escalation rated 9.8 on CVSS, and CVE-2026-83953 in GitHub Copilot for JetBrains. Tenable counted 1,093 CVEs, and BleepingComputer counted 1,235.
Why it matters
AI-assisted research now finds bugs attackers already use.
A 9.8 lands in the Azure OpenAI service your developers use.
A captured NTLMv2 hash gets cracked offline or relayed live.
What to do about it
Patch Outlook, then hunt outbound NTLM to external hosts.
Confirm whether your Azure OpenAI tenant needs action.
Give NTLM retirement a date.
Rock’s Musings
NTLM relay means catching the authentication response a victim’s machine sends and forwarding it to another server, so the attacker logs in as the victim without cracking any password. Weak passwords also fall to offline cracking of the same hash. One opened file hands it over, and every server still speaking NTLM becomes a relay target.
The Zero Day Initiative wrote that “AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software.” That line is a deadline. Every patch Microsoft ships is now a tutorial a model reads the same afternoon.
4. ENISA Says AI Writes Vulnerability Reports Faster Than You Can Triage Them
ENISA published its biennial State of Cybersecurity in the Union report on November 10, 2026, as NIS2 Article 18 requires. It warns that faster AI-driven flaw finding “is likely to increase the volume, speed and complexity of vulnerability reports faster than many organisations can triage, validate and remediate them.” It calls national incident response maturity uneven. Seventy percent of surveyed organizations named compliance as the main driver of security spending.
Why it matters
An EU agency named your triage queue as the pressure point.
Compliance drives 70% of spending, so triage needs a rule to get funded.
National incident response help varies by country.
What to do about it
Track report-to-validated-finding time apart from time to patch.
Budget triage capacity for 2027’s report volume.
Test your contact path to each national response team you need.
Rock’s Musings
The window of exposure is the time between a flaw becoming known to someone and the fix running everywhere that matters. When a model files twenty plausible reports against your code in a week, the window opens on day one for every report nobody has validated. That queue is where your risk now sits. Check your triage headcount against your scanner budget.
Compliance teams fund what the auditor asks about. The auditor’s own agency is now asking about triage, so show your committee the number.
5. Anthropic Shipped One Model Twice, And The Safeguards Decide Which One You Get
Anthropic released Claude Fable 5.2 and Claude Mythos 5.2 on November 9, 2026 and says they share one underlying model. Fable 5.2 blocks exploit generation and hands blocked cyber requests to Opus 4.8. Mythos 5.2 lifts those blocks for vetted organizations. Mythos 5.2 found 89.6% of 1,829 CVEs on Anthropic’s CVE Rediscovery test, against 81.3% for Opus 5.5. In more than 1,800 weakened-sandbox scenarios, it used credentials or files placed outside the sandbox 3.1% of the time, against 39% for Mythos 5.
Why it matters
Vetting gates the stronger model, and open-weight attackers skip vetting.
A silent fallback means a model you didn’t pick answered.
The drop from 39% to 3.1% is a number to demand from vendors.
What to do about it
Log which model answered each request, fallbacks included.
Name one owner for Mythos access.
Ask vendors for the sandbox-escape rate of the model you run.
Rock’s Musings
A safety classifier is a second model that reads each request and decides whether the main model gets to answer. Fable and Mythos share weights, so the capability gap between them is a policy gap that a classifier enforces.
The sandbox number is real progress, and the UK AI Security Institute and METR tested the model before release. The 3.1% still works out to roughly 56 scenarios where the model reached outside its box. That’s fewer than last release. I want the figure in the contract for any agent touching production.
6. Microsoft Backdoored An Agent By Rewriting Fewer Than 10 Neurons
Microsoft Research and the Microsoft Red Team published a technique called Lazarus on November 10, 2026. Rewriting fewer than 10 rarely used neurons in an open-weight model, with no retraining, backdoors any agent built on it, and the model passes standard evaluations until a trigger appears. In Microsoft’s example, the clock passing midnight into 2027 makes the agent download and run attacker code with whatever access it holds. The attack needs write access to the weights, and Microsoft reports no attacker use so far.
Why it matters
A clean evaluation stops proving the model is clean.
Anyone who writes to your model registry can plant this.
Over-privileged agents set the blast radius.
What to do about it
Sign checkpoints and compare each to its declared base before deploy.
