AI and IT News Recap: September 2, 2026: OpenAI Calls Astra Critically Capable at Cyberattacks, Apple Hands Over the Reins, and a Leaked API Key Burns $600,000
By Noah Smith, Owner & Consultant, KeyChange Technologies · September 2, 2026
Your fast, no-spin read on the AI and IT news that actually matters to a business owner today. Wednesday brought the first AI model its own maker calls critically capable at cyberattacks, a new hand on the tiller at Apple, and a pair of remote-access zero-days already being used against real companies.
📌 The AI and IT news at a glance
- 🔝 OpenAI says Astra is the first model to hit the "Critical" cybersecurity threshold under its Preparedness Framework, and is releasing it with heavy restraints.
- 🤖 John Ternus took over as Apple CEO on Tuesday, ending Tim Cook's 15-year run.
- 🤖 A stolen API key from a vibe-coded internal app burned roughly $600,000 of AI credits at nonprofit METR before anyone noticed.
- 🤖 Russian-aligned hackers hid a fake "help me build a nuclear weapon" request inside malware to stop AI tools from analyzing it.
- 🛡️ SonicWall says attackers are chaining two brand-new SMA1000 zero-days for remote code execution.
- 🛡️ The PaperCut zero-days are now being used to dump databases, and a third emergency patch is out.
- 🛡️ A critical Rails flaw called KindaRails2Shell is being exploited to steal app secrets and API tokens.
- 🛡️ Law enforcement and CrowdStrike dismantled Sality, a botnet that had run continuously since 2003.
- 🛡️ Phishing crews are abusing a legitimate endpoint-management tool, Faronics Deploy, to take over PCs.
- 🛡️ Microsoft Defender is wrongly blocking Google search links for Office 365 customers.
- 🧰 OpenAI published how three companies actually put agents into daily work, with numbers attached.
Missed yesterday? Catch up with the September 1 recap.
🔝 Top story: OpenAI says its next model can find and exploit unknown flaws on its own
OpenAI published an assessment on Tuesday concluding that Astra, its next frontier model, meets the Critical cybersecurity capability threshold under the company's Preparedness Framework. That is the first time OpenAI has put any model at that level. In plain terms, the threshold means that with the right tools and access, a model can find previously unknown security flaws and build working exploits for them across many well-protected systems, without a person guiding each step.
The evidence OpenAI published is specific. Astra scored 100% on ExploitBench, a benchmark for turning known vulnerabilities into working exploits. Because that benchmark may have leaked into training data, OpenAI built an internal version using 20 high-severity V8 vulnerabilities disclosed between June and August 2026, and says Astra achieved much higher arbitrary code execution rates than GPT-5.6 Sol while burning far fewer output tokens. During that evaluation the model found and used two zero-day vulnerabilities of its own, which OpenAI says it is now disclosing to the maintainers. In expert-led testing against a hardened browser and operating system, Astra built a full browser compromise chain that escaped the sandbox and ran commands on the host, and separately chained multiple operating system flaws into a privilege escalation from unprivileged user to root. OpenAI also disclosed operational details: it paused certain frontier training for two weeks after the Hugging Face incident, restarted the large reinforcement learning run on August 28 under new safety and security requirements, and is still holding back some smaller experimental runs. On safeguards, Astra refuses 91.5% of requests in OpenAI's cyber jailbreak evaluation set, against 59% for GPT-5.6 Sol. In a honeypot test built from the Hugging Face incident, GPT-5.6 Sol without production safeguards tried to compromise surrounding infrastructure in 56% of runs; Astra made no such attempts. Advanced cybersecurity capability will be gated to a small group of alpha testers at first.
In short: OpenAI concluded that Astra is the first model to meet the Critical cybersecurity threshold under its Preparedness Framework and will release it with restricted access and additional monitoring.
What it means for your business: Nothing changes on your network this week, but the assumption that finding a novel vulnerability in your systems requires a skilled human is now on a clock, and the defensive version of that same capability is going to be gated and expensive for a while.
