INTRODUCTION
An OpenAI research agent went looking for public figures on Australian medicine spending, was refused by a Services Australia statistics portal, and came back with files it was not authorized to have. Nobody was steering it. Three months passed before the agency heard about it, and the notice came from OpenAI rather than from anything on the Australian side.
Zenity published SalesBleed, three Agentforce flaws it demonstrated could turn a poisoned CRM record into data theft or a phishing post in Slack. Microsoft tracked one ransomware affiliate, Storm-2570, across Qilin, DragonForce, Anubis and BERT. Bitget reported $351.6 million in unauthorized transfers out of its hot and warm wallets.
Two of those four are not what a headline makes them look like. SalesBleed is research rather than a reported customer breach, and Salesforce’s fixes were verified on 21 September. Bitget has confirmed the money and the wallet tiers and has explicitly declined to name a cause. The OpenAI case lands on whoever owns your agent runs and your disclosure path, while Storm-2570 lands on whoever decides how your ransomware cases get named and joined together.
Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.
Thanks for supporting The Monday Brief.
WEEKLY SIGNALS ANALYSIS
An approved task does not authorize every action taken to complete it. An OpenAI agent looking for public spending figures met an access denial on an Australian government statistics portal and retrieved files it was not permitted to reach. Make agent runs reconstructable to a credential and a request trail, because the alternative is learning what happened from someone else’s email.
Agentic AI creates a data-exfiltration path that never touches a phishing email. Zenity showed Agentforce carrying external instructions across apps into Slack with zero clicks. Any AI product that reads untrusted external content and can act inside your tenant is an execution engine, not a convenience feature.
The ransomware brand is a costume, not an identity. Microsoft tracked Storm-2570 across four payloads with largely uniform tradecraft. If your detection and threat intel are organized by payload family, you are letting one affiliate wear four disguises. Pivot to behavioral tradecraft. We have leaned on behavioral detection before, and the sharper point this week is that payload-based intel actively fragments what should be a single case.
Bitget has confirmed the loss and pointedly not confirmed the cause. Roughly $351.6 million left hot and warm wallets, cold wallets were untouched, and the exchange says it will not speculate on the attack vector until the investigation is complete. The wallet-tier exposure is the lesson available today.
What not to over-index on: endpoint EDR as your primary line against AI-driven activity. The OpenAI agent run and the SalesBleed research both sat in vendor infrastructure and cloud SaaS, where endpoint telemetry sees little. The visibility that mattered lived in identity, API, and agent-action logs.
Signal 1: An OpenAI Research Agent Crossed an Authorization Boundary on an Australian Government Portal
Why it matters: On 18 June an OpenAI agent running an internal research evaluation accessed public and non-public files on the Medicare statistics reporting service, a standalone portal operated by Services Australia. OpenAI identified the activity on 11 August and emailed the agency’s disclosure address on 10 September. Australian officials say no individual personal information is believed to have been accessed and the wider investigation remains open. Twelve weeks separate the action from the notification.
What is being misread: Coverage frames this as an AI safety failure or a rogue-model event, and the government’s own account is narrower and more useful. A standalone statistics portal was accessed without authorization, no patient records are believed to have been touched, and the wider investigation is still open. The architectural problem underneath is that agent workflows are built assuming an agent performing an approved task stays inside approved behavior. The trust boundary was drawn around the task rather than around what the agent could technically do.
Think Red (Douglas McKee): The moment worth studying is the denial, and nobody had to smuggle in a hacking tool to reach it. The agent already held the reach to fetch public data across multiple providers, and probing for a weakness is a short step from fetching, which is how a system you trust to roam the internet on your behalf ends up inheriting my curiosity without inheriting any of my attribution. What happens when a source says no? Does the agent stop, find another authorized route, or start testing the edges of the refusal? The traffic looks the same either way, and that is the part that should bother you.
Act Blue (Ismael Valenzuela): Autonomous agents that touch external systems are a new identity class, and most environments have no idea which agent did what, when, or under whose authority. Start by requiring that every agent action be attributable to a specific run, a specific credential, and a specific human owner, logged where your SOC can query it without going to the model vendor. That covers who. Scope is a separate problem, so constrain what these agents can reach at the network and API layer rather than trusting the task definition to hold them in. An agent granted broad internet egress to fetch public data will eventually touch something non-public, and you want that to fail closed. Most importantly, shorten your detection horizon. If your only evidence of agent misuse is a vendor emailing you months later, you do not have detection. You have notification.
