LastWeekIn.Tech

Security incidents and disclosures dominate the AI news cycle today, from a serious OpenAI internal breach to a data-exfiltrating coding agent, alongside OpenAI's own safety framework unveiling, stalled Congressional AI action, and fresh signals OpenAI is chasing a historic $1.2T valuation.

1. 1

   Number 1. Security & Safety Hacker News

   A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

   Security researchers disclosed that they chained a heap overflow and an SSO misconfiguration to compromise multiple OpenAI employees' ChatGPT accounts and gain access to internal OpenAI repositories. They proved the access by having an employee's Codex instance open a pull request in OpenAI's internal monorepo, without viewing sensitive data. The vulnerability traced back to OpenAI's own community help forum, which for an extended period could expose logged-in users' ChatGPT and Codex accounts to compromise.

   Why it matters This is a serious real-world breach of a frontier AI lab's internal infrastructure, not a theoretical exploit — attackers demonstrated write access to OpenAI's core codebase via a chain of authentication flaws. It underscores that as AI companies wire agentic tools like Codex deeply into internal workflows, standard web vulnerabilities can escalate into supply-chain-level risk for the models and code powering products used by hundreds of millions.

   What to watch Watch for OpenAI's formal incident response, whether other connectors or repos were touched, and if similar SSO/agent-account chaining vulnerabilities surface at other AI labs.

2. 2

   Number 2. Security & Safety Hacker News

   ZCode, the GLM coding agent, silently uploads your Git history

   A reverse-engineering investigation found that ZCode, the AI coding desktop app from Beijing-based Z.ai (maker of the open-weight GLM model family), silently packages a user's entire workspace — including full .git history, LFS caches, reflogs, and global app configs — and uploads an encrypted archive to Aliyun OSS whenever the app is logged in. The behavior was undocumented and discovered through manual reverse engineering rather than disclosure by the vendor.

   Why it matters GLM models run widely in the local-AI and open-weight community, and this finding suggests a popular tool built on those weights covertly exfiltrates full source history and credentials-adjacent config data to a Chinese cloud provider. It raises fresh concerns about trust, data sovereignty, and supply-chain risk in the open-source AI tooling ecosystem, especially for developers using these agents on proprietary or sensitive codebases.

   What to watch Watch for Z.ai's response, whether other GLM-based tools share this behavior, and any regulatory or enterprise-security fallout for teams already running ZCode.

3. 3

   Number 3. Security & Safety businessinsider.com

   OpenAI unveils formal misalignment reporting framework and discloses six new cases of ‘concerning’ AI behavior

   OpenAI introduced a formal framework for reporting AI misalignment and disclosed six new cases of what it characterized as 'concerning' model behavior. The announcement came alongside other industry safety signaling, including comments from Geoffrey Hinton following Anthropic CEO Dario Amodei's essay urging the industry to 'pace the frontier.'

   Why it matters A formal, ongoing misalignment-disclosure process from OpenAI marks a shift toward institutionalized transparency about model failures rather than one-off incident reports, which could become a template other labs are pressured to adopt. It also arrives as external pressure mounts — from former employees, researchers, and even industry elders like Hinton — for labs to be more forthcoming about risks their own most advanced systems pose.

   What to watch Watch whether other frontier labs adopt comparable formal disclosure frameworks, and whether the six disclosed cases prompt scrutiny from regulators or safety researchers.

4. 4

   Number 4. Policy & Regulation cnbc.com

   US House leaves Washington without passing significant AI regulation, pushing decisions until after the midterm elections

   The House of Representatives adjourned for recess without passing substantive AI regulation, effectively pushing major legislative action until after the November midterm elections. This comes despite AI executives, including at Anthropic, OpenAI, and xAI, publicly urging Washington to regulate the industry, and after an Anthropic researcher resigned warning AI 'could kill us all by the end of the decade.'

   Why it matters The gap between AI companies' public calls for regulation and Congress's inaction highlights a widening policy vacuum at exactly the moment frontier capabilities and safety incidents are accelerating. With federal action stalled, states are likely to keep filling the void with a patchwork of rules, increasing compliance complexity for AI developers and raising the stakes for whatever emerges post-midterms.

   What to watch Watch for state-level AI bills advancing in the interim and whether AI safety incidents before November shift the political calculus on Capitol Hill.

5. 5

   Number 5. Industry & Economics agihunt.info

   OpenAI reported to have held early talks on a funding round that could value it near $1.2 trillion

   OpenAI has reportedly held early talks on a new funding round that could value the company near $1.2 trillion, according to Bloomberg. The report surfaced alongside other industry activity, including OpenAI ranking its models' math skills at Dreamforce and Anthropic integrating its Cowork tool directly into Claude chat.

   Why it matters A potential $1.2 trillion valuation would make OpenAI one of the most valuable private companies in history, reflecting investor confidence that frontier AI economics can scale even as compute costs, energy demands, and regulatory scrutiny mount. It also intensifies competitive and capital pressure on rivals like Anthropic, Google, and xAI to match funding trajectories, potentially accelerating infrastructure buildout and industry consolidation.

   What to watch Watch for confirmation of investors and terms, and how this valuation talk affects OpenAI's compute and infrastructure commitments amid ongoing energy and chip supply constraints.