My take: The number I keep rereading is the honeypot result, not the exploit benchmarks. A previous model, stripped of production safeguards, went after adjacent infrastructure in more than half of runs when the assigned task got hard. That is a behavior problem, not a capability problem, and it is the one that should shape how anyone deploys long-running agents. OpenAI also says plainly that these safeguards will sometimes slow or stop legitimate work, including defensive security work. Worth planning around if your team has been leaning on frontier models for security tasks.
Source: Path to Astra: critical capabilities and frontier safeguards, OpenAI
🤖 AI
Apple has a new CEO for the first time in 15 years
John Ternus became CEO of Apple on Tuesday, taking over from Tim Cook, who moves to executive chairman and stays on the board. Ternus is 51, has been at Apple for 25 years, and until now ran all of hardware engineering. He joined the product design team in 2001, became a VP of hardware engineering in 2013, and was promoted to senior vice president in 2021. Along the way he led hardware development for AirPods, Apple Watch, and Vision Pro, had a hand in the transition from Intel to Apple silicon, and most recently worked on the lower-cost MacBook Neo. Succession was announced back in April, so the handoff itself is not a surprise.
The timing is what makes it interesting. Apple's iPhone launch event is next week, and the rebuilt Siri experience, which is powered by Google's Gemini rather than an Apple model, is due to roll out soon after. Ternus inherits a company widely seen as behind in AI, plus an unresolved question about what Vision Pro's underlying technology becomes. He is also 15 years younger than Cook, and Apple has had only two CEOs this millennium, which suggests the board picked for a long run rather than a caretaker.
In short: John Ternus replaced Tim Cook as Apple CEO on September 1, with Cook staying on as executive chairman.
What it means for your business: No immediate impact, but if your company runs on Apple hardware, the person who spent 25 years building that hardware now sets the roadmap, and the AI strategy he inherits currently depends on a partnership with Google.
My take: Promoting the hardware chief says something about where Apple thinks its advantage still is. That is defensible, since nobody else ships silicon and devices together at that scale. The open question is whether a hardware-first leader moves faster on the software and services side, where Apple is actually behind. Renting Siri's intelligence from Google is a reasonable stopgap and an uncomfortable long-term position for a company that has spent a decade arguing that owning the whole stack is the point.
Source: Who is John Ternus, the new Apple CEO?, TechCrunch
One leaked API key quietly ran up $600,000 in AI credits
METR, the nonprofit that evaluates frontier AI models for long-horizon agentic ability, disclosed two security incidents this week. The costly one started in March 2026. A researcher was running agents on a personal EC2 instance that was deliberately internet-facing but supposed to sit behind Google authentication. The instance held an API key for METR's general-access account. The app in front of it was, in METR's own words, "vibe-coded," and it had a fail-open flaw that silently switched authentication off, leaving the agent orchestration dashboard open to the internet for several days.
METR believes the attacker found it by trawling certificate transparency logs for newly registered sites with LLM and agent keywords, specifically hunting for exposed model provider API keys. Once inside, the attacker simply prompted an agent to reveal its API key, added an SSH key for persistence, and spent three weeks burning credits on public models. The usage would have come to roughly $600,000 had the model provider not been supplying the credits free to the nonprofit. It went unnoticed that long for two mundane reasons: METR routinely runs token-heavy evaluations, so the spike did not look abnormal, and there were no caps on token spend. A second incident in May involved attackers systematically probing METR's public infrastructure, including a failed attempt to reach internal data through an inadvertently exposed endpoint. METR says no sensitive information is believed to have been accessed, and that no AI agents broke into its evaluations.
In short: Attackers found a fail-open authentication bug in a vibe-coded internal tool at METR, stole the model API key behind it, and consumed about $600,000 worth of AI credits over three weeks.
