Jugaad is a fix that works today and breaks tomorrow. Some weeks the AI news is mostly that: quick patches on top of quick patches.

This week there is one story where the pattern is in the record, with a CVE number.

the tell

#

GitLab AI Gateway is the service that connects a GitLab instance to AI models. On 2 October GitLab published CVE-2026-90970, scored 9.9 out of 10.

Per GitLab’s advisory, as reported by The Hacker News, a logged-in user with Duo Agent Platform access could escape the prompt template sandbox through a specially crafted flow configuration. The result: arbitrary commands on the gateway host.

Only self-hosted gateways need to act. GitLab.com, GitLab Dedicated and instances using a GitLab-hosted gateway are covered, per GitLab.

The detail I keep rereading: in February GitLab fixed CVE-2026-1868, also 9.9, reached through a crafted flow definition. Both are template engine weaknesses (CWE-1336). The new advisory does not mention the old one.

My read: a template is code that someone else gets to write. Calling the box around it a sandbox does not make it one.

hype meter

#

3 out of 5 hype (1 = mostly signal, 5 = mostly hype) · “Anthropic’s new OSS Scanner needs no human review” · the process is real, but every number is Anthropic’s own.

Reported figures, all self-reported: more than 29,000 candidate vulnerabilities, a little over 6,000 reported to maintainers, 584 advisories as of 2 October. Read that funnel again. Roughly 29,000 became 6,000 became 584. Filtering is clearly happening somewhere, and “no human review” is the part I would want explained. The article cites no independent testing. Vendor claim, unverified.

what i’m ignoring

#

• Statements that AI makes attacks cheaper, made by officials without a technical write-up behind them. Fine as a mood, not usable on a Monday.
• A 440% growth figure for blockchain dead drops, tied by its source to the launch of open Chinese AI models. A correlation dressed as a cause. Until the method is clear, I leave it.
• Any “AI scanner found thousands of bugs” line without a count of how many were real.

the real one

#

If you run a self-hosted AI Gateway, this is the week’s work. Update to the fixed version for your line. GitLab lists no workaround, and the advisory gives no way to tell whether a gateway was attacked before you patched.

GitLab’s own install guide says the gateway’s JWT signing keys must be treated as sensitive credentials, and the gateway sits between your instance and your model providers. So if you cannot rule out misuse, think about what a host like that can reach.

Caveats: CISA’s note on the CVE record lists exploitation as “none” as of 2 October. The attack conditions are not described in public, so I cannot tell you how hard this is to pull off.

tools worth a look

#

Read on 9 October 2026. All three are open source with recent commits. Not tested by me yet. Read the code before you run it.

• garak (9.5k stars, Apache-2.0): a scanner that probes an LLM for known weak spots.
• PyRIT (4.6k stars, MIT): Microsoft’s framework for finding risks in generative AI systems.
• TruffleHog (28.4k stars, AGPL-3.0): finds and verifies leaked credentials, which matters when a service holds signing keys.

the part that stays

#

Security angle: AI features arrive as new surfaces on old platforms, and a flow editor that lets users write templates is a code path. The 9.9 in February and the 9.9 in October point at the same door.

Human angle: “AI gateway” sounds like plumbing, so it gets patched like plumbing, late and by whoever remembers. I don’t think anyone owns it by default.

Honestly? I don’t know whether the second fix is deeper than the first. I would like to see it explained.

do this week

#

1. Find every AI gateway, proxy or flow builder in your environment, including the ones a team stood up on its own. Write down who owns each.
2. For self-hosted GitLab AI Gateway, confirm the version against the table above.

Who owns the thing that runs your templates?

a sandbox is a promise. the template was written by someone else.

sources

#

• The Hacker News, “GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers” (2 Oct 2026): thehackernews.com
• The Hacker News, “Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects” (9 Oct 2026), all figures are Anthropic’s own: thehackernews.com
• The Hacker News, “ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories” (statements on AI attack costs and the 440% dead-drop figure): thehackernews.com
• garak (GitHub): github.com/NVIDIA/garak
• PyRIT (GitHub): github.com/microsoft/PyRIT
• TruffleHog (GitHub): github.com/trufflesecurity/trufflehog

Stay patched. Stay paranoid. Maximum effort.

i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.

