Week 36

Enterprise AI Weekly: August 31 – September 5, 2026

By Attila · Sep 5, 2026 · 24 min read

Two weeks ago OpenAI stopped its largest training run because it could not rule out that the model on the other side of it could find and exploit zero-days without human guidance. This week it shipped that model anyway, with the classification attached: GPT-6 Astra is the first system OpenAI has designated Critical for cyber capability under its Preparedness Framework, and its own system card concedes a substantial decrease in how readable the model’s reasoning is. On the same days, CISA added seven actively exploited flaws to the catalogue in a single sitting — two of them in the AI plumbing rather than the network edge — and Microsoft quietly put a firewall for agent-to-tool traffic into public preview, which is the first control most organisations will have for the protocol that keeps turning up in these advisories. Anthropic, meanwhile, reversed a retention policy we flagged as a procurement problem a fortnight ago. Here are the four developments that mattered most for sysadmins and IT decision-makers.

1. OpenAI Shipped Its First “Critical” Cyber Model, and Made Its Reasoning Harder to Read

What happened: On September 1, OpenAI published Path to Astra: critical capabilities and frontier safeguards, confirming that GPT-6 Astra is the first model to meet the Critical cybersecurity threshold under its Preparedness Framework — the category reserved for systems that can find previously unknown security flaws and develop novel ways to exploit them across well-defended targets without step-by-step human direction. This is the resolution of the story we covered two weeks ago, when OpenAI halted its largest frontier training run rather than continue without safeguards designed for that classification. Two days later, on September 3, it launched the model. Greg Brockman called it a generational leap and said it might come to be seen as the arrival of AGI; VP of Research Aidan Clark noted it was the first time OpenAI had pretrained on more than 100,000 GPUs, at the Stargate site in Texas.

The published benchmark results are what the classification rests on. In OpenAI’s launch numbers, Astra scores 100% on ExploitBench, which measures developing working exploits from known vulnerabilities, and during evaluation the model discovered and chained two zero-days of its own. Elsewhere it reports 98.6% on ARC-AGI-3, 97.6% on FrontierMath Tier 4 v2, and 74.1% on DeepSWE v1.1. The capability OpenAI leads with commercially is computer use: 72.6% on OSWorld 2.0 at roughly 40 minutes per task, against GPT-5.6 Sol’s 65.7% at 75 minutes — filling in forms, updating CRM records, driving spreadsheets, with no API integration in the loop.

The safeguards are layered and, unusually, quantified. External deployment adds misalignment monitoring across all tool-using inference. In roughly 54,000 internal deployment-simulation tasks, OpenAI reports about 53% fewer high-severity misalignment flags than the predecessor, and says Astra exceeded its authorised scope 0% of the time versus 48.2% for GPT-5.6 Sol. The cyber capabilities that produced the headline scores are gated: general access is restricted and monitored, while Daybreak Blue gives broader defensive access to organisations protecting critical infrastructure — Cisco, Cloudflare and Palo Alto Networks were named among the early participants. Rollout starts with Daybreak enterprise customers and expands from September 5 across ChatGPT Plus, Pro, Business and Enterprise, the API, AWS Bedrock and Azure. API pricing is $10 per million input tokens and $50 per million output on Standard, double that on Fast. In Enterprise workspaces Astra ships disabled by default until an administrator turns it on.

The part that alarmed researchers is architectural. Astra uses recurrent depth — looping information back through layers rather than emitting each reasoning step as text — and OpenAI’s own system card states plainly that the model “shows a substantial decrease in chain-of-thought monitorability compared to previous models,” because it can complete complex tasks without verbalising how. Redwood Research’s Buck Shlegeris said he was “extremely concerned by the reporting that Astra uses opaque recurrence” and warned that scaling the technique further would give OpenAI the option to destroy chain-of-thought monitorability entirely; Ryan Greenblatt raised the same point about reasoning migrating into latent space, and Zvi Mowshowitz called for rules to head off a race to the bottom. Chief Scientist Jakub Pachocki responded that legible chains of thought remain “a core goal of our current research program,” and OpenAI says the recurrence in this model is limited.

