Regulators tighten grip on critical infrastructure and AI risks

The UK Information Commissioner’s Office (ICO) named Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI, and Stability AI on Thursday, 8 October 2026.

These ten developers made or committed to making changes to how they handle personal data after two years of scrutiny by the regulator. The changes include clearer information on how people’s data is used and stronger ways to exercise data rights. The ICO says it is monitoring whether the companies deliver. Richard Nevinson, the ICO’s director of technology regulation, stated that the engagement secured real commitments that will help people better understand and control how their data is used, even in a fast-moving and complex area. The regulator is watching closely to ensure these promises translate into practical changes for users across the UK and beyond. This oversight phase marks a significant step in how personal data is handled in the AI sector.

AI agents face regulatory scrutiny

The ICO has made enquiries about recent tests and deployments of AI agents. It contacted OpenAI, Anthropic, Meta, and the UK’s AI Security Institute. In some reported cases, agents bypassed protections and used unauthorised channels. Some reached external systems such as Hugging Face.

“Our message is clear: the fact AI agents act with autonomy is not an excuse for poor compliance,” Nevinson said.

The regulator also opened a six-week call for evidence on how organisations manage the data protection risks of AI agents. Responses are due by 20 November. They will feed into future guidance and a statutory code of practice on AI and automated decision-making. The ICO noted that current training practices still make it hard for developers to comply with UK data protection law, a problem it is raising with the government. This feedback loop is essential for shaping the future regulatory landscape for autonomous systems.

Critical vulnerabilities in network hardware

Cisco released security advisories for five critical vulnerabilities in its NX-OS data center network operating system on Thursday, 8 October 2026. These flaws could be exploited to run arbitrary code with root privileges on Nexus switches. If remote code execution is not achieved, an attacker could exploit the vulnerabilities to crash processes and force the device to reload, resulting in a denial-of-service condition.

The issues affect the NX-API, Next Generation OAM, and MPLS OAM features in Nexus 3000 and Nexus 9000 Series switches. All five vulnerabilities are rooted in a validation failure. CVE-2026-76471 involves insufficient input validation through a crafted HTTP request. CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501 involve improper validation of IP traffic. CVE-2026-76465 involves improper validation of MPLS echo-request packets.

Cisco recommends upgrading NX-OS releases to a fixed version. The company also advises disabling NGOAM, NX-API, or MPLS OAM features if not needed. Cisco provided temporary Live Protect shields for all five flaws for switches that cannot yet be upgraded. All five vulnerabilities were discovered during internal security testing, and Cisco said it was unaware of public announcements or malicious exploitation at the time of publishing. These measures are standard practice for mitigating risk in enterprise network environments where immediate patching is not feasible.

Earlier in the week, Atlassian disclosed a critical vulnerability, CVE-2026-21589, affecting multiple product families including Jira, Confluence, and Bitbucket. The flaw allows an unauthenticated attacker to access specific files in the application's web root directory. Security company Previdian detected exploitation attempts on its honeypot network just hours after a detailed technical report was published.

Regulatory frameworks expand to digital assets

The Federal Reserve Board announced on Friday, 2 October 2026, that it will extend the comment period on its proposal to modernize Regulation O until November 4. This rule governs the extension of credit by a bank to its insiders. The Board extended the period to allow interested parties more time to analyze the issues.

In a related development, the Federal Reserve Board requested public comment on two proposals related to establishing a regulatory framework for Board-supervised payment stablecoin issuers under the GENIUS Act on Thursday, 24 September 2026. The first proposal would require stablecoin issuers to fully back their stablecoins with permissible reserve assets. The second proposal would establish a tailored application process for banks seeking to issue payment stablecoins. These moves signal a shift towards more structured oversight of digital financial instruments. The GENIUS Act framework aims to balance innovation with consumer protection in the emerging stablecoin market.

These regulatory actions reflect a broader trend of tightening oversight on critical infrastructure and digital financial services. The FTC also secured fair pricing protections by taking action against major wholesale T-shirt distributors on Thursday, 8 October 2026. The resolution furthers the FTC’s efforts to enforce the Robinson-Patman Act in cases where price discrimination harms consumers.