A formula for when a model tips, OpenAI's agents at 100 organisations, 8.8 million Danes exposed through a partner's lawful access, two hours from exploit code to attack, and PwC counts who acts.
In this edition
- 01Researchers can now calculate when a model will turn.
- 02Wikimedia went looking for OpenAI's agents. The bill lands on volunteers.
- 03Nobody broke into Denmark's population register. Somebody logged in.
- 04Two hours from public exploit code to live attacks.
- 05Half say AI is their biggest gap. Seventeen percent give it to the CISO.
Get the next GRC Brief in your inbox.
Subscribe to The GRC BriefResearchers can now calculate when a model will turn.
Two researchers at George Washington University published a formula for the point at which a model tips into bad output. The cause sits in the attention head: accumulated conversation context drags attention towards an undesirable output basin until a threshold is crossed. Careless prompts do it as readily as malicious ones. It held across seven open-weight models. Their proposed fix is a warning light inside the model, checked before each output.
Source: Patterns (Cell Press) · Johnson & Huo, peer-reviewed paper
My take
Last week I dropped the word rogue. This is why. A threshold you can calculate and an indicator you can place is engineering, and engineering has owners. One caveat: they tested small open-weight models with the cloud filtering stripped out, so the numbers don't transfer to production. The mechanism does. Use the test it implies. Before an agent gets credentials, run it against vague and badly written prompts. Does it stay in its permissions, does it route around restrictions, does it escalate to a human. No answers, no autonomy.
Wikimedia went looking for OpenAI's agents. The bill lands on volunteers.
The Wikimedia Foundation ran its own investigation and published it. It found agents it believes OpenAI operates editing its wikis, mostly in sandbox areas, failing to turn a hosted note-taking tool into a proxy, and sending millions of automated requests to its public APIs, including hundreds of thousands of queries that may have contributed to a partial outage of the Wikidata Query Service in May. No compromise, and no sign the agents coordinated there. Two numbers around it: the foundation says 65 percent of its most resource-hungry traffic now comes from bots, and OpenAI has acknowledged over a hundred incidents across more than a hundred organisations.
Source: Wikimedia Foundation · S. Deckelmann, 5 Oct 2026
My take
A hundred incidents, a hundred organisations. I covered three this year, and only because somebody wrote those three up. Now look at who pays. The foundation says it is already absorbing the cost, its volunteers do the cleanup, and it is asking the companies profiting from these agents to help prevent and repair the damage rather than let it become the new normal. The problem it leaves you is attribution. If you expose a public API you cannot tell a research fleet from a hostile crawler, and your rate limits were sized for humans. Check what yours hands an unauthenticated client at volume.
Nobody broke into Denmark's population register. Somebody logged in.
Denmark's Central Population Register holds about 11 million records, and the ten-digit CPR number it assigns runs everything from tax to healthcare to banking. Attackers misused a private Danish company's legitimate access to search it, and walked away with the names, addresses and CPR numbers of roughly 8.8 million people, living, emigrated and deceased. That is about 80 percent of the register, in a country of six million residents. The register detected it on 2 October, notified the data protection agency on the 4th and went public on the 5th, cutting the company's access and calling in the police. People holding name and address protection were excluded. The actor has not been named.
Source: Help Net Security · Denmark CPR breach, 6 Oct 2026
My take
Nobody broke in. An account granted lawful access to look up named individuals was used to pull 8.8 million records, and the authorisation was valid at every single step. Nothing was watching the pattern of use. That is third-party risk in its purest form: you can vet the organisation, sign the contract, run the questionnaire, and still have no idea what its credentials are doing at three in the morning. And this harm does not expire. A CPR number is a permanent national identifier, so these people cannot rotate it the way you rotate a password, and the dead certainly cannot. Be fair on one point: Denmark runs MitID, so a CPR number alone does not let anyone impersonate you. It does make every phishing call sound legitimate, which is why the ministry is telling citizens to hand over nothing by phone or email even to a caller who knows their name, address and CPR number. If you grant any partner query access to identity data, go and find out this week whether anyone would notice a thousand lookups where there are normally ten.
Two hours from public exploit code to live attacks.
Atlassian disclosed CVE-2026-21589 on 5 October, rated 9.3: an unauthenticated attacker can read files inside the web root of eight self-hosted Data Center products, Jira and Confluence among them. watchTowr published analysis and exploit code the next day, showing that where Jira is wired to Crowd the file read becomes administrator access. Honeypots logged the first attempts two hours later, and a public scanning template followed.
Source: BleepingComputer · B. Toulas, 7 Oct 2026
My take
Two hours. Shorter than the gap between two change advisory board meetings. Ignore the comfort in needing the exact file path, because Atlassian paths are documented and identical in every deployment. This also sharpens advice I've given you twice. Prioritising by CISA's known exploited catalogue is a good filter, and it failed here: three days into live exploitation the flaw still wasn't listed. Your trigger is the combination. Internet-facing, self-hosted, public exploit code, scanning template in circulation. Patch on that. Where Crowd sits in the path, you are handling an identity incident.
Half say AI is their biggest gap. Seventeen percent give it to the CISO.
PwC surveyed 3,934 business and technology leaders across 71 countries. Half of security leaders name attacks on their own AI systems as the threat they are least prepared for, ahead of cloud, supply chain and ransomware. Seventeen percent make the CISO accountable for AI security. Forty-four percent say they lack the skills to oversee it. Twenty-one percent are implementing quantum-resistant measures.
Source: SecurityWeek · PwC survey, 1 Oct 2026
My take
Three numbers, one hole. The risk has a name, an owner nobody agreed on, and nobody qualified to review it. ISO 42001 is built around exactly those questions: who decides, who reviews, who answers afterwards. Then there is the 21 percent, against an EU expectation that member states have their cryptographic inventories under way by the end of this year. Harvest now, decrypt later means your clock started when the ciphertext was captured. Answer one question: does anything you hold need to stay secret for longer than your current cryptography will hold. Then build the inventory.