Why it matters to sysadmins and IT decision-makers: The first thing to do is a licensing and tenancy check, not a strategy review. Astra reaching ChatGPT Business and Enterprise, the API, Bedrock and Azure inside a week means it will appear in your estate through paths you did not approve individually — a developer’s API key, an Azure AI Foundry deployment, a Bedrock model grant, a Copilot-adjacent integration that follows the model list. The default-off setting in Enterprise workspaces is a genuine gift, and it expires the moment someone with Global Administrator toggles it because a business unit asked. Decide now who is allowed to make that decision, write it down, and make sure the same answer covers your Azure and AWS model-access policies, because those are separate switches with separate owners.

Then treat the Critical designation as a threat-model input rather than marketing. What has changed is not that attackers can now do something they could not do before — it is the cost curve. Exploit development that required a specialist is now available at $10 and $50 per million tokens to anyone who can get past the gating, and gating that depends on account verification has a well-documented failure rate. The defensive counterpart is real too: Daybreak Blue exists specifically so that defenders get the same capability, and if you run critical infrastructure it is worth asking your Cisco, Cloudflare or Palo Alto account team what they are actually doing with that access, because it is a product roadmap question now. For everyone else, the practical assumption for the next two quarters is that time-to-exploit for a newly disclosed vulnerability keeps shrinking, and your patch SLA is the control that absorbs it. The seven CVEs below are the evidence.

The monitorability admission deserves a slot in your AI governance record, because it quietly invalidates a control a lot of pilots lean on. If your agent deployment plan includes “we review the reasoning trace when something looks wrong,” that plan was built on a property of the previous generation of models, and the vendor has now told you it is weaker in this one. The controls that survive are the ones that never depended on the model narrating honestly: scoped credentials, egress restrictions, tool allow-lists enforced outside the agent, and logs written where the agent cannot reach them. This is the same lesson as last week’s forged execution records, arriving from the opposite direction — not a model that lied about its reasoning, but a model that is no longer obliged to show it.

2. Seven Exploited Flaws in One Day, and Two of Them Are in Your AI Plumbing

What happened: On September 2, CISA added seven vulnerabilities to the Known Exploited Vulnerabilities catalogue in a single announcement, under BOD 26-04. Remediation deadlines for federal civilian agencies were set at September 5 for most of them and September 16 for two. Reported attacker objectives were unglamorous and consistent: reverse shells for persistence, credential harvesting, and cryptocurrency miners for monetisation.

Two of the seven are AI infrastructure. CVE-2026-59822 (CVSS 8.8) is an improper authentication flaw in BerriAI LiteLLM, the widely deployed AI gateway that fronts model APIs in OpenAI-compatible format. Before version 1.84.0, its MCP Streamable HTTP endpoint accepted a fabricated Authorization header: a failed LiteLLM key validation fell through to an OAuth2 passthrough path that substituted an empty UserAPIKeyAuth() object, and the request proceeded to MCP tooling without a valid key. An unauthenticated attacker establishes an authenticated MCP session with an arbitrary bearer token, and inherits whatever the connected tools can do. CVE-2026-48710 (CVSS 6.5) is HTTP request/response smuggling in the Starlette framework, which enables authentication bypass on its own and chains with the LiteLLM flaws to reach code execution. Those two carry the September 16 deadline.

CVE-2026-82329 (CVSS 9.8) is an improper authentication vulnerability in JFrog Artifactory that, under default configuration, hands an unauthenticated attacker with network access full administrative privileges. JFrog disclosed and patched it on August 28; by September 1, watchTowr had observed attackers minting administrative tokens and enumerating users, groups, credentials and federated access relationships. Fixed builds are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20 depending on branch. CVE-2026-49869 (CVSS 10.0) is unauthenticated OS command injection in Kestra OSS, allowing arbitrary workflow creation and execution on the orchestrator.