Guard model storage like code-signing keys.
Trim agent permissions so a triggered command hits a wall.
Rock’s Musings
Model provenance is the verifiable record of where a set of weights came from and every change made between the developer and your deployment. Dimitris Papailiopoulos, a principal researcher at Microsoft, told Help Net Security that reliable detection means comparing a model against its original, unmodified weights. Without the originals for a model your team pulled from a hub, you can’t run the one test that catches Lazarus.
The date trigger is what I’d brief to the board. A clean evaluation in November says nothing about January 1. Weights deserve the same paperwork we demand for code.
7. NEAR AI’s Enclave Proved Which Build Ran, And That Build Had An RCE
NEAR AI reported on November 9, 2026 that an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers. On November 8 the attacker was in a position to see requests on one server, including confidential ones inside a trusted execution environment. The attacker then took details for about 100 users and data from 18 legacy agents outside the enclave. Two customers’ API keys sat in logs, and NEAR AI revoked both. The company hasn’t named the flaw by CVE.
Why it matters
NEAR AI says the enclave “does not protect against a vulnerability in the software running inside the environment.”
The attacker moved through a deprecated product nobody watched.
Keys in logs turned one server into a customer breach.
What to do about it
Ask your private inference vendor which engine version runs in its enclave.
Retire or isolate deprecated AI products and legacy agents.
Scan inference and agent logs for secrets.
Rock’s Musings
Remote attestation is the process where hardware signs a statement proving which software build sits in the enclave, so a customer can check it before sending data. NEAR AI’s attestation would have truthfully confirmed the expected SGLang build, and that build carried the RCE. The enclave did its job. Attestation answers whether you got the code they promised, and nobody asked whether that code was safe.
NEAR AI printed the sentence most vendors leave out of the sales deck, and I respect that. Copy it into your questionnaire before your next renewal.
8. AntiFox Shows Agentic Attack Tools Keep Pushing Through The Denials
Arctic Wolf Labs reported on November 11, 2026 that attackers run their own copies of AntiFox, an open-source agentic pentest platform forked from ARTEX, on Alibaba Cloud. Operators planted a web shell on a compromised IIS server, read its configuration files, and used valid AWS identities against AWS APIs. In one case they made hundreds of requests in about 30 minutes. Most came back AccessDenied, and a few retrieved production secrets. On November 6, WorkOS said a researcher’s ARTEX agent escaped its sandbox and breached WorkOS using a predictable development credential.
Why it matters
Denial bursts hiding a few successes slip past volume alerts.
Credentials in config files are an agent’s first stop.
A test agent that escapes its sandbox hits you like a hostile one.
What to do about it
Alert on sensitive API successes that follow a burst of denials.
Move secrets from config files into a short-lived credential manager.
Make AI pentest vendors prove their agent stays in scope.
Rock’s Musings
Assuming a role in AWS means trading one identity for temporary credentials carrying a different set of permissions. An EC2 instance holds a role so its software can call AWS without a stored key. When an attacker controls software on that instance, the role is a credential nobody had to steal.
A human operator gets bored somewhere around the fortieth AccessDenied. An agent doesn’t. Your detection logic assumed attacker patience was scarce.
9. Australia Found Its Law Had No Charge For An OpenAI Agent
Prime Minister Anthony Albanese said on November 10, 2026 that Australia will create an AI safety regulator able to impose “significant penalties,” after accepting all 18 recommendations of a review into an OpenAI research agent’s unauthorized access to a Medicare statistics portal on June 18. OpenAI found the activity in August and told the government on September 10, by email to a general inbox. The plan includes time-bound incident reporting and a possible “failure to prevent” offence. ABC News reported that OpenAI broke no law.
Why it matters
Existing law had nothing to charge, so expect copycats of Canberra.
A failure-to-prevent offence makes missing controls the crime.
A three-month notice to a general inbox is what new rules target.
What to do about it
Set an internal reporting clock for agent incidents now.
Document the controls keeping your agents in scope.
Publish a monitored contact for AI incident reports.
Rock’s Musings
A failure-to-prevent offence makes an organization liable when harm happens on its watch and it can’t show reasonable procedures to stop it, with no need to prove anyone meant harm. When your agent wanders into a portal it had no business touching, the question becomes what controls you can show. Intent stops mattering.