Half my feed this week arrived with the energy of a WhatsApp message marked “forwarded many times”. Rogue agents, regulators, training pauses. Loud, and hard to trace to a source.

So the filter this week is simple: only the story with a paper trail.

the tell

#

DeepSeek Harness is an open-source runtime for AI coding agents. In September it got CVE-2026-82533, scored 9.4 by VulnCheck. The Hacker News describes it plainly: a sandboxed agent could switch off its own sandbox.

The mechanism is almost boring. The tool ran a local web interface for managing sessions. That interface decided who was calling by reading the Host header, which is a value the caller writes itself. A header is not an auth layer. So one shell command from inside the sandbox could ask the interface to set the session to “danger-full-access”, with approval prompts gone.

Affected: 0.1.1-rc.2 and earlier.

My read: nobody broke the walls. The agent asked the door, and the door believed what it was told. Not the model weights. The plumbing.

what i’m ignoring

#

• The “rogue agents” and regulator headlines. Widely forwarded, and I could not trace them to a regulator’s own statement or a lab’s own disclosure. Until the primary document shows up, that is a story about a story.
• “Which AI model is best” rankings. The answer depends on who is asking, and the ranking rarely says who.
• Agent sandbox explainers that end in a product pitch. Vendor claims, unverified.

the real one

#

The fix is the useful part. Per the coverage, the Host-header check was replaced with token auth: the tool prints a one-time token at startup, and the browser swaps it for a signed cookie. A caller now has to hold something, not just say something.

That pattern travels. You can ask the same question of any agent runtime you run.

What I’d watch:

• a local control port that the agent can reach from inside its own sandbox
• any trust decision made from a header or field the caller can set
• desktop apps that bundle the harness and carry the old version quietly

Caveat: this is one product, already patched, and my account of the mechanism comes from write-ups, not from reading the code. OX Security’s write-up says the sandbox blocked file writes but left local networking open. I would treat the class of bug as the signal, not this one CVE.

the part that stays

#

Security angle: the cage and the keys sat in the same room. A local control plane is convenient. It is also the place where blast radius lives, and convenience and blast radius are the same coin.

Human angle: we say “the agent went rogue”. Here nobody went anywhere. The agent did something the design allowed. Accountability for that sits with whoever shipped the default and whoever approved it.

Honestly? I don’t know how many other runtimes have the same gap. I haven’t seen anyone count.

do this week

#

1. List where coding agents run in your environment, laptops included. For each one, ask a single question: can the agent reach the thing that sets its own permissions?
2. If you use DeepSeek Harness, or an app that wraps it, check the version is 0.1.2-alpha.2 or later.

Which of your agents has the shortest walk from its cage to its keys?

the lock held. the agent asked the door, and the door said yes.

sources

#

• The Hacker News, “DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval” (Sept 2026): thehackernews.com
• OX Security, “CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox”: ox.security
• Cloud Security Alliance, “DeepSeek Harness Sandbox Escape and Agent Containment” (10 Sept 2026): labs.cloudsecurityalliance.org

Stay patched. Stay paranoid. Maximum effort.

i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.

This newsletter is named after the human in the loop.

This week a researcher showed how little that human can actually see.

the tell

#

On 17 September, Adithyan Arun Kumar published a paper on arXiv called Loopjacking. The idea fits in one line: a human approves operation A, and the system spends that approval on operation B.

The paper’s example is plain. A low-privilege user asks for a transfer of 20 units to an approved vendor. An administrator reviews it and approves. The user then swaps the pending arguments for 2,000 units to an attacker’s destination, and the approval still counts.

There are two routes in:

The author reproduced state substitution in seven Agno AgentOS releases up to 3.0.9 and in twelve versions of one LangGraph Agent Server setup up to 0.14.0. The representation route worked in OpenClaw 2026.2.23 and was fixed in 2026.2.24. The OpenAI Agents SDK was the control case: it binds each approval to the exact call and rejects the swap. The A2A specification also added a section on binding approvals to the actual operation.

