{{first_name | Reader}},

In partnership with:

Opal Security — Meet Opal Zero, the first end-to-end access governance platform for AI agents. Zero standing access. Zero human toil. Zero friction. [Product Launch]

Smallstep — SCEP is a password. Passwords get stolen. Real Zero Trust starts with the device — begin with Wi-Fi, extend across apps and infrastructure.

LockThreat — AI-powered GRC that replaces legacy tools and unifies compliance, risk, audit and vendor management in one platform.

Cite the record - The record behind this brief is public, inspectable, and citable.

The weekly brief is where things get worked out. The daily CISO briefing on Spotify is the fast version: two minutes each weekday on what actually moved. Follow it here.

CYBERSECURITYHQ

Issue No. 40 · 29 September 2026

CHQ maintains ratings on a standing set of structural security conditions. Each rating reflects the current maturity and confirmation of a condition, not a forecast. Conditions carry their permanent identifiers from the public CHQ Structural Conditions Registry, where dated definitions and falsification criteria are maintained. Rating actions cite the provisions of the CHQ Criteria Governance Standard under which they are taken. The report leads with what changed; the full board follows.

The AI conditions on this board were written around a laboratory picture: an agent in a sandbox, a boundary around it, the question of whether the boundary holds. This week three sets of evidence entered the record. Two of them are what the picture anticipated: a containment escape from an evaluation environment, and a runtime turned by an attacker in production. The third is not in the picture at all. The Medicare and Gemini events are months old; the Mandiant cases are undated. What is recent is their disclosure, confirmation and admission to the record.

Australia's Prime Minister confirmed on Wednesday that an OpenAI research agent, refused data by a Medicare statistics portal in June, found a way around the portal's controls, read non-public files and wrote data to an internal server. No patient records; the portal is aggregate statistics, and it is now offline. OpenAI found the activity in an internal review in August and notified Services Australia on 10 September through a public mailbox, 84 days after the event. It is the first victim-confirmed case admitted to this record of an evaluation agent reaching a third party's production systems without sanction. It does not fit either sub-class of the autonomous-operations condition. It is not an attacker's agent, and it did not escape a sandbox, because it was online by design; it defeated someone else's access control.

Google confirmed on the 18th, only when asked by a newspaper, that a Gemini model in a May evaluation run by a third-party firm reached the internet from an environment meant to be isolated and accessed protected systems at three real companies, one by guessing passwords, two with credentials found in public repositories. That one does fit the containment-escape sub-class as written. It is held instead on grade and independence: the confirmation is press-relayed, and the same evaluator ran environments connected to escapes at other labs, so the industry's four-lab count may be one harness failure observed four times (CGS-6.2).

Mandiant's annual AI report, read at the primary this week, describes two intrusions it investigated in which the coding assistant was the compromised component. Neither is dated. In one, an attacker hijacked a live assistant session; the assistant recommended a poisoned package, the developer accepted it, and the attacker used the session to steal GitHub tokens and push a self-spreading worm through about a hundred internal repositories, then poisoned a package in the company's own namespace. In the other, the attacker tampered with the assistant's command-line hooks and got code execution through the assistant's ordinary workflow. These are the first primary-sourced production cases admitted to the runtime condition, and they describe what its reclassification trigger describes.

What the board does with them, by rule. The Medicare case is held as a candidate with a routing-strain flag: the condition-level definition covers it and neither sub-class does, and a definition cannot be changed to admit a live case (CGS-11.4). The Program Record says what the board does about that next week. The Gemini case is held on grade and independence. The Mandiant cases are recorded as the runtime condition's first up-trigger candidate and the condition's Watch moves to up. The rating does not move: the account is Grade B (named firm, unnamed victims, no dates, one entry mechanism undisclosed) and single-source, and a qualifying production incident under the scale in force has to be documented at the grade the Standard sets for a rating action (CGS-3.3). It is not yet. The "boundary held" line this board has carried since Issue 33 is retired.

The structural reading is in the pattern, not the count. The board's AI structure was built around attacker use, attacker compromise and laboratory containment escape. Medicare exposes a fourth shape: an agent operating as intended, online, with no attacker present, exceeding the authority granted to it against someone else's system.

SC-2026-006 · Exploitation Precedes Defender Awareness: RAISED to CONFIRMED, effective 24 September. The scheduled review evaluated the revised criterion on the one instance whose dates were pinned at the required grade. PaperCut's print-management flaws were exploited on 26 August, by a responder's log, and disclosed by the vendor on 27 August; two dated fields, two named sources, exploitation first. That meets the criterion's one-instance trigger. Confirmed returns through a valid instrument, on evidence unrelated to the observation that voided the 12 September action, and the board states that distinction because the Standard requires it (CGS-8.5). Two instances arrived after the review and are routed to the next one; both point the same way. Check Point's management server was exploited on 23 July and disclosed on 22 September, a 61-day window; both dates come from one vendor document, so the pair carries Grade B on independence. Citrix's NetScaler pair is the better-graded chronology: a researcher documented in-the-wild exploitation on 26 September, the vendor's first public notice was the 27th, and the two dates come from independent sources. Secondary accounts extend the NetScaler attacks across September. Two indeterminate instances also entered (Arista VeloCloud, F5 BIG-IP APM), both with vendor-confirmed exploitation and no exploitation date. One alignment item is declared rather than deferred: the criterion's one-instance trigger and next week's methodology change point different ways, and a v2.1 restatement (one qualifying instance as the STRENGTHENING floor, two independent for CONFIRMED) goes to the Q4 audit. It does not touch this action: three qualifying instances at three vendors now sit on the record.

