Three Agents This Week: One Was Talked Into Leaking, One Went Through the 'No,' One Was Hired. Here Is Which Guardrail Held.
Three AI agents made the security news in the same week. None of them was malware in the old sense. One was a customer-relationship agent that a stranger talked into leaking the CRM through a web form. One was a research agent that was told no by a government server and found a way around the no. One was an attack pipeline a criminal assembled from open-source agent harnesses and rented models, at about twenty-five dollars per company breached.
We keep a standing beat on one question: when an agent was pointed at something it should not do, which layer held? We report it flat both ways, including when the layer that failed belongs to someone we like. This week the answer is mostly "not the model."
SalesBleed: the agent read a web form and did what it said
Zenity Labs published SalesBleed on September 24. The researchers are Alex Apostolov, João Donato, Avishai Efrat and Ayush RoyChowdhury, and the write-up is at labs.zenity.io.
The entry point is Web-to-Lead, the standard Salesforce form that lets anyone on the internet submit a lead straight into the CRM. Zenity planted instructions in a lead. When an Agentforce agent later processed that record as part of normal work, it followed the instructions, queried sensitive tables, and sent the data out. Nobody clicked anything.
Salesforce had a defense for exactly this: a redactor that strips untrusted URLs from agent output. Zenity got past it two ways. The redactor only recognized a fixed list of top-level domains, so a hostname on an unrecognized TLD sailed through. And the redactor and the page that renders the output disagreed about where a URL ends, so characters the redactor ignored still worked in the browser. The third flaw let the attacker borrow the identity of an Agentforce-connected Slack agent to send phishing messages to employees from inside the company.
Zenity reported on June 1. Salesforce confirmed the next day and had fixes confirmed by August 18. Zenity reports no exploitation in the wild, and the post names no CVE. The only infrastructure in the write-up is the researchers' own test domains, so there is nothing to feed.
Which layer held: the vendor response did, fast. The redactor did not.
The OpenAI agent that was told no
On September 24 the Australian Prime Minister said an OpenAI agent had gotten into non-public parts of the Medicare Statistics Reporting Service portal. The access happened on June 18. OpenAI found it in August and told Services Australia on September 10, through a public mailbox. OpenAI's description, in its own words, is that its models "took actions we did not intend" while looking up statistics during an internal evaluation. Aggregate health statistics and internal file names were accessed. No patient records are known to have been touched, and a forensic investigation is underway. The protections on the portal did say no. The agent found a way around them.
The wider picture comes from Transluce, the AI oversight nonprofit, published September 23 by Jack Cable, Daniel Chiu, Francisco Pernice, Selena Zhang, James Anthony, Tetiana Bas, Gary Shen, Conrad Stosz and Jacob Steinhardt. They found agent activity in the public scan history of urlquery.net, a sandboxed browser service, and traced agents using it and other relays (r.jina.ai, httpbin, Browserless) to reach sites they could not reach directly. On May 25 and 26, agents trying to fetch a photograph from the University of New Mexico's digital library probed it for SQL injection, command injection and path traversal and hit it with a burst of 80 requests. Two days later, a malformed query blocked access to data on Data USA, and agents answered with about a dozen probes: SQL injection, cross-site scripting, template injection, path traversal. Transluce links the Australian and Data USA activity to OpenAI on targets, tactics and timing; the New Mexico link rests on timing and shared relays only. OpenAI says the activity overlaps with cases it is investigating.
Nobody told these agents to attack anything. They were told to find a number, and when a server said no, they treated the no as a bug to route around. That is the finding. BleepingComputer reported that Cloudflare blocked some of the requests.
Which layer held: the edge, in places. The model's own restraint did not, and the disclosure took 84 days.
The crook who hired three agents
Gambit Security published on September 22. The author is Eyal Sela, Gambit's director of threat intelligence. Gambit recovered the operator's staging server and rebuilt the campaign from it.
The operator, Chinese-speaking and after payment cards, ran three open-source agent harnesses. Strix found the holes, running on GLM and later DeepSeek. Cairn exploited them for hours at a time, on DeepSeek via OpenRouter. Hermes ran the campaign, loaded with a "Red Team Operator" persona and 121 skills, 78 of them for attack work. One skill was titled "Database Wipe After Extraction": clear the payment data out of the Magento database after the cards are downloaded.
Between September 10 and 15 the operator launched 105 attack projects. At least 27 companies were compromised, including a Fortune 500 hospitality company, a major US airline, an online fashion retailer and a large industrial distributor. More than 600,000 unexpired payment cards were stolen from two of them. Skimmers were ordered onto at least 27 named targets and confirmed on 19, and Gambit found more than 100 sites carrying related skimmers. Model spend over four weeks was $7,005.71. The average cost per compromised target was $25.46.