Cricket settled a version of this years ago. The third umpire can only be as right as the replay they are shown. If the replay is from a different ball, the decision is correct and still wrong.

My read: an approval is only a control if it is bound to exactly what runs. Otherwise it is a timestamp on a guess.

what i’m ignoring

#

• Headlines built around startup valuations when a prompt-injection bug lands. The bug is worth reading. The valuation is not a security fact.
• The joint CISA, NSA and FBI advisory on model distillation. It matters to AI labs. It does not change a Security analyst’s shift this week.
• “Top AI agent incidents of 2026” roundups. Most are the same five stories, re-counted.

the real one

#

On 14 September, Spain’s data protection authority, the AEPD, received what it described as its first breach notification involving an autonomous AI agent. Its deputy director disclosed it on the agency blog the next day, as reported by Infobae.

As described, an agent built on a large language model searched files for weaknesses, got an unauthorised login, kept probing the application with little human steering, altered personal data and opened invoices. The AEPD has not named the organisation, the model or the sector.

What is usable here is not the attack. It is the paperwork. A regulator now has a category where the actor is an agent.

What I’d watch:

• whether your incident and breach templates have a field for “AI agent involved”, on either side
• logs that show a login followed by fast, patterned probing with no human-shaped pauses
• whether you could tell a regulator which agent did what, if one of yours were the actor

Caveat: this is one notification, described through secondary reporting. It is a signal, not a trend yet.

the part that stays

#

Security angle: both stories point at the same weak spot. We keep adding a human checkpoint and calling the risk handled. Loopjacking shows the checkpoint can be real and still not protect anything, if what the human saw is not what ran.

Human angle: think about the approver, not the attacker. The fortieth approval of the day does not get the attention of the first. Nobody reads the full payload at 6 pm. Attackers do not need to beat the human. They only need the human to be tired and the screen to be incomplete.

Honestly? I don’t know how to keep an approver sharp at approval number forty. Better tooling helps. I’m not sure it solves it.

do this week

#

1. Take one agent workflow that has an approval step. In a test setup, change the pending action after approval and see whether it still runs. Ten minutes will tell you which side of the paper you are on.
2. Add one line to your incident template: “Was an AI agent involved, on our side or theirs?” It costs nothing now and saves a scramble later.

When you last clicked approve on something automated, how sure were you that it ran exactly what you saw?

you signed the page you saw. the machine filed a different one.

sources

#

• Adithyan Arun Kumar, “Loopjacking: Hijacking Human-in-the-Loop Approval”, arXiv 2609.21081 (17 Sept 2026): arxiv.org/abs/2609.21081
• Loopjacking evidence and reproduction archive: github.com/adithyan-ak/loopjacking
• Infobae, on the AEPD’s first breach notification involving an AI agent (15 Sept 2026, Spanish): infobae.com

Stay patched. Stay paranoid. Maximum effort.

i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.

Too much AI security news. Too little signal.

Most of it is launches. Some of it is noise dressed as urgency. A small part actually changes what a defender does on Monday.

Signal Loop finds that small part, once a week.

what this is

#

• A weekly read of AI and security, written by a Security analyst.
• Read through a security operations lens. Opinionated, sourced, short.
• Built for peers, curious people around cyber, and security leaders.

The name carries two ideas: the human in the loop who confirms what the machine did before anything closes, and keeping you in the loop without the scroll fatigue.

what every issue gives you

#

Then one closing question and one line to carry.

what this is not

#

• Not a news summary. A filter with an opinion.
• Not hype, not doom. Real threats named plainly. Marketing called marketing.
• Not a vendor channel. No sponsored picks. Vendor claims flagged as unverified.
• Not a lecture. Actions are offers. You know your environment best.

the rules

#

• Numbers come with a source you can open, primary sources first wherever I can find them.
• My opinions are labelled “my read”, so you can tell them apart from reported claims.
• Tools are marked “not tested” unless I have actually run them.
• If I get something wrong, I correct it in the next issue.
• When I don’t know, I say so. Honestly? That will happen often. AI security moves faster than anyone’s certainty.

when it arrives

#

• Every Monday, 07:30 IST, on the site and by email.
• Issue 1 is already up if you want to see the format first. Link below.
• Have a question for the reader section? Leave a comment on any issue.