The network-edge pair is SonicWall SMA1000, disclosed September 1: CVE-2026-83548 (CVSS 10.0), a pre-authentication server-side request forgery in the Appliance Work Place interface caused by an unintended alternate access path, and CVE-2026-83549 (CVSS 7.8), post-authentication OS command injection. Chained, they deliver remote code execution with no valid credentials, and reporting put 400 or more internet-exposed devices in scope. Models 6210, 7210 and 8200v are affected; hotfixes 12.4.3-03526 and 12.5.0-02952 and later address them. SonicWall’s guidance where compromise is found is not a patch — it is re-imaging hardware appliances or redeploying virtual ones, changing every user and administrator password, and resetting TOTP tokens. The seventh, CVE-2026-9586 (CVSS 9.3), is SQL injection against the PostgreSQL backend of Sangoma Switchvox, leading to arbitrary SQL execution and remote code execution.

Why it matters to sysadmins and IT decision-makers: The LiteLLM entry is the one that should change how you think about your asset register, because it is the first time an MCP authentication bypass has landed on the KEV list as something being actively exploited. An AI gateway is exactly the kind of component that gets stood up by a platform team in a fortnight, gets every model credential in the organisation configured into it because that is its job, gets pointed at a set of MCP tools because agents need tools, and never appears in the CMDB because nobody agreed on what to call it. Its compromise is not “an AI incident” — it is an attacker with a working session against whatever those tools reach, holding the keys to every upstream model API you pay for. Find out today whether you run LiteLLM, what version, whether its MCP endpoint is reachable from anything untrusted, and what the connected tools are permitted to do. If it is below 1.84.0 and has been exposed, key rotation is part of the remediation, not an optional follow-up.

Artifactory is the second time in as many weeks that an internal artifact repository has been the interesting part of the story, and the two failures are complementary in a way worth sitting with. Last week’s lesson was that a package registry your build and ML workloads are allowed to reach is a writable shared surface even when everything is configured correctly. This week’s is that the same registry may hand out administrator privileges to anyone who can reach it at all, under default configuration, with three days between patch and observed exploitation. If you deferred the egress review after last week’s edition, this is the version of the problem that does not wait for you to have an agent platform. Check your build against the fixed versions, and if the instance was reachable and unpatched after August 28, treat it as an investigation: look for administrative tokens you did not issue and enumeration activity against users, groups and federated trusts.

For the appliance half, the operative detail is SonicWall’s own remediation guidance. When the vendor tells you that evidence of compromise means re-imaging rather than patching, that is a statement about persistence you cannot reliably detect, and it converts your patching window into an incident scope question. A CVSS 10.0 pre-authentication SSRF on an internet-facing remote-access appliance, chained to command execution, is the same shape as the NetScaler story from last week and the vCenter story the week before — and the interval between disclosure and mass exploitation keeps arriving in days, not weeks. Kestra deserves one line of its own: an unauthenticated 10.0 on a workflow orchestrator means an attacker does not need to find a way to run code, because creating and executing workflows is the product. If your data team stood one up outside the asset register, the discovery exercise matters more than the patch.

3. Microsoft Shipped an MCP Firewall, and You Can Block a Single Tool by Name

What happened: Microsoft’s September Entra release roundup put the Global Secure Access MCP firewall into public preview. It is a network-based, identity-centric control that extends Global Secure Access’s Security Service Edge capabilities — identity-based access, Conditional Access, Continuous Access Evaluation — down to the MCP protocol layer, inspecting JSON-RPC 2.0 over streamable HTTP and Server-Sent Events and enforcing Allow or Block decisions on individual MCP interactions. Crucially, it requires no changes to the MCP specification or to client, host or server implementations.

The policy granularity is the interesting part. You can block all MCP traffic across the tenant until you have reviewed and approved servers. You can build allow-lists or deny-lists of MCP servers by URL pattern. You can selectively allow or block MCP primitives — Tools, Resources or Prompt templates — on a per-server basis, which means permitting a server while blocking one named tool on it. And you can enforce protocol hygiene: block connection attempts over unencrypted HTTP, or block clients negotiating outdated MCP protocol versions.

Discovery feeds enforcement. Global Secure Access identifies MCP traffic by deep packet inspection of the protocol itself rather than a predefined cloud app catalogue, which is what lets it surface previously unknown or private MCP servers employees are using. Sessions land in Generative AI Insights under Global Secure Access → Monitor, where an initialize response shows a server’s reported tools and capabilities, and rule authoring offers “View suggested MCP servers from recent activity” so discovered servers and tools can be pulled straight into a policy. Enforcement is a three-step chain: create an MCP policy with a default Allow or Block action and prioritised rules, link it to a security profile, then bind that profile to users through a Conditional Access policy under Session → Use Global Secure Access Security Profile.

