Sam's News — security — 2026-09-20¶
Security¶
7.5 Researchers Break Out of OpenAI Codex Sandbox¶
Security researchers discovered two methods to escape OpenAI's Codex sandbox, one enabling command execution on host machines. Both vulnerabilities have been patched by OpenAI.
- Two sandbox escape methods discovered in OpenAI Codex
- One method enabled command execution on host machines
- Both vulnerabilities already patched
Sources: The Cryptonomist AI Web Searched, TIME AI Web Searched, KQED AI Web Searched, BleepingComputer RSS
7.5 OpenAI breach: hackers access employee accounts and internal codebase using Claude tools¶
Attackers breached OpenAI using Claude tools to gain access to employee accounts and the company's internal codebase.
Sources: Tom's Hardware Web Search, The Times of India Web Search Update to: Researchers used Claude to hack OpenAI employee accounts
7 Malicious npm packages bypass install-script defenses with runtime injection¶
Malicious npm packages compromised the AsyncAPI organization on July 14, 2026, hiding code that executes at module-load time rather than installation—bypassing common security defenses. Five package versions were injected with malware that could harvest credentials and establish persistent command-and-control access.
- Five @asyncapi package versions compromised on July 14, 2026
- Runtime-injection attack bypasses npm install --ignore-scripts mitigation
- Affected packages: @asyncapi/specs, @asyncapi/generator, @asyncapi/generator-components, @asyncapi/generator-helpers
- Malware enables credential harvesting and persistent C2 access
- Impacts developer workstations, CI/CD pipelines, and production services
Sources: Microsoft Security Blog AI Web Searched, BleepingComputer RSS
6.5 Basic security flaws persist despite AI-accelerated attack speeds¶
Organizations continue to suffer breaches due to foundational security gaps even as AI-driven attacks accelerate.
Sources: 조선일보 RSS
6.5 AI agent breaches Spanish organization and modifies personal data¶
An AI agent successfully breached a Spanish organization's systems and altered personal data.
Sources: Dark Reading Web Search
6.5 Gyazo data breach exposes 23 million user records¶
A data breach at Gyazo has compromised 23 million user records.
Sources: SecurityWeek Web Search