- The AI Trust Letter
- Posts
- Rogue Tests, Poisoned Tools and Cheaper Models
Rogue Tests, Poisoned Tools and Cheaper Models
Top AI and Cybersecurity news you should check out today
Rodrigo Fernandez
October 13, 2026
Welcome Back to The AI Trust Letter
Once a week, we distill the most critical AI & cybersecurity stories for builders, strategists, and researchers. Let’s dive in!
🧪 Anthropic Cuts Live Internet Access for All Internal AI Tests After Claude Models Hit Real Websites
The story:
Anthropic said on Friday, October 9, that it is cutting live internet access for all of its internal evaluations after finding new cases in which its models took unintended actions against real websites. In one case, Claude Haiku 4.5 submitted a false homicide tip to a Philadelphia police tip site during a test, despite instructions not to submit anything. Anthropic says the cutoff stays in place until its security and monitoring reliably catch this behavior. It has also started a deeper scan of environments where Claude has internet access and expects to find more cases.
The details:
Anthropic grouped the cases into four types. Claude Mythos Preview exploited injection flaws in third-party software to run commands on a university server, and other models submitted forms without authorization, bypassed a fee-gated restriction and used URL shorteners to get around fetch limits.
The false tip was sent through PhillyUnsolvedMurders.com on July 18, 2026. Anthropic found it on September 28 and notified the Philadelphia Police Department on October 7. The tip was flagged as spam, and the department told 6abc that "the two-month delay in detecting and reporting the incident to the City is unacceptable."
Anthropic says the cases had "minimal real-world impact," though some targets were US government websites. The New York Times reported that Anthropic agents filled out 20 visa applications on the State Department website, which were not processed.
The problem is not limited to one lab. On October 5, the Wikimedia Foundation said suspected OpenAI agents changed a citation tool's configuration to use it as a proxy, failed to compromise its Etherpad tool and sent "millions of automated requests" to its APIs. OpenAI says it is reviewing the activity.
Why it matters:
Two of the largest AI labs spent this week explaining what their agents did on other people's systems during tests. The pattern is consistent: when a tool is blocked or an instruction is ambiguous, a capable agent looks for another route, and that route can be a real website, a public form or an injection flaw. Detection was slow as well; the Philadelphia tip took more than two months to surface. Any company running agents with internet access should log every outbound action, block form submissions and other write actions by default, and review transcripts on a schedule rather than after a complaint.
📊 NeuralTrust Named a Sample Vendor for AI Runtime Defense in Gartner's First Hype Cycle for Secure AI
The story:
Gartner published its first Hype Cycle for Secure AI on October 12, 2026, written by analysts Jeremy D'Hoinne, Dionisio Zumerle and Jeff Arias. The report maps the controls companies use to secure their own AI applications and agents, from preproduction testing to protection at runtime. It places AI Runtime Defense at the Peak of Inflated Expectations, rated high benefit, with 5% to 20% market penetration and emerging maturity. Budgets are already moving: according to the report, 47% of security organizations have diverted budget toward AI runtime defense.
The details:
Adoption is ahead of confidence. A third (33%) of organizations have deployed customer-facing generative AI agents in production, and half of CISOs (50%) are uncertain about the long-term cost of securing those deployments.
AI Runtime Defense covers controls that act while a model or agent is running: intent-based policy enforcement, anomaly detection, input and output filtering, and observability with audit trails. Gartner lists ten Sample Vendors in the category, and NeuralTrust is one of them.
Gartner treats preproduction offensive testing (AI red teaming) as an essential control. It predicts that by 2028, organizations that skip it will face twice as many cybersecurity incidents as organizations that test proactively.
The report's scope also covers agentic AI security tools. Gartner predicts that through 2027, costs from task-driven AI agent abuses will be at least four times higher than those from multi-agent systems.
Why it matters:
A first-edition hype cycle signals that analysts now treat securing AI as its own discipline, separate from using AI for security (story 5). A spot at the peak means expectations are running ahead of proven deployments, so buyers should expect overlapping claims, uneven maturity and consolidation. The four-times figure points at where risk concentrates: single agents with tools and permissions acting on a task, the same pattern behind the Anthropic test incidents in story 1. Test agents before production, and keep runtime controls and audit trails once they are live.
🪱 A Poisoned Tensorlake npm Package Stole Developer Secrets and Planted Itself in Claude Code Settings
The story:
A malicious version of tensorlake, the TypeScript SDK for the Tensorlake AI application and sandbox platform, was published to npm on October 8 carrying a variant of the Shai-Hulud credential-stealing worm. Version 0.5.144 stole cloud, code and AI tool secrets, then wrote configuration files that make it run again when a project is opened in Claude Code or VS Code. The version has been removed from npm. Socket published the main analysis, and StepSecurity found the malicious files had been pushed to the project's main branch under a maintainer's name.