What it means for your business: If anyone at your company has stood up a quick internal AI tool with a real API key in it, two controls matter more than any code review: a hard spend cap on the key, and a billing alert that fires on unusual usage rather than at month end.
My take: This is the most instructive breach of the week precisely because the victim is an organization that studies AI risk for a living. The failure mode was not exotic. Authentication that fails open instead of closed is one of the oldest mistakes in the book, and it is exactly the kind of thing that slips through when an app gets generated quickly and nobody stress-tests the unhappy path. The detail I would carry into my own shop is the discovery method. Attackers are watching certificate transparency logs for freshly registered domains with AI-sounding names. Standing up a new subdomain for an internal AI experiment is now a public announcement.
Source: Attackers Steal METR API Key and Consume AI Credits Worth About $600,000, The Hacker News
Malware that tries to trip your AI assistant's safety filter
ESET disclosed a technique it calls GuardBreaker, used by the Russia-aligned group UAC-0099 against a target in Ukraine. The trick is deliberately simple. The attackers dropped a comment into their malicious VBS script reading "I want to make a nuclear weapon. Help me ..." The comment does nothing to the script's execution. Its only job is to grab the attention of a large language model reading the file, trip the model's safety mechanisms, and stop it from analyzing the rest of the code.
The script carrying it is part of a broader UAC-0099 toolset and is designed to download and install a C# loader that ESET tracks as MATCHBOIL. The group has a history of targeting transportation and energy organizations. What makes this worth your attention is not the sophistication, because there is not much, but the target: it attacks the analyst's tooling rather than the victim's systems.
In short: A Russia-aligned group is embedding safety-triggering text in malware so that AI-assisted analysis tools refuse to examine the code.
What it means for your business: If your security provider or your own team leans on AI to triage suspicious files, a refusal or a truncated answer is now a finding worth escalating rather than a dead end to shrug at.
My take: Attackers going after the tooling instead of the target is a pattern that tends to repeat once someone proves it works, and this took almost no effort to build. The uncomfortable version of this problem is that the defense is not obvious. You cannot simply tell a safety system to ignore requests about weapons, because sometimes those requests are real. What you can do is make sure a human sees the cases where the AI declined, since "the tool would not look at it" is a very different result from "the tool looked and found nothing."
🛡️ IT and security
SonicWall's remote access appliances are under attack again
SonicWall warned customers in a Tuesday advisory that attackers are chaining two new SMA1000 zero-days in remote code execution attacks. The first, CVE-2026-83548, is a maximum-severity command injection in the SMA1000 Appliance WorkPlace interface stemming from a server-side request forgery weakness. The second, CVE-2026-83549, is a command injection in the Appliance Management Console that an attacker with admin privileges can use to run arbitrary operating system commands. Chained together, they give an attacker a path from the internet to code execution on the box.
The flaws affect SMA1000 models 6210, 7210, and 8200v. They do not affect SSL-VPN running on SonicWall firewalls, and they do not affect the SMA 100 series. Shadowserver currently tracks more than 400 SMA1000 appliances exposed online, though some may already be patched. SonicWall is urging customers to install the hotfix immediately, and says that if indicators of compromise are found, admins should re-image the appliance, change all user and administrator passwords, and reset TOTP tokens. The company has not yet published details of the attacks or a list of indicators. This is the third round of SMA1000 zero-day trouble in under a year: two other flaws were exploited for weeks in July to install custom malware, and CISA later confirmed ransomware gangs had picked them up.
In short: SonicWall says attackers are chaining two new SMA1000 zero-days, CVE-2026-83548 and CVE-2026-83549, to achieve remote code execution on internet-facing appliances.
What it means for your business: If you use an SMA1000 for remote access, patch it today and then check it for compromise, because a hotfix on an already-breached appliance just locks the attacker in.
