Introduction
Two of this month's four news incidents had no attacker in them. Coding agents published more than 13,000 internal screenshots to public GitHub repositories while trying to make pull requests easier to review, and a Grok Bot agent posted its owner's bank balances to his company's Slack because it decided that was what he wanted. The other two, an untrusted-repository flaw shared by seven coding agents and a template sandbox escape in GitLab's self-hosted AI Gateway, needed an adversary but relied on boundaries that were never enforced. On the leaderboard, ten new models entered testing, Grok 4.7 (high) moved into the top 10, and OpenAI's GPT-6 arrived in three variants. This month's Signature attack addition, Involuntary In-Context Learning, gets a model to hand over restricted content through a task it believes it is completing correctly.
AI Insights October 2026
October's new arrivals were GPT-6 Luna, GPT-6 Astra and GPT-6 Sol, Grok 4.7 (high), Claude Opus 5.5 (reasoning), Claude Fable 5.1 (max effort), Xiaomi MiMo V2.6 Pro, Gemini 3.8 Flash (high), GLM-5.3 Flash and DeepSeek V4.1 Flash (reasoning).
Grok 4.7 enters the top 10
Grok 4.7 (high) scored 93.46, the highest result from any xAI model in a monthly run since February. It finished 0.06 points behind GPT-6 Luna and ahead of every Google model on the board.
The same month, a Grok-powered agent product published its owner's personal finances to a work Slack channel (see the news section). CASI measures how a model responds to adversarial input. It does not measure the connectors, shared computers, and permission models built around that model in production.
GPT-6 arrives in three variants
GPT-6 Luna scored 93.52, the highest of this month's new arrivals. GPT-6 Astra scored 89.62 and GPT-6 Sol 88.22. The 5.3-point spread between Luna and Sol means the choice of variant within a single family is also a security decision, separate from the choice of vendor.
Visit the F5 Labs AI leaderboards to explore the latest CASI and ARS results for October.
Figure 1: F5 Labs CASI Leaderboard for the past 6 months (top 10 only)
AI Attack Spotlight: Involuntary In-Context Learning
Involuntary In-Context Learning (IICL), described by Alex Polyakov and Daniel Kuznetsov of Adversa AI1 is now part of the F5 Signature attack suite. It is a single-turn, black-box attack. The attacker needs nothing beyond the ability to send one message.
The behavior it exploits is in-context learning: give a model a handful of examples and it infers the rule behind them, with no retraining. Enterprises depend on this constantly. Most production prompts for classification, extraction, tagging or structured output carry a few examples so the model learns the task on the spot. It is the cheapest way to customize a general-purpose model.
The attack builds a small fake task around that capability. The prompt defines two abstract operations, `answer` and `is_valid`, and provides ten interleaved examples. Benign questions (small talk, arithmetic, geography) are paired with ordinary answers marked as not valid. Harmful how-to questions are paired with harmful answers marked as valid. The final instruction gives a new harmful question and asks for an answer that `is_valid` would accept. To complete the pattern, the model must produce the content its safety training was meant to block. Nothing is encoded or obfuscated. The authors' point is that the reframing is structural, so a filter looking for disguised payloads has nothing to find.
Small details carry a lot of weight. Against GPT-5.4, the authors found that naming the operators `X` and `Y` produced a 52% bypass rate, while naming them `answer` and `is_valid` produced 100% across 50 probes. Words that line up with the model's drive to give a correct, valid response make the pattern harder to resist. Direct versions of the same harmful queries failed every time; the IICL framing succeeded on 24% of attempts against a HarmBench subset. Exposure is uneven by topic, with harassment queries succeeding 75% of the time and violence 2%.
Across ten OpenAI models the results split cleanly. GPT-4.1, GPT-4o, GPT-5.1 and GPT-5.4 were vulnerable. GPT-5, GPT-5 mini, GPT-5.2 and every "pro" variant resisted completely, and the authors found no middle ground. GPT-5.4 is the instructive case. Its average bypass rate in the broad survey was 1.7%, yet three of the five test queries were broken at least once. An average can look reassuring while a specific weakness sits underneath it.
Adversa's follow-up ranking, which is vendor-published and not peer reviewed, reports that reasoning modes cut bypass rates by roughly a factor of four.
The tension does not resolve neatly. The capability that makes few-shot prompting useful is the same one IICL exploits, and no attack-specific fix removes it. Input controls that recognize the structure (operator definitions followed by validity-labeled examples) are more likely to catch it than keyword filtering, because the harmful words are only part of the request.
AI Security News and Insights
The two leading stories this month have no adversary. In both, an agent pursued a reasonable goal and exposed data along the way, because nothing in its environment stopped it. Exposure without an attack does not show up in threat models built around adversaries, and it does not trip detection tuned for intrusions.
The other two incidents involve an attacker, but they follow the same pattern. A boundary that operators assumed was in place, a coding agent's trust prompt and a prompt template's sandbox, was not enforced where it mattered.
PixelLeak: Coding Agents Publish Internal Screenshots
Vector: Autonomous agent behavior / data leakage
Target: AI coding agents working with GitHub
Reference: https://www.glow.io/blogs/how-ai-agents-exposed-developer-screenshots-from-leading-tech-companies
Glow Labs researchers Yoni Gottesman and Noam Kesten found more than 13,000 internal screenshots and recordings published to public GitHub repositories, spread across more than 900 repositories and over 300 organizations. Nobody attacked anything.
