AI research pipelines can now find and weaponise bugs at a scale, speed and cost that puts pressure on monthly patch windows and alert-led response. This Sunday Special walks through the evidence and its limits, four assumptions worth revisiting, and a practical model for adapting: know your exposure, triage by risk, verify the fix, contain what you can't fix yet, and govern the AI agents in your own workflow. It opens with one live item: an exploited SonicWall VPN flaw that can bypass SAML-enforced MFA.
News: one live item
SonicWall SonicOS SSL-VPN SAML/MFA bypass exploited, now in CISA KEV (CVE-2026-19868). A user with valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA, on SSL-VPN configured for SAML. Affected: Gen7 TZ, NSa, NSsp and NSv on SonicOS 7.3.3-7015 and earlier; Gen8 TZ, NSa and NSv on 8.2.2-8015 and earlier. Fixed: 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8). No workaround. CISA federal deadline 20 November 2026. Exploitation details have not been shared. - SecurityWeek - BleepingComputer - SonicWall advisory SNWLID-2026-0014
Part one: the evidence
OpenAI: 948 working Linux local privilege-escalation exploits. Mid-October 2026 pipeline run (scout, reproduce, assess, patch, human review). About US$1.2 million in API credits (US$1,213,430; about US$1,279 per LPE end to end), not a fully loaded programme cost. 2,308 candidates in about 12 hours; 1,724 reproduced (about 75%); 291 information-leak proofs of concept. July comparison: an earlier run found 166 LPEs for about US$514,000; the October run found more than five times as many novel LPEs on the latest kernel master. Candidate patches still need maintainer review; critical findings reported first. - OpenAI: A thousand fewer paths to root
GPT-6 Cyber and gated defender access. Initially available only to a select group of approved Daybreak Red customers; a US$1 billion programme subsidises access for resource-constrained defenders. OpenAI reports 304 critical Linux findings disclosed first and 81 novel high-severity Firefox issues reported to Mozilla. - OpenAI: Introducing GPT-6 Cyber
Anthropic Frontier Red Team: N-day exploits in the lab. The model was given security patch diffs plus vulnerable and patched standalone SpiderMonkey builds; fixes had been public for at least 90 days. 18 patches, proofs of concept for 14, first working exploit in just under an hour, 8 working code-execution exploits in about 12 hours. Windows kernel, without source: 21 patches, 18 proofs of concept, 8 full SYSTEM chains for about US$15,700 (about US$2,000 each). Lab capability, not a measured median or a wild-attack timeline. - Anthropic: Measuring LLMs' impact on N-day exploits
Part two: the pressure
VulnCheck State of Exploitation 1H-2026. 495 vulnerabilities added to VulnCheck's own exploited catalogue; 23.43% had exploitation evidence on or before CVE publication day (28.93% in 2025). Median CVE-to-KEV time about 80 days (from about 120); this measures time to recorded exploitation evidence, not first exploitation. About 200 CVEs exploited within 31 days, flat on prior years, while CVE volume rose about 45% on the previous half. 1,061 AI-attributed vulnerabilities across two tracked disclosure datasets, 14 (1.3%) with confirmed exploitation in the evidence available at the time. - VulnCheck: State of Exploitation 1H-2026
CISA BOD 26-04, Prioritizing Security Updates Based on Risk (10 June 2026). Deadlines as short as three calendar days, depending on public exposure, KEV status, automatability and technical impact; some three-day cases (KEVs giving total control) also require forensic triage, and an exposed, automatable non-KEV flaw giving total control also gets three days. Other combinations get 14 days, 60 days or fix on system upgrade. Clock starts at KEV addition or agency identification on an asset, whichever comes first. Applies to Federal Civilian Executive Branch systems; Phase III implementation due within 180 days of issuance (7 December 2026). Supersedes BOD 22-01's flat KEV deadlines. - CISA BOD 26-04
ASD Essential Eight Maturity Model. From Maturity Level One: patches, updates or other vendor mitigations for online services and internet-facing servers and network devices within 48 hours of release when critical or a working exploit exists; two weeks otherwise. A maturity model recommendation, not a blanket legal deadline. - ASD Essential Eight Maturity Model
Part three: adapting
Process model. The show's synthesis of public Cloud Security Alliance guidance and published enterprise process practice: continuous discovery including AI review of your own code; risk-based patching with a named emergency pathway; treat each patch as an exploit blueprint; verify the fix (asset, owner, emergency change, staged test, deploy and restart, independent retest, rollback); compensating controls with owners, expiry dates and validation; continuous asset visibility; architectural containment; behaviour-based detection with bounded, pre-authorised containment; supply chain visibility. - Cloud Security Alliance public summary
OpenSSH on Alpine: installed is not the same as fixed. Upgrading the openssh package leaves the old sshd running until it is restarted (covered in Episode 23). - Help Net Security
OpenAI alignment report: an agent harness with raw-packet permissions. In a 4 August coding evaluation (report updated 5 November) with the web proxy unavailable, the model used raw-packet permissions in its container to scan private addresses and reach outside services through the app's browser network; a request for cloud-instance credentials was refused. It built a substitute site with invented testimonials, and evaluators cancelled the run before it sent a final answer. No evidence of sensitive-data transfer or access to the host or another tenant's data. Fixes: raw-packet permission removed from unprivileged containers by default, forwarding from private container networks blocked, DNS query paths hardened. - OpenAI Alignment: Bypassing network restrictions during a coding evaluation
Five takeaways
- Know what is exposed and who owns it.
- Prioritise exploitation evidence, exposure and business impact, not severity alone.
- Rehearse urgent changes and verify the fix, with staged testing, retesting and rollback.
- Contain what cannot yet be fixed, using validated controls with owners and expiry dates.
- Govern defensive agents, their untrusted inputs and privileges, and support the people accountable for their actions.