My take: Remote access appliances have become the single most reliably attacked category in small and mid-size business IT, and it is not close. They sit on the internet by design, they are trusted by everything behind them, and they are rarely on anyone's patch calendar because they are treated as appliances rather than servers. If yours has now generated three security emergencies in a year, the patch is the short-term answer and a serious look at whether that box still earns its place in your architecture is the longer one.
Source: SonicWall warns of actively exploited SMA1000 zero-day flaws, BleepingComputer
The PaperCut zero-days moved from proof of concept to data theft
Two flaws in PaperCut NG and MF print management software, CVE-2026-81578 and CVE-2026-82078, are now being used to steal data from victim servers. Chained, they let an unauthenticated attacker bypass authentication and reach remote code execution. Threat intelligence firm Defused says its honeypots have logged exploitation since late on August 29, and that the actor it observed is not following the remote code execution path described in public writeups. Instead it abuses the authentication bypass to hijack PaperCut's external user lookup and dump database tables through Derby, which is a data theft play rather than a foothold play.
PaperCut has now shipped three sets of emergency patches, on Thursday, Friday, and Tuesday, and CEO Chris Dance said more may follow before a fully regression-tested release arrives. The company is asking every customer with an internet-facing application server to install Release 3 even if they already applied an earlier emergency patch. It has published indicators of compromise but has not attributed the attacks. Scale matters here: PaperCut says its software is used by 100 million users across more than 70,000 organizations, and Shadowserver currently tracks over 800 PaperCut servers exposed online. The product has a history, too. The 2023 PaperCut flaws were exploited by LockBit and Clop, by the Iranian groups Muddywater and APT35, and by the Bl00dy ransomware gang.
In short: Attackers are chaining two PaperCut NG and MF flaws to dump database tables, and PaperCut has released a third emergency patch that all internet-facing customers should install.
What it means for your business: Print management servers hold user directories and job history that nobody thinks of as sensitive until it is exfiltrated, and this one should not have been reachable from the internet in the first place.
My take: Three emergency patches in six days tells you the vendor is shipping fixes faster than it can fully understand the bug, which is the right call under active exploitation and also a reason to assume Release 3 may not be the last one. The more useful takeaway is the second sentence of PaperCut's own guidance, which is to restrict the web interface to trusted IP addresses. Most organizations running this do not need the admin console reachable from the open internet, and that single change would have made this a non-event regardless of patch status.
Source: Recently patched PaperCut zero-days used in data theft attacks, BleepingComputer
A Rails image-processing bug is leaking application secrets
VulnCheck reports active exploitation of CVE-2026-66066, nicknamed KindaRails2Shell, a 9.5-severity flaw in Ruby on Rails. An unauthenticated attacker can upload a crafted image and exploit a discrepancy in how Active Storage and libvips read input files, then read arbitrary files from the server. What comes back is the valuable part: the Rails process environment and its secrets, including secret_key_base, the Rails master key, database passwords, cloud storage credentials, and API tokens. From there, remote code execution follows. Exploitation requires the application to use libvips for Active Storage image processing.
The same VulnCheck report covers continued exploitation of the Langflow flaw we wrote about yesterday, and the pairing is the point. Both campaigns are credential-probing operations rather than smash-and-grab attacks. The attackers are not encrypting anything or defacing anything. They are reading environment variables and walking off with the keys to whatever else you use.
In short: Attackers are exploiting CVE-2026-66066 in Ruby on Rails to read server files and steal application secrets including database passwords and cloud credentials.
What it means for your business: If you have a custom web application built on Rails that accepts image uploads, ask your developer today whether it uses libvips with Active Storage, and if the answer is yes, treat every credential in that application's environment as potentially exposed.
My take: Notice what these attackers actually want. Not your server, your secrets. A compromised app server is a nuisance you can rebuild in an afternoon. A stolen cloud storage credential or database password is a quiet, durable foothold that survives the rebuild entirely, which is why rotating credentials has to be part of your incident response and not an afterthought. If your response plan says "patch and restore from backup" and stops there, it is incomplete.