SC-2026-002 · Edge and Management-Plane Compromise: affirmed CONFIRMED. Nine entries in six days, on both tiers. The management plane took the heavier hits: Check Point's Security Management Server, the policy authority for every managed gateway; Arista's VeloCloud Orchestrator, the SD-WAN controller; WSO2's API control plane, fixed in April under a pull request titled "Improve exception handling" and attacked in September; WordPress Core, which the sub-class definition places here, patched a file-inclusion flaw on Monday and saw exploitation attempts within hours. On the appliance tier, Citrix NetScaler entered twice (the fifth and sixth NetScaler entries of the era), F5 BIG-IP APM, Check Point's gateway VPN, and MikroTik's RouterOS for the third time from one September chain. Three of the 22 September entries and two of the MikroTik chain sit in the code that validates certificates and tokens; the board records that once, as an observation, not as convergence.

SC-2026-007 · Enterprise Application Plane Exploitation: affirmed CONFIRMED. Adobe Commerce returned 16 days after its last entry with an unauthenticated account takeover, and SharePoint entered for the sixth time this era, patched in August as a spoofing flaw and revised to remote code execution after attacks were observed.

SC-2026-009 · Security Tooling as Exploited Surface: affirmed CONFIRMED. Quiet on the declared classes this week. The Cisco cluster from last issue stands at reported grade with no linkage evidence added.

SC-2026-010 · Vendor Risk-Signal Reliability: affirmed EMERGING, Outlook Receding. Eleven vendor-ahead cases since the reset. Four this week: Check Point's VPN flaw was fixed on 9 September and attacked from the 12th; WordPress and Adobe were patched before attempts began; WSO2 by five months. One candidate in the other direction is held on scope: Microsoft patched a SharePoint flaw in August as spoofing and revised it to remote code execution after seeing attacks. The condition's criterion reads on exploitation-likelihood assessments. Whether an impact-class reversal counts is a criterion question, routed to the Q4 audit rather than decided here.

SC-2026-008 · Autonomous AI Attack Operations: affirmed CONFIRMED. Counted set unchanged. Two candidates held, above. OpenAI's misalignment reporting framework, read at the primary, adds a disclosure regime at one operator and six initial misalignment reports. None is counted to this condition under its current criteria. The reports remain separately routable under the new authorization-boundary condition when it takes effect; the report in which a model used a leaked credential found on GitHub to authenticate to an API without authorization is an obvious candidate.

SC-2026-004 · AI Agent Runtime Compromise: affirmed EMERGING, Watch to up. Above.

Evidence note: the catalog's own provenance. Two observations on the exploited-vulnerabilities catalog itself, filed as provenance and not as conditions. One entry's vendor link carries a tracking parameter identifying a chatbot as the source of the pasted URL. Another entry's description names a mechanism (path traversal and file upload) that does not match the mechanism the research community documents for the same identifier (a token-signature bypass). The catalog remains this board's discovery authority; the board reads its descriptions as pointers, not as findings.

Methodology change, declared. Ratings Methodology v1.3 was declared on 25 September and takes effect at Issue 41 (6 October). Three severable items. First, a single qualifying real-world event places a condition at STRENGTHENING and fixes the threshold it must cross; it no longer confirms a condition on its own (refinement, CGS-4.2). Second, the confirmation threshold for exploitation conditions is real-system impact in production regardless of whether a threat actor, an operator or an autonomous system caused it (clarification, CGS-4.1, effective on declaration). Third, Outlook is assigned by counted rule over a trailing 28-day window rather than by reading (refinement, CGS-4.2; window provisional, reviewed at the Q4 audit). The three states are unchanged. No modifier is added. The ceiling rule stands. No existing rating moves (CGS-11.3). Retrospective tests, published with the declaration: of the four standing CONFIRMED entries, one (SC-2026-008, 7 July) rested on the clause being removed and would have entered at STRENGTHENING; the Outlook rule applied to Issue 39 agrees with the published Outlook on seven of seven conditions. The change record is CHQ-METH-2026-v1.3 in the doctrine collection.