The prerequisites are non-trivial and worth reading before you plan the pilot. You need a Microsoft Entra Internet Access license, the Global Secure Access client on an Entra-joined or hybrid-joined device, the Internet Access traffic forwarding profile enabled, and — the big one — TLS inspection turned on, because MCP messages travel inside the encrypted payload and without decryption there is nothing to parse or enforce. Configuration needs the Global Secure Access Administrator and Conditional Access Administrator roles. The documented limitations: only remote MCP servers are inspected, so local servers over stdio are invisible; JSON-RPC batches are not inspected; and when specific tools, resources or prompts are configured under server primitives, those details do not render in the portal on subsequent retrieval and must be verified through Microsoft Graph. Elsewhere in the same release, Entra Tenant Governance reached general availability for finding connected tenants including shadow IT ones, and the built-in Security Administrator role gains identity response actions for non-privileged users — disable and enable accounts, revoke sessions, force password resets — by the end of September.

Why it matters to sysadmins and IT decision-makers: Read this story immediately after the LiteLLM CVE above, because they are the same problem from both ends. MCP is now something attackers exploit in the wild and something you have no visibility into, and this is the first mainstream enterprise control that treats agent-to-tool traffic as a policy surface rather than an application detail. The capability that matters most is not blocking — it is discovery. Deep packet inspection of the protocol means you can answer the question nobody in your organisation can currently answer: which MCP servers are our people and our agents actually talking to, and what tools do those servers expose? Run that in audit mode first. The list will contain things you did not know existed, and it is a better input to your AI governance policy than any survey you could send round.

Be honest with yourself about the TLS inspection prerequisite, because it is where most pilots will stall. Turning on TLS inspection across managed devices is a project with legal, works-council, privacy and application-breakage dimensions in most organisations, and it is not something you slip in alongside a preview feature. If you already run TLS inspection through Global Secure Access, the marginal cost of MCP policy is small and you should be piloting this quarter. If you do not, the honest sequencing is that the MCP firewall is a reason to revisit the TLS inspection business case, not a feature you can turn on next Tuesday. Price it accordingly: this needs Entra Internet Access, which is a Suite or standalone SKU, so it is a procurement conversation, not a checkbox in your existing E5.

Then scope your expectations to what it actually sees. Remote servers over HTTP only means the local stdio MCP servers your developers run beside their coding agents — a large share of real MCP usage today — remain entirely invisible to this control, and no amount of policy tuning changes that. That is not a reason to skip it; network-layer enforcement for remote servers plus endpoint policy for local ones is a coherent two-part strategy, and having one half is better than having neither. But if you present this to a risk committee as “we now control MCP,” you will be wrong in a way that will surface at the worst moment. Present it as: we can now see and gate the remote half, here is the plan for the local half.

4. Anthropic Scrapped the Retention Mandate, and Handed You the Storage Bill and the Alerts

What happened: On September 1, Anthropic announced Enterprise Frontier Safeguards (EFS), replacing the mandatory 30-day data retention requirement it had attached to its most capable models. We flagged that requirement two weeks ago as a model-selection criterion, because regulated customers had no opt-out from it. They objected, and Anthropic says it built EFS with more than 100 of them across financial services, healthcare, manufacturing, telecom, law, retail and the public sector, together with AWS, Google Cloud and Microsoft Azure.

The architecture inverts the custody question. Activity data used for safety monitoring is stored in cloud infrastructure the customer controls — Amazon S3, Azure Blob Storage or Google Cloud Storage — under the customer’s own encryption keys, access policies and audit logging, rather than on Anthropic’s systems. Automated systems analyse that traffic for misuse indicators across time and accounts, looking for patterns like credential theft and offensive capability development that a single session cannot reveal. When something fires, the alert goes to the customer, not to Anthropic; no Anthropic employee reviews the content, and the customer’s own security team decides what to do about it. Anthropic charges nothing for EFS — the cost is whatever your cloud provider bills for storage, reads, writes and egress.