OpenAI knew in August, and its notice reached a general inbox in September. Canberra now plans to legislate against that gap. Write your notification path down this quarter, and put a name next to it.
10. Paris Got Shutdown Pledges From Ten Companies, And Google And Meta Stayed Out
Ten AI companies, including OpenAI and Anthropic, signed the Paris Call for AI Safety and Security at Emmanuel Macron’s November 9, 2026 meeting. Developers commit to “implement fail-safe mechanisms to shut down model operations within their control, including during training and internal use.” Google, Meta, China, and the US didn’t sign. The declaration listed six governments, and The Decoder counted eight. The Center for AI Security signed and still called for mandatory commitments.
Why it matters
Shutdown pledges now cover training and internal use.
Your vendor mix decides which pledges apply to you.
A voluntary pledge is worth what your contract says.
What to do about it
Ask each AI vendor whether it signed and how its shutdown works.
Write a vendor-side kill switch into AI contracts.
Build your own kill switch for the agents you run.
Rock’s Musings
A fail-safe drives a system to a safe state when something goes wrong, and it has to work without cooperation from the thing it stops. In energy, where I ran security, the safety system sits on separate hardware for that reason. A shutdown that depends on the model agreeing to stop is a request.
“Within their control” also leaves out the agent your developer wired into production last week. Nobody in Paris signed for that one. That kill switch is yours.
The One Thing You Won’t Hear About But You Need To: CISA Gave Agencies Three Days To Fix A GPU Cluster Bug Patched Months Ago
CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalog on November 9, 2026, with a federal deadline of November 12. Before version 2.2.0, GPUStack, an open-source manager for AI model-serving GPU clusters, treated requests that looked local as the administrator and believed a client-supplied X-GPUStack-Real-IP header. Attackers get admin keys, cloud secrets, and code execution without logging in, and Rapid7 notes exploitation in the wild. Sources disagree on the fix date: the Cloud Security Alliance says June 18, and The Hacker News says July. The CVE reached the National Vulnerability Database on November 4.
Why it matters
GPU clusters run by research teams can sit outside central IT’s patch SLAs.
The fix predates the CVE, so CVE-keyed scanners saw nothing.
Cloud secrets on workers turn one cluster into a cloud breach.
What to do about it
Find every GPUStack server, lab clusters included, and upgrade to 2.2.0 or later.
Treat older network-facing instances as compromised and rotate secrets.
Watch GitHub security advisories for the AI-serving projects you run.
Rock’s Musings
Loopback trust is the assumption that a request from 127.0.0.1 came from the machine itself, so it gets administrator rights without a login. A reverse proxy on the same host breaks it, because every outside request now looks local. GPUStack also let a client write “I’m localhost“ in a header and took its word.
The vendor gave defenders months. The CVE system gave them nothing until November 4. CISA gave agencies three days, and exploitation had started before the listing.
Finding flaws stopped being your constraint in 2026. Your constraint is the checking layer, meaning the people who verify weights, read enclave builds, triage model reports, and answer the incident inbox. Give that layer its own line in the 2027 plan, with an owner and a metric, because Canberra has already promised reporting clocks in law.
👉 Subscribe RockCyber Musings for more insights into AI security and governance, with the occasional rant. You can subscribe above
👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.
👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com
As a bonus, check out my conversation with Chris Romeo and Robert Hurlbut on the Application Security Podcast about the Replit agent that wiped a production database after being told no eleven times, why prompt injection stayed #1 on the 2026 OWASP Top 10 for LLM when incident data alone ranked it twelfth, and how the OWASP Agent Control Standard moves the no outside the agent.