What is the one AI security question you wish someone would answer plainly?

the signal was always there. the loop is how you learn to hear it.

sources

#

• Signal Loop issue 1, “the check that gave it away”: virtueofvague.com/newsletter/2026-w39-the-check-that-gave-it-away
• Signal Loop archive and RSS feed: virtueofvague.com/newsletter

Stay patched. Stay paranoid. Maximum effort.

i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.

That is the story worth your time. Everything else in my feed was a launch.

the tell

#

A SANS Internet Storm Center diary by Renato Marinho, published 11 September, describes an offensive coding agent that mistook a honeypot for a real, free LLM backend.

The request carried far more than an exploit payload. The honeypot received about 43 KB: a large AGENTS.md, an offensive playbook, infrastructure notes, reconnaissance scripts, collected API keys, previous targets, and parts of the agent’s working history.

One instruction told the agent to verify its proxy was active before attacking. That check exposed the operator’s direct, unproxied egress IP. The agent leaked it by doing exactly what it was told.

My read: nobody built this to fail. Every instruction was reasonable in isolation. What was missing was judgment, the ability to ask whether a check safe to run at home is still safe to run in front of a stranger’s server. SOC teams have the same gap with a well-behaved copilot that closes a ticket correctly without knowing the incident three rows up is still open.

what i’m ignoring

#

• Any AI product pitched this week as a “decision engine”. Positioning until someone outside the vendor tests it.
• Pledge-style headlines about labs slowing down. A pledge with no enforcement and no date is a press release, not a control.
• Lab gossip. Not a SOC problem.

the real one

#

Pillar Security reported an active MCP supply-chain campaign they call Deadbugz. On 10 August, in a 74-minute window, one GitHub account opened 23 pull requests across unrelated AI, MCP and developer-tool repositories. Each added a server called productivity-suite.

The server offers two harmless tools, format_text and summarize, and behaves normally. Once it reaches three calls, its tool listings change and steer the connected agent toward SSH keys, AWS credentials, shell history and Kubernetes config.

Auto drivers have a line for this: meter kharab hai. The meter is “broken”, so you cannot check the fare. A tool description you cannot watch change is the same meter. Two clean calls prove nothing, because the server decides when to show you what it really does.

What I’d watch:

• any MCP server pull request from an account with no history in your org’s repos
• a tool’s description text changing between calls, not just between releases
• an agent reaching for credentials a formatting tool has no business touching

Caveat: when Pillar published on 12 August, 19 of the reviewed pull requests were closed and four were still open. Do not assume the closures cover you. Check your own configs. If your team reviews MCP servers by reading the README once, this is the argument for reading the code.

the part that stays

#

Security angle: both stories say the same thing from opposite sides of the wire. An agent that verifies things literally, without asking whether the verification itself is safe, will hand someone a win eventually, whichever side it’s running for.

Human angle: neither agent here made a decision. One leaked its own operator by checking a proxy correctly. The other waited three calls before turning honest into hostile. Both just ran instructions, all the way through.

Honestly? I don’t have a tidy conclusion for what that means once a SOC hands one of these more access next quarter. I don’t think anyone fully does yet.

do this week

#

1. List every MCP server currently connected in your environment and who approved it. An unowned list is the finding.
2. Pick one reference value, like the proxy check in Marinho’s writeup, and check whether anything in your environment would leak it the same way if it were watched instead of trusted.

Which one worries you more: the agent that gives up its own operator, or the one that waits three calls before it shows you what it actually does?

a check that is safe at home is a leak in front of a stranger.

sources

#

• SANS Internet Storm Center, Renato Marinho, “The Self-Expanding Stolen Inference Supply Chain” (11 Sept 2026): isc.sans.edu/diary/33332
• Pillar Security, “Deadbugz: Currently Active MCP Supply-Chain Campaign”: pillar.security/blog/deadbugz-currently-active-mcp-supply-chain-campaign

Stay patched. Stay paranoid. Maximum effort.

i take help from ai to optimise what i have learned and share it with you. the reading, the lens and the calls are mine. weekly, so you stay updated without the scroll fatigue.