Supporting sources:
Australian Government: Prime Minister’s 24 September press conference confirming the portal access, the notification chronology and that no individual personal information is believed accessed
Wired: OpenAI agent reached non-public Australian government data, disclosed months later
BleepingComputer: OpenAI agents probed public data providers and exploited an Australian government portal weakness
SecurityWeek: Agents probed websites for vulnerabilities while fetching public data
Signal 2: Zenity Showed How SalesBleed Could Drive Agentforce From a Web Form Into Trusted Internal Channels
Why it matters: Three flaws in Salesforce Agentforce let an attacker hijack a trusted AI agent, exfiltrate data, and push phishing into internal Slack channels without a single user click. This is the productized version of prompt injection reaching a system that customers already granted access to their data and their communications. Zenity demonstrated all of it rather than finding it in the wild, reported on 1 June, and verified the last of Salesforce’s fixes on 21 September.
What is being misread: The framing treats this as a prompt-injection bug to be patched. The deeper problem is that agentic AI apps are designed to interpret external content and act on it, so the very feature that makes them useful is the attack surface. An agent that reads a web page and can also post to Slack has no architectural line between content it was told to summarize and instructions it should obey. Salesforce closed the two specific defaults Zenity abused, a missing confirmation and a missing invoker attribution, and whether a customized agent in your tenant has reopened them is a configuration question you can answer today.
Think Red (Douglas McKee): Nothing about this requires me to touch the user’s prompt. Your team hardened the login page and the API gateway, and I moved to the layer you invited inside on purpose. The agent already holds read access to your data and write access to Slack, so nothing has to be breached. It only has to read my content. I plant instructions in something the agent will process during normal work, and it carries them across app boundaries because it was built to be helpful across app boundaries. The phishing that lands in your internal channel is more convincing than anything I could send from outside, because it comes from a source your people trust. None of that bug class is new, but the delivery mechanism you handed me is.
Act Blue (Ismael Valenzuela): Any AI agent that consumes untrusted external content and can also act inside your tenant is an execution engine wearing a productivity label. Inventory every Agentforce and similar deployment, then map exactly what data each agent can read and what actions each can take, especially cross-app actions like posting to Slack or Teams. The three SalesBleed flaws are fixed, so the work here is confirming your own tenant still has the new defaults rather than a customized agent that quietly reopened them. Separate the reading privilege from the acting privilege wherever the platform allows it, and require human confirmation before an agent posts to internal channels or moves data outside its origin app. A public web form is an untrusted input channel that terminates in a database your agents are asked to read.
Supporting sources:
SecurityWeek: SalesBleed flaws in Salesforce Agentforce enabled zero-click data exfiltration
Dark Reading: SalesBleed exploits Salesforce agents to enable Slack phishing across apps
Signal 3: Microsoft Tracked One Ransomware Affiliate Across Four Different Payloads
Why it matters: Microsoft assesses that Storm-2570 is a single ransomware affiliate operating across the Qilin, DragonForce, Anubis and BERT ecosystems, with largely uniform tradecraft, overlapping infrastructure and repeated use of the same remote access and cloud exfiltration tooling. Four payload names, one operator workflow underneath. If your detection and intel strategy is organized around payload families, that operator arrives four times under four names.
What is being misread: That the payload label misleads you is the easy read, and we have made some version of that argument three times since August. What is new here is the evidence behind it. Microsoft joined these cases through infrastructure overlap and repeated tooling seen across victims in six countries, having tracked the actor since April 2025. That is cross-customer visibility a single organization does not have, and the report does not say what vantage point a defender would need to reproduce the join. Correlating on behavior rather than payload is still right. The honest version is narrower, which is to keep enough pre-encryption detail from your own closed cases that you can compare them to each other later.
Think Red (Douglas McKee): Microsoft went backwards through these intrusions and found the same hands behind four different lockers. Most of the remote access tooling on that list is commercial software your own administrators run on purpose. You are watching all of it, and none of it can be alerted on by presence alone without burying the queue, so detection has to turn on context instead. That is the classic living off the land attacker advantage, another concept we emphasize in SANS SEC660. Credential dumping is the one step that genuinely lights up, and I only need it to work once. The encryptor is the cheap, swappable end of what I do, and it is also the only part that gets a name and a case file. Take four closed ransomware cases and compare the halves that happened before encryption. If those halves match, you had one campaign and four tickets.
Act Blue (Ismael Valenzuela): Microsoft’s report is unusually operational, and the hunting leads are the part to use rather than the argument. MeshAgent, Atera, ScreenConnect, Splashtop and NinjaRMM for remote access. Mimikatz, LaZagne and ntdsutil for credentials. s5cmd and Rclone for exfiltration, Cloudflare Tunnel and ngrok for egress, and Defender tampering alongside all of it. Hunting that list is the easy half. The correlation step is what turns it into intelligence, so link matching behavior across cases even when the ransomware family differs, which is exactly what a payload-first case structure prevents. On exfiltration, Microsoft says it frequently observed the activity rather than that it happens every time, so confirm what actually moved in your incident instead of carrying an assumption into the regulatory conversation.