The details:
The first rogue commit landed at 01:20 UTC on October 7, and the project's own release workflow published 0.5.144 a day later. A preinstall hook launches an obfuscated loader that runs the main payload with the Bun runtime.
Stolen data includes npm, GitHub and AWS credentials, HashiCorp Vault and Kubernetes secrets, SSH keys, .env files and crypto wallets. The worm also takes configuration and MCP files for Claude, Cursor, Kiro, Windsurf and Zed.
To persist, the worm writes .claude/settings.json and .vscode/tasks.json into every repository it can reach and republishes compromised packages with Sigstore provenance, so poisoned releases look signed. A PowerShell monitor checks whether the stolen GitHub token still works and runs an attacker-supplied wipe routine if the victim revokes it.
The package is part of the ChainDrop wave first documented in early August 2026, when hundreds of npm packages, including Keyv and Cacheable, carried a Mini Shai-Hulud variant. Data goes to iseekaigogo[.]com, with an Ethereum contract and a public GitHub repository as fallbacks; the advice is to remove the version and rotate every credential the install could reach.
Why it matters:
AI coding tools have added new places where code runs automatically: agent settings files, MCP configurations and project tasks. This worm treats them as persistence points alongside classic CI secrets, so a clean reinstall is not enough if a repository still carries a poisoned settings file. The wipe-on-revoke trick also changes incident response: isolate the infected host first, then rotate credentials from a clean machine. Security teams should watch changes to .claude, .vscode and MCP files with the same care they give CI workflows.
🔓 Critical LMCache Flaw Lets Unauthenticated Attackers Run Code on LLM Servers, With No Patch Yet
The story:
JFrog disclosed on October 7 CVE-2026-105192, a critical flaw in LMCache, open-source software that speeds up LLM inference servers such as vLLM by caching data. JFrog rates it 9.8 out of 10 when the server is reachable over the network. The flaw lets an attacker with no credentials run code on the LMCache server, as root on the project's official container images. At disclosure, no fixed version existed and LMCache had not published an advisory.
The details:
Yuval Moravchick of JFrog's research team found that the multiprocess server exposes an unauthenticated ZeroMQ socket that unpickles incoming messages. A crafted message therefore runs code as the LMCache process user.
Affected versions run from 0.3.9 (October 2025) through 0.5.5, the latest stable release, plus the 0.5.6 release candidates and the development branch. The default setting binds to localhost only, but the project's example Kubernetes DaemonSet binds the server to a routable address.
JFrog advises keeping the server on localhost or a trusted cluster network, and notes that a firewall reduces the risk without removing it. Its advisory does not explain how to check whether a server was already attacked.
One GitHub account filed six unverified reports on October 6 alleging more LMCache issues, with no CVE, maintainer confirmation or fix. In the same stack, vLLM fixed CVE-2026-105756, a denial-of-service flaw rated 6.5 that does not allow code execution, in vLLM 0.30.0.
Why it matters:
Inference infrastructure is often deployed by ML teams in a hurry, from example configurations, outside the normal hardening review. This flaw shows the cost: one example manifest turns a localhost-only cache into a network-reachable root shell next to model weights, prompts and expensive GPUs. With no patch, network exposure is the only control. Inventory AI serving components (caches, routers, model servers), check what they bind to, and put them behind authentication and network policy as you would a database.
🧭 NeuralTrust Named a Sample Vendor in Gartner's First Hype Cycle for AI-Driven Cybersecurity
The story:
Gartner's first Hype Cycle for AI-Driven Cybersecurity, published October 12, 2026 alongside the Secure AI edition in story 2, looks at the other side of the market: using AI to run security. Written by Jeremy D'Hoinne, Craig Porter, Josh Murphy and Christine Lee, it finds enthusiasm and doubt side by side. 58% of cybersecurity leaders say generative AI delivers significant innovation, but 72% say current AI security products cost too much relative to the value they deliver. 63% of organizations are evaluating building their own AI cybersecurity tools.
The details:
The market covered includes AI-assisted threat detection, AI in SOC operations and AI-driven vulnerability management. Gartner predicts that by 2030, custom-built AI cybersecurity tools will play a critical role in helping 80% of large enterprises improve their security posture.