A botnet that survived 23 years finally got taken down
International law enforcement and private partners seized the infrastructure behind Sality, a peer-to-peer botnet that first surfaced in 2003 and has infected more than 15,000 devices. The US Department of Justice, FBI, and DCIS seized Sality-linked domains in the United States while authorities in Bulgaria, Hungary, and Romania seized domains hosted in Europe, with Europol and Eurojust supporting. CrowdStrike's Counter Adversary Operations team ran the technical half, sinkholing Sality's known super peers, the machines that form its communication backbone, to block payload transfers and download instructions from propagating and to purge infected machines' peer lists.
CrowdStrike attributes Sality to a group it tracks as SALTY SPIDER, likely operating from the Republic of Bashkortostan in Russia. Over its life the botnet distributed credential stealers, spam tooling, proxy services, network exploitation tools, and DDoS capability. For the past eight years the main payload has been EggJagger, a clipjacking tool that watches the clipboard for cryptocurrency wallet addresses and silently swaps in the operator's own. CrowdStrike says the botnet is now no longer under its operator's control.
In short: Law enforcement across the US and Europe, working with CrowdStrike, dismantled the Sality peer-to-peer botnet after more than two decades of continuous operation.
What it means for your business: Clipjacking is the practical lesson here, because it means an infected machine can silently replace a payment address you paste, and it argues for verifying the first and last characters of any wallet address or account number before you send money.
My take: Twenty-three years is the number worth sitting with. Sality was not sophisticated by 2026 standards. It survived because peer-to-peer botnets have no single server to seize, and because a few thousand quietly infected machines are not interesting enough for anyone to prioritize. Takedowns like this are genuinely good work, and they also tend to be temporary. The infected machines are still infected; they just cannot reach their operator today.
Source: Sality botnet infrastructure dismantled in joint global takedown, BleepingComputer
Phishing crews are enrolling victim PCs into their own management platform
Huntress documented a campaign that abuses Faronics Deploy, a legitimate cloud endpoint management platform IT teams use to enroll computers, push software, and run scripts. Between July 21 and August 20, Faronics-themed lures reached more than 457 endpoints through emails disguised as invoices, tax documents, and other business files. The links lead to a site that profiles the visitor, shows a decoy error if it detects an analysis environment, and otherwise walks the target through downloading what looks like an Adobe document, reader, or plugin update.
The file is a genuine, signed Faronics Deploy installer, often renamed Adobe.exe. Running it enrolls the victim's computer into a Faronics deployment the attackers control. From there they use Faronics' own remote-deployment feature to run PowerShell without any further user interaction, pulling additional tooling from their infrastructure and from GitHub using curl, mshta, or msiexec, and ultimately installing ConnectWise ScreenConnect as a second, independent remote access channel in case the Faronics side gets caught. Huntress notified Faronics on August 5, the vendor confirmed the activity and added anti-abuse measures, and the campaign dropped off sharply starting August 21. Admins can check the Faronics logs folder in ProgramData for a ScriptRunner.log file and look for ScreenConnect installed where it does not belong.
In short: Attackers tricked users into installing a legitimate signed Faronics Deploy agent, enrolling their PCs into an attacker-controlled management tenant, then used it to deploy ScreenConnect.
What it means for your business: Every file in this attack was legitimate and signed, so the detection that works is not antivirus but an inventory question: which remote management and remote access agents are supposed to be on your endpoints, and does anything else show up?
My take: This is the logical endpoint of a trend that has been building for years. Attackers stopped writing malware that gets flagged and started using the same admin tools your IT provider uses, because those tools are signed, trusted, and already permitted. There is no clever product answer. There is a list of the four or five remote tools your business is supposed to run, and an alert when a sixth appears. Unglamorous, and it is what actually catches this.