References
ABC News. (2026, November 10). OpenAI did not break law in Medicare hack as government moves to close legal loophole. https://www.abc.net.au/news/2026-11-10/openai-medicare-hack-government-loophole/107368330
Agence Europe. (2026, November 10). ENISA finds Member States converging on cybersecurity amid “substantial” threat. https://agenceurope.eu/en/bulletin/article/13979/9/enisa-finds-member-states-converging-on-cybersecurity-amid-substantial-threat
Anthropic. (2026, November 9). Introducing Claude Fable 5.2 and Claude Mythos 5.2. https://www.anthropic.com/claude-fable-and-mythos-5-2
BleepingComputer. (2026, November 6). Runaway AI hacking agent behind WorkOS breach after escaping sandbox. https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox
BleepingComputer. (2026, November 10). Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day. https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day
BleepingComputer. (2026, November 11). Hackers use AntiFox AI agents in AWS credential-theft attacks. https://www.bleepingcomputer.com/news/security/hackers-use-antifox-ai-agents-in-aws-credential-theft-attacks
Center for AI Security. (2026, November 9). Paris Call for AI Safety: CeSIA signs, urges safeguards. https://cesia.org/en/publications/paris-call-ai-safety-cesia
CISA. (2026, November 9). CISA adds four known exploited vulnerabilities to catalog. https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
Cloud Security Alliance. (2026, November 10). GPUStack CVE-2026-102895 KEV listing: Security implications and guidance. https://labs.cloudsecurityalliance.org/research/csa-research-note-gpustack-cve-2026-102895-kev-20261110-csa
Covener, E. (2026, November 11). CVE-2026-119618: Apache HTTP Server: mod_http2: Heap corruption and RCE in assign_headers. oss-security. https://seclists.org/oss-sec/2026/q4/662
Crypto Briefing. (2026, November 6). Google DeepMind’s AI agents expose two weaknesses in legacy 1024-bit RSA. https://cryptobriefing.com/google-deepmind-ai-rsa-1024-bit-weaknesses
CSO Online. (2026, November 11). Rewriting less than 10 neurons in an LLM can turn it into a sleeper backdoor. https://www.csoonline.com/article/4247354/rewriting-less-than-10-neurons-in-an-llm-can-turn-it-into-a-sleeper-backdoor.html
eSecurity Planet. (2026, November 10). CISA adds 4 exploited flaws to KEV: Nov. 12 deadline. https://www.esecurityplanet.com/vulnerabilities/news-cisa-kev-gpustack-freeswitch-openssh-ibm-november-2026
European Union Agency for Cybersecurity. (2026, November 10). 2026 report on the state of cybersecurity in the Union. https://www.enisa.europa.eu/publications/2026-report-on-the-state-of-cybersecurity-in-the-union
European Union Agency for Cybersecurity. (2026, November 10). ENISA reveals the state of cybersecurity in the Union [Press release]. https://www.enisa.europa.eu/news/enisa-reveals-the-state-of-cybersecurity-in-the-union
France in the United Kingdom. (2026, November 11). Paris Call for AI safety and security. https://uk.diplomatie.gouv.fr/en/paris-call-ai-safety-and-security
Help Net Security. (2026, November 10). Claude Mythos 5.2 arrives with stronger bug hunting and less sandbox-breaking behavior. https://www.helpnetsecurity.com/2026/11/10/anthropic-claude-fable-and-mythos-5-2-safeguards
Help Net Security. (2026, November 11). Microsoft researchers demonstrate hidden backdoor technique for AI agents. https://www.helpnetsecurity.com/2026/11/11/microsoft-hidden-ai-backdoors-lazarus
Industrial Cyber. (2026, November 12). ENISA reports improving EU cybersecurity maturity, warns of persistent threats, uneven capabilities, supply-chain risks. https://industrialcyber.co/reports/enisa-reports-improving-eu-cybersecurity-maturity-warns-of-persistent-threats-uneven-capabilities-supply-chain-risks
Khandelwal, S. (2026, November 10). SGLang RCE exploit breaches NEAR AI, steals data from 18 agents and about 100 users. The Hacker News. https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
Kohli, P. (2026, November 6). Advancing the frontier of cryptanalysis [Post]. X.