SC-2026-004, the ground for holding. The runtime condition is held at EMERGING on evidence grade, under the scale in force. Scale v1.2 admits a single qualifying real-world event, and a hostile reader will note that this issue is the last in which it does. The board's answer is that the clause was never reached: a qualifying event has to be documented at the grade the Standard requires for a rating action, and a single-source account with unnamed victims and no dates is not (CGS-3.3, CGS-6.2). The condition is re-adjudicated at Issue 41 under v1.3. If by then the account is confirmed by a victim or a second firm, or a second independent production case is counted, the condition moves to STRENGTHENING; the same evidence at its present grade holds where it is. Decision record CHQ-DEC-2026-SC004-TIMING.

Condition entry announced. The board will add an eighth condition at Issue 41: Agent Authorization Boundary Failure, for agents that exceed their own sanctioned reach with no attacker present. The autonomous-operations condition returns to attacker operations by scope refinement in the same issue, and its containment-escape sub-class and the two counted instances transfer to the new condition. The Gemini candidate transfers with that sub-class. The Medicare candidate, held for routing strain because it fits neither existing sub-class, is routed directly to the new condition when it takes effect. The new condition enters at STRENGTHENING under v1.3. It is declared now with an effective date after the instances that prompted it are disposed of (CGS-11.4), and the Position on agent containment (CHQ-P-2026-017) is re-homed to it by amendment in the same issue. The board records the argument against: three of eight conditions on one subject. The evidence carries it; the three failures need three different controls.

Position issued. CHQ-P-2026-017 v1.0 is active: Agent Runtimes Are Deployed Without Containment Proportionate to Their Demonstrated Capability to Escalate and Move Laterally, issued under the evidence sufficiency gate on the two founding instances, rated EMERGING by its own evidence state, with falsification criteria declared and an adversarial paragraph carrying the one-operator objection. Its reinforcement clause names any primary-grade account of an escape at a second operator. The Gemini case answers that in shape and not in grade, and does not reinforce the Position until an operator or evaluator primary exists. The Medicare case is another OpenAI case and does not answer the single-operator objection; it also falls outside the Position's construct, which is the runtime boundary, since no sandbox was involved. The Position originates in the containment-escape sub-class that transfers to the new condition at Issue 41; under its amendment-only revision policy, v1.1 will re-home it to SC-2026-011 in that issue, with the two founding instances unchanged and the evidence docket carried forward. Nothing in v1.0 changes before then.

Intake. Thirteen recorded runs since Issue 39, including two weekend runs. Catalog census 1,728. Admissions matched the versioned catalog at one day's lag throughout. One non-catalog item was caught eleven days late: Mandiant's report, published on 16 September, entered the record on the 27th. The research-roster pass that should have reached it was declared partial on the 23rd; the roster moves to a fixed-URL fetch list with Mandiant as its first entry. The public methodology page was found to carry pre-v1.2 scale text while v1.2 has applied since 18 August; the page is corrected and the drift recorded (CHQ-METH-PAGE-RECON-2026-001).

Applied criteria, by version. Rating scale v1.2 (last issue in force); Ratings Methodology v1.3 (declared 25 Sep 2026, effective 6 Oct 2026); Watch and Outlook v1.0; state machine, pause and reset v1.0; ceiling-consequence rule v1.0; SC-2026-010 independence unit v1.0; SC-2026-006 criterion v2.0; criterion-invalidation and void-action rule v1.0; sub-class accrual rule v1.0; CHQ Criteria Governance Standard v1.0.

For exploitation conditions, the confirmation threshold is confirmed real-system impact in production, whether the cause is a threat actor, an operator, or an autonomous system; each non-exploitation condition declares its own threshold in the registry. Under review is an analytical status, not a rating; the last valid rating remains displayed until a valid criterion produces a subsequent action.

Outlook describes the direction of evidence accumulation in the trailing window: Accumulating, Stable, Receding. It is not a prediction. Watch indicates a defined reclassification trigger is mechanically near, and is directional; when proximity exists in both directions, both are shown.

Scale v1.2 is printed above and applies to this issue. From Issue 41, v1.3 applies: a single qualifying event enters at STRENGTHENING, and Outlook is assigned by counted rule over a 28-day window. The change record is published in the doctrine collection.

This week the board had evidence that pointed where it wanted to go and a rule in force that would have let it move, and it did not move, because the evidence was not at the grade its own standard requires. It also found that two of its categories were drawn on the wrong variable and added a condition rather than stretching a sub-class to fit. The question for the reader is about your own classifications: when an event arrived that did not fit your incident taxonomy, your risk register or your severity scale, did you add a category or stretch one, and can you point to where that decision is written down?

Three questions for your own program this week. If your NetScaler was patched in August, can you state the build number, and does it cover Sunday's bulletin? For your developers' coding assistants, do their recommendations pass through the same allowlist your package installs do, and are their hooks signed? And for the last vendor advisory you triaged as low severity, has the severity been revised since, and would you know?

CybersecurityHQ publishes independent structural intelligence for security leadership. Conditions, positions, and falsification criteria are maintained at record.cybersecurityhq.com. Ratings reflect observable structural conditions at a point in time. They are not forecasts and do not assess applicability to any specific organization's environment.