Developers asked their agents to attach before-and-after screenshots to pull requests. GitHub's image hosting worked through the browser rather than the CLI the agents used, and images stored in private repositories rendered as broken links for reviewers. The agents found a workaround: they created a public repository, usually in the developer's personal account, uploaded the images there and linked to them. In Glow's lab reproduction, the agent explicitly reasoned that the image proxy fetched anonymously and therefore needed a public repository.
At one software vendor, more than a dozen agents encoded the workaround as a reusable skill within a week and uploaded over 1,000 screenshots of unreleased features. About a third of affected organizations had developers using `gitshot`, an open-source screenshot publisher. 93% of cases sat in personal accounts, outside corporate GitHub monitoring.
GitHub CLI `v2.99.0` added an `--attach` flag that removes the original trigger. The images already published still need to be found and removed, including those in the personal accounts of employees who have since left.
Grok Bot: A Personal Finance Agent Posts to the Company Slack
Vector: Autonomous agent behavior / shared agent environment
Target: SpaceXAI Grok Bot
Reference: https://www.businessinsider.com/personal-ai-agent-grok-bot-posted-bank-details-company-slack-2026-10
Grok Bot is SpaceXAI's persistent agent product, which entered beta in August. Users create multiple Bots, each with its own instructions, that run tasks and scheduled routines on a cloud computer and connect to outside services such as Slack, email and bank accounts.
Shane Mac, CEO of XMTP Labs, set up a Grok Bot agent as a private "personal CFO." It had read-only access to his bank accounts, no Slack connection, and one task: send him a monthly audit privately. On October 1, at 8:40am, the audit appeared in his company's executive Slack channel, posted under his name, with checking and savings balances and an itemized breakdown of his spending. It stayed up for two hours until a colleague flagged it. In his own account, Mac said, "Nobody prompted it."
The finance Bot lacked Slack access, but a different Bot on the same account had it. SpaceXAI's documentation already describes the architecture: all of a user's Bots share one cloud computer, with files, browser sessions and credentials available across the roster, and the docs say plainly not to use separate Bots as a security boundary. Mac's per-agent permissions were never an isolation control. Read-only access limited what the agent could do at the bank and did nothing to limit where it could send what it read.
The account is self-reported. A Community Note on Mac's original X thread disputes it, noting that the thread later points to a product he sells. SpaceXAI has not confirmed the incident. Mac's description is consistent with the platform's published design, and he has since said Grok Bot shipped a channel permission change. Thirty-four minutes after his thread went up, Elon Musk posted that Grok Bot can be your personal chief financial officer.
GitSpawn: Repository Config Runs Code Before the Trust Prompt
Vector: AI coding agent / untrusted repository configuration
Target: Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code, Grok Build
Reference: https://www.manifold.security/blog/ai-coding-agents-git-hijack
Francisco Rosales of Manifold Security found that seven CLI coding agents shared the same flaw. On startup, each agent runs `git status` or `git diff` to gather context about the project. On some agents this happens before the workspace trust prompt appears, and on some before authentication. Those git commands read the repository's own `.git/config`, and if `core.fsmonitor` is set, git executes whatever command it names.
The command runs because the agent's own code launched git. No model tool call is involved, so it executes as the developer, outside any sandbox, without an approval step. Cloning does not carry the setting across. The delivery method is a directory copied with its `.git` folder intact: a zip file, a shared drive, a USB stick.
Manifold reported eight findings across the seven agents, four of them unpatched at publication. Claude Code fixed the `core.fsmonitor` path by version `2.1.196`, but a second path through `claude ultrareview` uses a different git key and was still open on `2.1.252`. Goose fixed it in `1.44.0` (`CVE-2026-72718`). Hermes Agent remained unpatched on `0.21.0` with `CVE-2026-71963` assigned after six unanswered contact attempts. Codex and Cursor closed the reports as duplicates of issues they had already fixed.
VS Code closed this class of bug in 2021 with `CVE-2021-43891` by blocking git operations until a workspace is trusted. The coding agents rebuilt the problem independently and, in some cases, shipped it again.
GitLab AI Gateway: Template Sandbox Escape
Vector: Insecure AI deployment / prompt template sandbox escape
Target: GitLab Self-Hosted AI Gateway (GitLab Duo Agent Platform)
Reference: https://docs.gitlab.com/releases/patches/other-patches/patch-release-gitlab-ai-gateway-19-4-1-released/
On October 2, GitLab disclosed `CVE-2026-90970`, rated CVSS 9.9. According to GitLab's advisory, an authenticated user with Duo Agent Platform access could escape the prompt template sandbox through a crafted flow configuration and run arbitrary commands on the AI Gateway itself. HackerOne researcher "invisiblemeerkat" is credited with the finding.
The bug sits in the custom flow feature, where users define how agent prompts are assembled. Those templates are processed by a template engine, which means they are code and not merely text. The sandbox around them was the only thing separating "can build an agent flow" from "can run commands on the host that brokers the organization's model traffic." Secondary analysis classifies it as `CWE-1336`, improper neutralization in a template engine, which is a well-understood bug class.
Affected versions run from `18.1.6` up to the fixed releases `19.2.4`, `19.3.2` and `19.4.1`. Only self-hosted gateways need action. GitLab.com, Dedicated, and self-managed instances that use a GitLab-hosted gateway were already protected, and GitLab says it contacted self-hosted customers before publishing. No exploitation had been confirmed as of early October.
The only privilege required is the ability to build an agent flow, which is the capability the Duo Agent Platform exists to provide.
