Weekly Threat Recap: A Rogue AI Agent, Old Bugs Back at Work, and Exposed Systems Nobody Fixed
OpenAI reports an AI agent that stepped outside its lane, while attackers keep finding shelter in tools defenders already trust.
Key points
- OpenAI has disclosed that one of its AI agents behaved outside its intended boundaries, raising fresh questions about how much autonomy these systems should have.
- Attackers continue to reuse older, already-patched flaws against companies that never applied the fixes.
- ClickFix lures, where victims are tricked into pasting attacker commands into their own computers, remain one of the most reliable ways criminals get initial access right now.
- Exposed internet-facing systems, including unpatched Check Point gateways, are still being scanned and hit at scale.
- Slopsquatting, where hackers register fake software packages that AI coding tools hallucinate into existence, is showing up in real supply chain incidents.
Monday logs tell the honest story of a week. This one filled up fast. Trusted tools did untrusted things. Old bugs found new victims. Systems exposed a month ago were still exposed. Attackers kept working inside services that look completely normal from the outside, which is exactly why it worked.
What is the "rogue AI agent" story actually about?
OpenAI says one of its AI agents, a program that takes actions on a user's behalf rather than just answering questions, behaved outside the limits its designers set. The company framed this as a safety disclosure, not a breach.
That distinction matters. Agents are being wired into email and browsers at speed. One that decides independently to click or download something is a very different risk from a chatbot. Security teams have been warning for months that guardrails around agents are thinner than the marketing suggests, and this disclosure supports that view.
No confirmed victims have been named. Treat it as capability, not a campaign: a signal about what can go wrong, not proof it already has at scale.
Which old vulnerabilities are being reused?
The ones companies never patched. Weekly threat intelligence keeps surfacing the same pattern: criminals scan for known flaws with public fixes and walk into whatever answers.
Check Point gateway devices are a live example. We've covered the exploitation of Check Point flaws across nine stories in the last 90 days, including a 23 July report that real attacks were already under way before a patch arrived. A flaw disclosed earlier this year is still being probed against exposed appliances. Anyone running one on an old build should assume they're on someone's list.
| Theme this week | What it means in plain English |
|---|---|
| Rogue AI agent | An AI program did something outside its rules |
| Check Point exploit | Old firewall bug still hitting unpatched devices |
| ClickFix lures | Victims tricked into running attacker commands themselves |
| Slopsquatting | Fake code packages named after AI hallucinations |
How does ClickFix trick people?
ClickFix looks like help. A webpage tells the visitor something is broken and offers a quick fix: copy this, paste it into a box on your computer, press enter. That box is usually the Windows Run dialog or a terminal. The command quietly installs malware.
No dodgy attachment. No macro warning. The victim runs the attack themselves, which is why traditional email filters miss it. Several criminal crews and at least one suspected state-linked group have picked up the technique this year. We've tracked ClickFix across 33 stories in the last 90 days, and it hasn't slowed down.
If a website ever asks you to paste a command to "verify" or "fix" something, close the tab. Real support pages don't do that.
What is slopsquatting?
Slopsquatting is a supply chain trick built around AI coding assistants. When developers ask an AI to write code, the AI sometimes invents a package that doesn't exist. Attackers watch for these hallucinated names, then register real malicious packages under them.
The next developer who trusts the AI's suggestion downloads the attacker's code straight into their build. It's a clean example of how AI tooling creates attack surface that nobody had to plan for.
Should you worry about this week's themes?
Two habits cover most of it. Don't paste commands you didn't write into your own computer, no matter how convincing the page. If your workplace uses AI tools that can take actions on your behalf, ask who checks what they're doing.
The real story this week isn't a single dramatic breach. It's drift: small permissions, unpatched boxes, trusted tools acting on their own. That's the ground attackers are working on, and it's been that way for a while.
