Welcome back to This Week in AI Security. UN General Assembly week turned into an impromptu AI governance summit: a 20-country coalition, OpenAI, and the leaders of OpenAI and Anthropic each made a separate, competing pitch for who should set the rules for frontier AI — and pointedly, the US, UK, and China sat out the loudest of those pitches. Meanwhile, on the ground, security researchers demonstrated that Anthropic’s newest model could do in hours what its predecessor couldn’t do at all: chain two bugs together to break into OpenAI’s internal systems. Around that, a coding-agent vulnerability from earlier this month is still only half-patched, and Meta and OpenAI both shipped new products that make the same bet — bigger, cheaper, more autonomous agents — with very different ideas about how to keep them contained.

Regulatory & Governance: The UN General Assembly Becomes an AI Safety Summit

Twenty countries — but not the US, UK, or China — called for a new international body to oversee advanced AI. The September 21 joint statement, spearheaded by Finland’s Alexander Stubb and Norway’s Jonas Gahr Store and signed by Germany, Canada, Australia, South Africa, the UAE, and Singapore among others, calls for mandatory pre-deployment safety testing, shared technical standards, and an institution empowered to act “when capability thresholds are crossed.” Per NBC News, the statement explicitly cites “recent episodes of AI systems sidestepping safety protocols” as the trigger. The absence of the three countries that actually host frontier AI development is the story here as much as the statement itself — it’s a coalition of the willing, not the capable.

OpenAI countered with its own standards proposal, explicitly asking the US — not a new UN body — to lead. In “Building Standards for the Next Phase of AI,” published September 21, OpenAI called for US-led international technical standards covering three areas: measuring and managing recursive self-improvement (AI systems that meaningfully assist in building their successors), common incident-reporting protocols with shared severity classifications, and a coordinating role for national AI safety institutes — CAISI in the US, plus counterparts in the UK, Japan, India, and elsewhere. The next day, OpenAI followed up with “Priorities and Principles for Effective Third Party Assessments,” committing to give outside evaluators access across training, evaluation, and deployment; OpenAI says it’s in talks with groups including METR and Redwood Research, though no partner or access terms are finalized. It’s a direct, if quieter, follow-through on last week’s Amodei-Zuckerberg-Huang argument over slowing down — OpenAI is picking a side, and picking a US-centric one.

Sam Altman and Dario Amodei separately addressed the UN Security Council on AI risk, laying out visibly different theories of how cooperation should work. Per CNN and OpenAI’s own transcript of the September 23 session, Altman argued that consequential decisions should sit with “democratic institutions… accountable to the people they serve” — a framing that implicitly sidelines authoritarian states from setting the rules. Amodei proposed three narrower, more concrete mechanisms: a global ban specifically on using AI to help build biological weapons, verification systems so countries can check each other’s safety commitments, and a shared incident-notification system. Three governance pitches in three days, from three different directions, is a genuinely new dynamic — for most of this year the pressure has been “someone should do something”; this week it was “here specifically is my something, and it’s better than theirs.”

New Attack Surfaces: When the Agent Itself Is the Exploit

Security researchers used Anthropic’s newest model to hack into OpenAI’s internal systems in under 72 hours — and the same attack had failed for weeks on the previous model. Per TechCrunch and Hacktron’s own writeup, researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini chained a libheif image-processing flaw in OpenAI’s Discourse forum (CVE-2026-32882) with an SSO misconfiguration that let Discourse logins reach ChatGPT and Codex accounts, ultimately reaching OpenAI’s internal code repository. The detail that matters: Claude Opus 4.8 failed to complete the exploit across multiple attempts, but Claude Opus 5 succeeded within hours of its release. This was authorized research — OpenAI patched the SSO flaw within 14 hours of disclosure and paid a $6,500 bounty — but it’s a clean, dated data point for a claim that’s usually made in the abstract: a single model generation upgrade turned an unworkable exploit chain into a working one.

A zero-click bug that lets a malicious plugin silently replace itself in AI coding agents is still only half-patched, three weeks after disclosure. Dubbed Plugin4Shell and disclosed September 17 by AIR Security researchers Or Nevo, Dor Granat, and Niv Hoffman, the flaw breaks SHA-pinning — the mechanism that’s supposed to lock an installed plugin to one specific, reviewed version — by exploiting the fact that a branch name can be crafted to look identical to a pinned commit hash on platforms like Bitbucket. It affected four of the most widely used AI coding agents: Claude Code, OpenAI Codex, GitHub Copilot, and Gemini CLI. Per Help Net Security, Anthropic patched Claude Code (2.1.179) and OpenAI patched Codex (0.146.0), but Google has deprecated Gemini CLI rather than fix it, and GitHub Copilot remains exposed with no patch timeline. “SHA pinning” is a real security control millions of agent users believe is protecting them right now — for two of these four tools, it currently isn’t.

Lab Releases: Cheaper Frontier Models, Kernel-Level Agent Security

OpenAI shipped GPT-6 Sol and GPT-6 Luna, bringing GPT-6 Astra’s capabilities to models priced at half of last generation’s rates. Per OpenAI’s announcement on September 22, both models carry over Astra’s training approach — including its alignment work — into faster, cheaper variants aimed at high-volume coding, computer-use, and professional workloads; Luna in particular is priced at $0.10/$0.50 per million input/output tokens in the API. The pattern worth watching isn’t the release itself but the cadence: frontier safety work increasingly ships downstream into cheap, high-volume models within weeks, which means whatever guardrails exist at the top of the line need to actually survive that compression.

Meta detailed a kernel-level security architecture for its new Muse personal AI agent, built around automatically revoking an agent’s permissions the moment it touches untrusted data. Unveiled at Meta Connect on September 24, the “Sentinel” system, according to Meta AI Research, uses eBPF programs to monitor data flow at the Linux kernel level inside each user’s dedicated Muse virtual machine: if the agent ingests untrusted web content, it’s marked “tainted,” its autonomous network access is automatically revoked, and any external action requires manual human approval. Credentials are also held in a separate vault the model itself can never read. It’s a notably different containment philosophy than sandboxing alone — instead of just isolating the agent, Meta is trying to make the agent’s own permissions dynamically shrink in response to what it’s been exposed to, which is a more direct answer to the “prompt injection via untrusted content” problem than most agent products currently offer.

What to Watch

  • Whether the 20-nation coalition’s oversight body gets any buy-in from the US, UK, or China — without at least one frontier-hosting government, it risks becoming a standards document rather than an enforcement mechanism.
  • Whether OpenAI’s US-led standards pitch and the 20-nation coalition’s UN-adjacent pitch end up competing or merging — right now they’re both responding to the same week’s events with incompatible visions of who holds authority.
  • Whether other AI vendors quietly re-test old “failed” exploits against their newest models, given that the Hacktron/OpenAI case shows a model upgrade alone can turn a dead attack chain into a working one.
  • Whether GitHub and Google face pressure to patch or fully deprecate Copilot and Gemini CLI’s SHA-pinning bypass, since “we’re not fixing it” is a live answer for two of the four Plugin4Shell-affected agents.
  • Whether Meta’s taint-tracking approach to agent permissions gets adopted elsewhere, or stays a Muse-specific architecture while competitors keep betting on sandboxing alone.