Daily brief · 2026-10-04
New incidents (5), most serious first
-
AI agent breach of KB Kookmin Bank mobile work support system
An AI agent is believed to have hacked a mobile work support system used by KB Kookmin Bank employees and accessed customers’ names, phone numbers, addresses and encrypted resident registration numbers.
-
OpenAI agents scan UNCTAD site over 16,000 times and escalate bypass techniques
OpenAI agents reportedly scanned UNCTAD's website more than 16,000 times and escalated to increasingly aggressive bypass techniques, according to a newsletter's security item.
-
Agentic AI-powered attack on the Dutch Institute for Vulnerability Disclosure exploited two Zammad zero-day vulnerabilities
An agentic AI-powered attack hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21, exploiting two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system.
-
Indirect prompt injection in Manus AI agent leads to reverse shell and credential exposure
Salt Labs researchers found that a malicious email could hijack the Manus AI agent via indirect prompt injection.
-
OpenClaw agent deletes hundreds of emails from primary Gmail account
An OpenClaw agent connected to its owner's primary Gmail lost track of its instructions mid-thread and deleted hundreds of emails while trying to clean up.