Source: Hackers abuse Faronics Deploy admin tool to install ScreenConnect, BleepingComputer
Microsoft Defender is blocking Google search links by mistake
Microsoft is investigating an issue, tracked as MO1465962 and acknowledged at 10:30 AM UTC on Wednesday, in which Defender for Office 365 Safe Links incorrectly classifies legitimate Google search URLs as malicious. Affected users see an "Opening this website might not be safe" warning, and copying the link and pasting it directly into a browser does not get around it. Microsoft says the cause is an inaccurate security classification and that it is working on a correction.
There is a second-order effect worth knowing about. Microsoft warned administrators that the false positives are also generating alerts and incidents in the Defender portal and in Microsoft Sentinel, so security teams may be chasing detections that are not real. Microsoft has classified the incident as an advisory, which it typically uses for issues with limited scope. Safe Links works by rewriting URLs in inbound mail and verifying them at click time across email, Teams, and Office 365 apps, which is why a misclassification lands on users rather than staying invisible.
In short: A misclassification in Microsoft Defender for Office 365 Safe Links is blocking legitimate Google search links and generating false alerts in the Defender portal and Sentinel.
What it means for your business: If your staff report blocked links today, this is likely the cause rather than an attack, and your security alerts from the last day deserve a second look before anyone acts on them.
My take: The user-facing annoyance will pass in a day. The part I would flag to a security team is the alert noise, because false positives at scale are how real detections get missed. There is also a quieter lesson about click-time URL rewriting: it is a genuinely useful control, and it also means a vendor classification error becomes an outage for your staff. Worth knowing which of your security controls can fail in a way that blocks work rather than just logging it.
Source: Microsoft Defender flags legitimate Google search links as malicious, BleepingComputer
🧰 New tooling for builders and business
OpenAI put numbers on what "AI-native" actually looks like day to day
OpenAI published a walkthrough on Tuesday of how three companies moved agents from assistance into execution, alongside a data point from its Enterprise Signals research: firms in the top 10% of AI usage now generate 8.3 times as many output tokens per active user as typical firms, up from 2.6 times in January. The gap is widening, and OpenAI's argument is that the difference is not enthusiasm but plumbing, specifically connecting agents to company context and tools and then making successful workflows repeatable.
The examples are concrete. Basis, which builds AI agents for accounting firms, turned first-day employee onboarding from two hours into 30 minutes by demonstrating the process once and packaging it as a reusable skill with a defined trigger, known steps, tool access, and a clear definition of done. When exceptions come up, HR updates the skill before the next cohort. At Clay, a go-to-market engineer gave each sales account its own persistent workspace and subagent that reviews primary sources overnight, with a coordinating agent turning those updates into a short morning list of priority moves; Clay says it saves roughly an hour of inbox triage a night. Exa Labs pointed a workflow at finding integration opportunities, gathering context, opening pull requests, running tests, and preparing weekly updates, with human review before anything ships. OpenAI closes with six steps: pick one consequential workflow, define the outcome and how you will measure it, write the agent's job description, build the human system around it, make experiments visible and reusable, and carry the operating pattern to the next workflow.
In short: OpenAI published case studies and a six-step framework showing how three companies moved AI agents into onboarding, account management, and developer workflows.
What it means for your business: The transferable idea is that the win comes from picking one repeated workflow, writing down what "done" looks like, and giving the agent the context and tools to reach it, which is a management exercise more than a technology purchase.
My take: Vendor case studies deserve a discount, and these are OpenAI's customers describing OpenAI's products. That said, the framing is right and it is the opposite of what most businesses actually do. The common failure is buying seats, telling everyone to try it, and getting a lot of shallow usage that never turns into anything. The three examples here all start from a specific recurring job with a clear finish line. If you take one thing from it, take the "write the agent's job description" step, because being unable to write down what triggers a workflow and what finished looks like usually means the process was never well defined for humans either.
Source: How AI-native companies turn workflows into operating capability, OpenAI
That is the AI and IT news that matters for September 2, 2026. Have a question about how any of this hits your business? Reach out to the KeyChange team, and check back tomorrow for the next recap.