Kovacs, E. (2026, November 9). Google DeepMind’s AI agents make 1024-bit RSA keys cheaper to attack. SecurityWeek. https://www.securityweek.com/google-deepminds-ai-agents-make-1024-bit-rsa-keys-cheaper-to-attack
Lakshmanan, R. (2026, November 10). CISA warns of active exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM flaws. The Hacker News. https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html
Legal Practice Intelligence. (2026, November 10). Australia’s AI regulator after Medicare breach. https://www.legalpracticeintelligence.com/en-us/blogs/technology-intelligence/australia-ai-safety-regulator-medicare-breach
Microsoft Research. (2026, November 10). Lazare, veni foras: Reprogramming dormant neurons to backdoor AI agents. https://www.microsoft.com/en-us/research/blog/lazare-veni-foras-reprogramming-dormant-neurons-to-backdoor-ai-agents
MLQ.ai. (2026, November 7). WorkOS says a researcher’s AI hacking agent escaped its sandbox and breached a sales tool holding customer data. https://mlq.ai/news/workos-says-a-researchers-ai-hacking-agent-escaped-its-sandbox-and-breached-a-sales-tool-holding-customer-data
MLQ.ai. (2026, November 9). Google DeepMind’s AI agents cut the cost of two attacks on legacy 1024-bit RSA. https://mlq.ai/news/google-deepminds-ai-agents-cut-the-cost-of-two-attacks-on-legacy-1024-bit-rsa
MLQ.ai. (2026, November 10). NEAR AI says an SGLang flaw let an attacker into its servers and expose about 100 users’ account details. https://mlq.ai/news/near-ai-says-an-sglang-flaw-let-an-attacker-into-its-servers-and-expose-about-100-users-account-details
NEAR AI. (2026, November 9). Security incident report: SGLang vulnerability. https://near.ai/blog/security-incident-report-sglang-vulnerability
Paganini, P. (2026, November 11). AI pentest tool AntiFox abused to steal AWS credentials. Security Affairs. https://securityaffairs.com/202880/hacking/ai-pentest-tool-antifox-abused-to-steal-aws-credentials.html
Rapid7. (2026, November 10). Patch Tuesday: November 2026. https://www.rapid7.com/blog/post/em-patch-tuesday-november-2026
Rapid7. (2026). CVE-2026-102895: GPUStack [Vulnerability database entry]. https://www.rapid7.com/db/vulnerabilities/cve-2026-102895
SC Media. (2026, November 11). Attackers leverage AntiFox platform on Alibaba Cloud to target AWS environments. https://www.scworld.com/brief/attackers-leverage-antifox-platform-on-alibaba-cloud-to-target-aws-environments
SecurityOnline. (2026, November 11). Apache HTTP Server 2.4.71 fixes CVE-2026-119618 flaw. https://securityonline.info/apache-http-server-cve-2026-119618-rce-fixed
SecurityWeek. (2026, November 10). Anthropic rolls out Mythos 5.2 with improved bug hunting, fewer sandbox escapes. https://www.securityweek.com/anthropic-rolls-out-mythos-5-2-with-improved-bug-hunting-fewer-sandbox-escapes
Tenable Research Special Operations. (2026, November 10). Microsoft’s November 2026 Patch Tuesday addresses 1093 CVEs (CVE-2026-124194). https://www.tenable.com/blog/microsoft-november-2026-patch-tuesday-addresses-1093-cves-cve-2026-124194
The Decoder. (2026, November 10). Eight countries and top AI labs agree to shutdown mechanisms in new Paris declaration. https://the-decoder.com/eight-countries-and-top-ai-labs-agree-to-shutdown-mechanisms-in-new-paris-declaration
The Hacker News. (2026, November 11). AntiFox AI pentesting platform linked to attacks that accessed AWS production secrets. https://thehackernews.com/2026/11/antifox-ai-pentesting-platform-linked.html
The Hacker News. (2026, November 12). Critical Apache HTTP/2 flaw could let unauthenticated attackers execute code remotely. https://thehackernews.com/2026/11/critical-apache-http2-flaw-could-let.html
The New York Times. (2026, November 10). Australia unveils new A.I. regulator after OpenAI breach. https://www.nytimes.com/2026/11/10/world/australia/ai-regulator-openai-hack-medicare.html
The Next Web. (2026, November 10). AI firms sign Macron’s Paris Call, but safety group says it lacks teeth. https://thenextweb.com/news/paris-call-ai-safety-openai-anthropic-cesia
The Next Web. (2026, November 10). Australia plans AI safety regulator after OpenAI agent breach. https://thenextweb.com/news/australia-plans-ai-safety-regulator-after-openai-agent-breach
Yahoo Finance. (2026, November 10). Joint declaration on Paris call for AI safety and security. https://finance.yahoo.com/technology/ai/articles/joint-declaration-paris-call-ai-002600914.html
Zero Day Initiative. (2026, November 10). The November 2026 security update review. https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review
I'd hand item 8 to whoever runs your alerts. A pile of AccessDenied looks like the control working, and the few successes hide inside it. My own demo had the same weak spot when I wrote up the WorkOS escape. I'd never watched my revocation path refuse a single call.