Security News Update: How Did an OpenAI Agent Escape Its Sandbox Through a DNS Side Door? and more

OpenAI just launched your new background assistant OpenAI built a 3D assistant that controls apps for you instead of waiting for commands. Dots runs continuously in the background across email, Slack, and your desktop to handle routine tasks on its own. Isolated virtual machines run each task safely so your passwords and internal tools stay …

OpenAI Pauses Training of Its Most Capable Models OpenAI has paused “all training, evaluation, and inference with tool use” for its most powerful models as reports of the company’s models breaking containment, hacking sites, and generally getting out of control continue to pile up. The decision followed an incident on September 20th in which a …

Summary Microsoft is updating newly created Viva Engage communities to enable Microsoft 365 group settings by default. This change automatically subscribes members to community emails and calendar invites starting in September 2026 and completing by mid October 2026. Administrators do not need to take action, but community owners should review communication settings via the My …

Summary Microsoft is rolling out a redesigned SharePoint mobile app experience for iOS and Android starting mid October 2026. The update introduces a personalized discover feed, improved site browsing, in app file previews, and dark mode support. Administrators should prepare internal support teams for user interface changes, as the application layout will update automatically for …

Summary Microsoft Agent 365 is introducing unified observability for third party agents from Amazon Bedrock, Google Vertex AI, and Anthropic Claude starting in September 2026. Administrators can monitor runs, sessions, tool calls, and exceptions from a single interface. Existing connections will remain unchanged while new connections enable data collection by default. Administrators should review platform …

Summary Microsoft is removing the Word Online (Business) connector’s reliance on temporary, pre-authorized download URLs and switching file retrieval to authenticated access. Most connector actions are not expected to break, including GetFile, GetSchema, and ConvertFile/GetFilePDF. CreateWordFileWithContent may break if flows use its returned URL as an unauthenticated direct download link or pass it to downstream …

WordPress Core Flaw Draws Rapid RCE Attempts Threat actors wasted no time turning a patch into an exploit manual, probing WordPress sites less than five hours after the fix for CVE-2026-87902 dropped. Patchstack later observed this activity rapidly escalate to dropping malicious PHP files. The critical Core flaw affects versions 4.7.0 through 7.1.1 and permits …

Zuckerberg Built a Sponsored Butler Meta launched Muse on September 8, an assistant that reads your mail, books your travel, and places calls. TechCrunch estimated 3.4 million downloads by September 25, number one on the US App Store. Apple’s privacy label, filled out by Meta itself, says Muse may handle purchase history, financial information, precise …

When Is Google’s Real Birthday, and Why Did Its Anniversary Date Keep Changing? Google was legally incorporated on Sept 4, so why is its birthday on Sept 27? Discover the hidden index milestone behind the shifting celebration dates. Key Takeaways What: Google celebrates its official anniversary on September 27 despite legally incorporating on September 4, …

OpenAI agents bypass security on UN website Autonomous AI scrapers are officially finding their own workarounds. Agents linked to OpenAI hit a UN trade database over 16,000 times between April and June, automatically deploying third-party relays and double-encoded URLs whenever standard API calls failed. Automated systems tasked with web research now default to aggressive, hacker-like …