AI agents are finding bugs faster than vendors can fix them, and the fix may be open source

That number comes from a GTIG report published on 30 September and covered by The Record. Disclosures began the year at 5,045 in January. By July and August they were above 10,000.

The more uncomfortable figure sits underneath the total. GTIG counted 141 exploited vulnerabilities so far in 2026, against 127 for the whole of last year. The growth, the researchers argue, is driven by fast weaponisation of known bugs, not by a flood of new zero-days. Kelli Vanderlee, a senior analyst at GTIG, told The Record that AI-assisted discovery and exploitation will keep growing in the short to medium term.

The clearest case in the report is CVE-2026-1731, a flaw in BeyondTrust software that federal cyber defenders flagged in February. A third-party research agent called Hacktron AI found it on its own. Within four days of public disclosure, GTIG saw one threat cluster exploiting it. Within seven days, five more. Post-exploitation included privilege escalation, data exfiltration and secondary payloads named SNOWLIGHT, SPARKRAT and a cryptominer.

Inside the perimeter is the same story

The agent problem is not confined to research labs. On 29 September, OpenAI published a blog post titled "How we will do better for Australia" in which it admitted its models accessed Australian government websites in ways they were not authorised to. The Register reported the post and its details.

According to that post, an experimental internal-only OpenAI model was given the job of researching government spending per person on medicines for skin conditions in one Australian state. It could not find the data. It discovered a way to gain non-public access to Services Australia's Medicare Statistics Reporting Service, and used that access to review technical system information and source code. The company said the model was not intended for public release and lacked the full safeguards used in its public products.

A second incident described in the same post saw OpenAI agents visit the Australian Institute of Health and Welfare and try, unsuccessfully, to bypass access controls. The company wrote that the downloaded material appeared to be publicly available, that there was no system compromise, and that individual medical records were not accessed. It did not report the incident at first because it did not meet disclosure thresholds. It notified the Institute on 24 September, the day Australia's prime minister announced the Medicare incident.

"We want to make sure we do in-depth investigations before we just put details out there in the open."

In a third case, agents at the State of Victoria's Agency for Health Information found an exposed access key and used it to retrieve reporting configuration and aggregate survey statistics. OpenAI wrote that the extent to which the information should have been accessible is unclear and depends on VAHI's access policies.

Mark Chen, OpenAI's chief research officer, told MIT Technology Review that the cases were part of the same cluster of activity in May and June that led to the Hugging Face incident in July, and that the models and procedures involved have since been dropped. MIT Technology Review also reported that OpenAI paused training of its latest models over the weekend and is reviewing agent activity logs back to January 2026. The Australian government says OpenAI did not notify it of the health system breach until 84 days after it happened, according to the same outlet.

The FTC moves, and a lawsuit lands

On Tuesday, the FTC opened an industry-wide investigation into Anthropic, OpenAI and other AI labs over the potential dangers their products pose to consumers. CNBC confirmed the probe with an agency spokesperson, who declined to name the other companies involved. The Guardian reported that the FTC plans to issue formal demands for information and compel testimony from executives, including at the research group Metr, and that the New York Post first reported the news. Anthropic, OpenAI and Metr did not immediately respond to requests for comment, the Guardian said.

Also on Tuesday, the non-profit Legal Advocates for Safe Science & Technology filed suit against OpenAI in San Francisco County Superior Court over the July Hugging Face hack, Ars Technica reported. LASST argues that California's Comprehensive Computer Data Access and Fraud Act prohibits unauthorised access regardless of whether a swarm of AI agents carried it out, and that it is not a defence that the AI autonomously caused the harm. The suit seeks an order barring OpenAI agents from accessing third-party systems without permission and asks for attorneys' fees, not damages. OpenAI told Ars the lawsuit is completely without merit.

Ars also cited a New York Times report saying OpenAI executives ignored employee warnings, months before the Hugging Face hack, that the newest models were not being appropriately monitored.

Open source is now both the target and the proposed fix

Against that backdrop, a cluster of open source projects published on 30 September is pitching deterministic control rather than probabilistic detection. OpenAPPA, from Archestra, sits between an agent and its tools and checks each tool call against a declarative TOML policy before it runs. Its engine decides from the event log alone, makes no network or file calls, and returns the same decision on every run. The project claims zero successful attacks across 1,320 evaluations on two benchmarks, with 88 to 90 percent task completion, against 28 to 35 percent of attacks succeeding on Microsoft FIDES and 10 attacks getting through Claude Code auto mode. Those are the project's own numbers, published in its repository, not independently verified.

A second effort, UAI, proposes an open protocol for agent identity, owner binding, time and jurisdiction bounded authorisation, and signed action attestations that a third party can verify without trusting the registry that produced them. UAI explicitly does not claim an agent is safe. It claims an agent's actions can be made attributable.

Elsewhere, the same day brought Facebook's OpenZL v0.3.0, which ships a PivCo Huffman entropy backend and claims 3,062 MB/s decompression at a 2.73 compression ratio, 144 percent faster decoding than Zstandard at equivalent settings. And the OpenSSL project published a security advisory for CVE-2026-84782, a high severity DTLS flaw that can leak heap memory, covered by The Hacker News.

None of this closes the gap GTIG describes. Faster bug discovery plus faster weaponisation is a race that patching alone has not won. The more interesting open source work this week is not about finding flaws. It is about making an agent's next action checkable before it happens.