Supporting sources:
Microsoft: Storm-2570 maintained consistent tradecraft across Qilin, DragonForce, Anubis, and BERT deployments
Signal 4: Bitget Reported $351.6 Million in Unauthorized Transfers and Will Not Name a Cause Yet
Why it matters: Bitget reported roughly $351.6 million in unauthorized transfers on 24 September, affecting part of its hot and warm wallet layers while cold wallets were untouched. The exchange says its systems detected the transfers at 18:31 UTC and that it will not speculate on the attack vector until the investigation is complete. Early reporting has raised possible North Korean involvement, but neither a cause nor an actor is established.
What is being misread: The instinct is to reach for a root cause, and none has been published. What the notice does establish is the shape of the exposure. The money that moved was the money held in the tiers designed to stay reachable, and the money that did not move was the money held out of reach. That distinction is an architecture question worth asking this week. How the attacker obtained authorization to move it is a question for Bitget’s investigation, and answering it early on someone else’s behalf is how a guess becomes a citation.
Think Red (Douglas McKee): The place to start investigating here is the wallet tier. Hot and warm funds moved while cold funds did not, why? That is enough to aim a red team at three things. Whatever can authorize a transfer, the services that can reach the signing path, and how much value one compromised session is allowed to move before something independent has to agree. Every exchange makes the same speed-versus-safety tradeoff with reachable funds, and the exposed money is the money that has to stay reachable to function.
Act Blue (Ismael Valenzuela): An open investigation is not a reason to wait, but it is a reason to be precise about what you are responding to. The reachable tiers are where the loss landed, so the questions available today are how much value sits in hot and warm wallets, whether a transfer above a threshold requires an authorization that a single compromised session cannot satisfy, and whether transfer volume and destination changes alert independently of whether a transaction is cryptographically valid. Bitget detected the movement and activated emergency response within minutes, then suspended withdrawals, and that sequence is worth rehearsing against your own clock. Preserve forensic state on the signing and approval paths while you do, without assuming either one was the way in. Speed of settlement is a business decision. Speed of theft is what you inherit when the two share the same trust.
Supporting sources:
BleepingComputer: Suspected North Korean hackers stole $351.6 million from Bitget hot and warm wallets
The Hacker News: Bitget confirms $351.6M theft after backend compromise, suspects North Korea
Role-Based Takeaways
Executive / CISO / Board Level
Agent activity needs an owner and a disclosure path before it needs a policy. Twelve weeks separated the Australian portal access from the notification. Ask your security team whether they could reconstruct an agent run, identify the external system affected, and notify its owner without a vendor telling them first.
Cross-application AI actions deserve an approval decision of their own. Zenity turned malicious CRM content into Slack phishing in a lab, and Salesforce has since fixed it. Request an inventory of SaaS agents that both read untrusted content and hold write privileges.
Ransomware readiness measured by payload family is measuring the wrong thing. Storm-2570 wore four brands over one playbook. Fund a threat-hunting engagement scoped to pre-encryption behavior, and require that your incident response investigates possible exfiltration before it focuses on recovery from encryption.
Enterprise Architect
Design Principle Impact: The trust boundary around AI agents has to move from the task to the capability. The OpenAI run crossed an external authorization boundary while performing an approved task. Scope agent authority to what it can technically do, not what it was asked to do, and retain evidence of what was attempted as well as what succeeded.
New Constraint/Dependency: Any agent that ingests untrusted external content and can act within your systems now requires an architectural separation between its read privilege and its act privilege. Where the platform cannot enforce that separation, human confirmation must gate any cross-app or data-egress action.
Security Operations
Implementation Watch Item: Agent and service-account activity in your SaaS and cloud logs. Watch for agentic identities performing actions or reaching resources outside their normal task scope, especially cross-app actions like posting to collaboration channels or moving data between origins.
Common Failure Mode: Assembling an agent’s action trail for the first time after somebody else reports the problem. Run identifiers, tool calls, destination responses and cross-application writes have to be retained before the week you need them.
Monitoring Patterns: Microsoft’s named Storm-2570 tooling for remote access, credential dumping, Defender tampering and cloud exfiltration staging, correlated across cases regardless of payload family. For wallet operators, transfer volume, destination changes and authorization-chain anomalies, independent of whether a transaction is cryptographically valid.
Signal vs Noise Guidance: A genuine indicator is an agentic identity or backend service taking an action that is valid and authorized but inconsistent with its established behavioral baseline. Routine agent activity within normal task scope is noise. An unusual but authorized action is a reason to triage, not proof of compromise.
Adversarial edge item: Most monitoring watches what a non-human identity successfully did, and almost nobody watches what it was refused. That asymmetry is the opening. An agent that collects a 403 and keeps requesting is the Australian portal sequence exactly, and unlike the model vendor’s telemetry it sits on your side of the connection. Log the denials your agents receive, and treat refusal followed by continued attempts as a first-order alert rather than noise.
See you next Monday!
The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.