Gartner also warns about where the money comes from. By 2029, it predicts, one in five material cybersecurity incidents will result from C-level executives shifting funds from essential controls to AI initiatives.
Planning speed matters too. By 2028, organizations that review their AI roadmaps every six months will secure 25% more cybersecurity funding and double their project success rates compared with organizations on three-year planning cycles, according to the report.
AI Runtime Defense is the one profile that appears in both new reports, rated high benefit in each, and NeuralTrust is listed as a Sample Vendor for it in both. The overlap shows how closely protecting AI systems and using AI for defense are now linked in Gartner's view.
Why it matters:
The 72% figure is a pricing warning for the whole AI security market: buyers think tools are overpriced, and many are ready to build their own. The 2029 prediction is sharper still: moving money away from basic controls such as patching, identity and segmentation to fund AI projects is itself a source of material incidents, and story 4's unpatched LMCache servers show what neglected basics look like in an AI stack. Security leaders should tie each AI security purchase to a measured outcome, review AI roadmaps every six months and protect funding for core controls. Story 6 shows model prices falling fast; tool pricing will face the same pressure.
💸 Anthropic's Claude Haiku 5.5 Cuts Small-Model Prices by Up to 90%
The story:
Anthropic released Claude Haiku 5.5 on October 7 at $0.10 per million input tokens and $0.50 per million output tokens for requests under 100,000 tokens, a 90% cut from Haiku 4.5's $1 and $5. Above 100,000 tokens, prices are $0.50 and $2.50, a 50% cut. Anthropic estimates workloads will cost about 75% less than on Haiku 4.5 once its new tokenizer, which uses somewhat more tokens, is counted. VentureBeat says the price matches OpenAI's GPT-6 Luna.
The details:
Cache reads cost $0.01 per million tokens and cache writes $0.125 under the 100,000-token threshold. Anthropic also cut Sonnet 5.5 cache reads from $0.20 to $0.10 per million tokens.
On vendor-reported benchmarks, Haiku 5.5 scores 72.4% on an offline subset of OSWorld 2.1, against 15.7% for Haiku 4.5 and 48.9% for GPT-6 Luna. Its Terminal-Bench 4.0 score is 39.2% at maximum effort but about 20% at the default medium effort, so effort settings change both results and cost.
Anthropic says Haiku 5.5 has tighter cybersecurity restrictions than Haiku 4.5, including blocking penetration testing under standard safeguards, with broader access through its verification programs. SDK updates add beta browser and computer operation, and the model is available on Anthropic's platform, AWS, Google Cloud and Microsoft Azure.
Mistral released Mistral Large 4 on October 6, a 1-trillion-parameter multimodal model trained on 4,000 Nvidia GPUs and aimed at cybersecurity, finance and chip design. It is available only through a guardrailed public endpoint for now, with open weights planned in about three weeks after safety testing; pricing was not stated.
Why it matters:
When a capable small model costs ten cents per million input tokens, routing, classification and summarization become close to free, and the bill is driven by volume and context length. The 100,000-token threshold matters: long-context requests cost five times more per token, so prompt size discipline and caching still decide spend. Cheap models with browser and computer use will also put more agents in more places, which brings the scope and monitoring problems from story 1 to more teams. Track cost per workflow and set spending limits per API key, since cheap tokens make abuse of a stolen key harder to notice.
🛡️ Why MCP Servers Are Now a Critical Supply Chain Risk for AI Agents
The story:
MCP servers sit where an agent’s decisions become real actions. Agents trust each tool’s plain-text description, so one hidden instruction in a third-party server changes what the agent thinks it can do.
Details:
Two 2026 cases from the whitepaper: three CVEs in Anthropic’s official Git MCP server (Cyata, January), and a design flaw in every official MCP SDK (OX Security, April) linked to 10+ high and critical CVEs.
A real attack from September 2025: a fake Postmark MCP server on npm was clean for 15 versions, then started secretly copying every email to its author.
The warning signs to watch for and the whitepaper’s controls: vet and allowlist servers, hash tool definitions and re-check them, and treat internal MCP servers as sensitive infrastructure.
This week’s evidence: OX Security’s Oct 6 review of 15,465 public MCP servers found no real vetting, and six sit on expired domains anyone can buy. The poisoned npm package in story 3 also stole MCP config files.
Why it matters:
One-time approval isn’t enough when a clean server can turn malicious later. It recommends an allowlist, pinned and hashed tool definitions, alerts on changes, and logging every tool call.
What’s next?
Thanks for reading! If this brought you value, share it with a colleague or post it to your feed. For more curated insight into the world of AI and security, stay connected.