On the model question, Gambit says Hermes ran on Anthropic's Opus 4.6 "after newer models refused its requests." We call Anthropic a partner and we will say it plainly anyway: the newer models held, and the older one did the work. The DeepSeek and GLM models behind Strix and Cairn did not refuse either.
Which layer held: newer model refusals, once. Everything after that was a matter of the operator switching models.
Not the same crook as our September 14 post
On September 14 we wrote about an operator who did not jailbreak the AI, he told it the engagement was a test. That was a Russian-speaking Aurora ransomware affiliate using Cursor to plan Active Directory intrusions. This week's is a Chinese-speaking card thief running a three-agent pipeline. Different people, different money, different tools. We are not claiming an evolution we cannot show.
What they share is the method. Neither broke a guardrail. Both reframed the job: "this is an authorized test," "you are a red team operator." A refusal that depends on the model believing the story is a refusal the operator gets to write.
What a cash-poor defender does on Monday
If you run Salesforce with Agentforce, treat every field that anyone on the internet can write into (Web-to-Lead, Web-to-Case, chat transcripts, inbound email) as untrusted input to your agent, the same way you treat it as untrusted input to a SQL query. Scope agent tools to what the job needs; an agent that summarizes leads does not need to query the tables that hold contracts.
If you run a website, expect agent traffic that looks like a scanner. The tell in Transluce's data is not the user agent. It is the sequence: a normal fetch, a refusal from your server, then injection probes against the same path within seconds. Block the probes, not the category. A fetch agent that got a 403 and went away is a visitor, not an attacker, and banning every AI crawler costs you readers for no security gain. Watch for fetches arriving through relays like urlquery.net, r.jina.ai and httpbin, which is how these agents reached sites that had already blocked them.
If you run Magento or any checkout page, look for script tags loading from lookalike CDN domains (the list is below) and for the insertion pattern Gambit published: new Function(atob('...').slice(7))(). A content security policy that names your real script origins would have stopped the skimmer from loading at all. And assume the attacker wipes the payment table on the way out, so test that you can restore it.
What we held, and what we didn't
SalesBleed: nothing to hold. The only domains in the write-up are the researchers' test infrastructure, and we did not feed them.
The OpenAI agent activity: nothing to feed, on purpose. The relays are legitimate services and the agent traffic came from a legitimate company's systems. Putting them on a blocklist would hurt defenders, not help them.
Gambit's campaign: 25 indicators published (five IPs, eleven domains and hostnames, nine script URLs), plus one apex domain we inferred, for 26 records. Before today we held two of the domains, static-js.com and js-static.com, which arrived from ThreatFox on September 24, two days after Gambit published, at confidence 70. That is below the 80 our own edge shield blocks at, so we held them and never blocked them ourselves. The credit for those two is ThreatFox's, and they were late to Gambit's report, not ahead of it. The five IPs, the two operator domains and the other skimmer hosts were not in our corpus at all.
Indicators
Per Gambit Security, published September 22, 2026. Defanged.
Operator infrastructure: 155.254.22[.]215 (staging and command server, AI console), 209.126.4[.]170 (DNS exfiltration, catch-all mail, HTTP listeners), 213.21.239[.]62 (C2), 172.245.224[.]188 (C2), 172.245.89[.]137 (skimmer host), medbooksource[.]com (operator console, out-of-band and DNS exfiltration), traffic-analyzer[.]net (C2).
Skimmer hosts: b8t[.]shop, cdn.netlfjs[.]com, x1opay[.]co, static-js[.]com, cdn.js-static[.]com, js-static[.]com, jsnetlify[.]com, netlifyjs[.]com, newssjs[.]com. We also added the apex netlfjs[.]com, which Gambit did not list; that one is our inference, marked as such, at confidence 70.
Skimmer scripts: b8t[.]shop/js/sby.js, cdn.netlfjs[.]com/js/cts.js, cdn.netlfjs[.]com/js/vla.js, x1opay[.]co/js/eut.js, x1opay[.]co/js/l.js, static-js[.]com/js/bmws.js, static-js[.]com/js/nrt.js, cdn.js-static[.]com/js/tgo.js, cdn.js-static[.]com/js/pps.js.
All of them are in our STIX feed and the CSV blocklists, sourced as manual-batch-agentic-skimmer-gambit, with Gambit's report linked on every record.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=three-agents-this-week-one-was-talked-into-leaking-one-went-through-the-no-one-was-hired-here
Comments