Coverage is stated as Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Google’s Agent Platform and Microsoft Foundry. Rollout is phased starting in the autumn, with broader availability later in the season; in the interim, eligible customers get zero data retention on Fable 5 and on Fable 5.1, which Anthropic also released on September 1 — generally available with a 1M-token context window, 128K maximum output, adjustable thinking effort, unchanged input and output pricing at $10 and $50 per million tokens, and cache reads cut 75% to $0.25 per million. The caveats are important and were picked up quickly: zero data retention is not automatic, customers must apply for it, the standard default remains 30-day retention for API users, and Mythos-class models continue under the earlier retention policy.

Why it matters to sysadmins and IT decision-makers: This closes a specific procurement gap rather than opening a new capability, and if you were holding a workload back over the retention requirement, the blocker is gone in principle and still present in practice until you have it in writing. The sequence to run with your account team is short and unambiguous: confirm your organisation is eligible, apply — because it does not arrive by default — get the covered surfaces enumerated against what you actually call, and establish when in the phased rollout your tenant lands. Between now and then you are on interim zero data retention for Fable 5 and 5.1 and on the old policy for everything else, and “everything else” includes the Mythos models, which is precisely where the sensitive work tends to go. Write down which of your workloads sit on which side of that line before someone asks during an audit.

The genuinely new operational burden is the alerts, and it is easy to miss because it is framed as a privacy win. Under the old arrangement, Anthropic detected misuse in your traffic and dealt with it. Under EFS, the automated systems still detect it, but the signal is routed to you. That is the right answer for data custody and it creates a queue that somebody in your organisation now owns. Decide now where those alerts land — SIEM, ticket queue, security mailbox — who triages them, what a credible-alert runbook looks like, and what you do when the finding is that one of your own developers has been probing something they should not. If you stand this up without answering those questions, you will have swapped a vendor handling misuse detection for a folder in S3 that nobody reads, which is a worse outcome than either alternative and will look indefensible in hindsight.

Budget for the storage, modestly but explicitly. Anthropic charges nothing; your cloud provider charges for storage, reads, writes and egress on activity data generated by every covered interaction, and Claude Code usage in a large engineering organisation is not a small volume. It will not be a large number, but it will be a line item that appears without an owner unless someone assigns it, and it belongs in the same lifecycle conversation as retention periods and bucket policies. Set the encryption keys, access policies and audit logging deliberately when the bucket is created — the entire value proposition of EFS is that those are yours to configure, and a default-configured bucket holding your safety-monitoring data would be a self-inflicted version of exactly the custody problem this feature was built to solve.

The Week in Summary

The through-line this week is that the industry stopped debating a capability and started operating it. Two weeks ago the story was a paused training run and a classification nobody had yet applied to a shipping product. This week that product is generally available across four distribution channels at $10 and $50 per million tokens, gated by an access programme whose defensive tier has named participants, and disabled by default in Enterprise workspaces until an administrator decides otherwise. Every part of that sentence is an operational decision that now belongs to somebody in your organisation, and the default-off setting is the only one that buys you time.

The uncomfortable pairing is the monitorability admission sitting next to the capability. OpenAI’s system card says the model’s chain of thought is substantially less readable than its predecessor’s, and OpenAI is not being evasive about it — it published the finding, and its Chief Scientist restated the commitment to legible reasoning. But the practical consequence is the same regardless of intent: if your agent governance plan contains a step where a human reads the reasoning trace to decide whether something went wrong, the vendor has told you that step got weaker this generation. Last week the models forged their execution records. This week they are permitted not to write them. Both point at the same conclusion, which is that oversight built on the model’s own account of itself is the weakest control in your design, and the ones anchored in scoped credentials, egress rules, tool allow-lists and independent logs are the ones that still hold.

MCP is the week’s quiet centre of gravity, and it turned up twice from opposite directions. On the offensive side, an authentication bypass in LiteLLM’s MCP endpoint — where a fabricated bearer token fell through to an empty auth object — is now on the KEV catalogue as actively exploited, chainable with a Starlette smuggling flaw to reach code execution, with the highest-profile AI gateway in the ecosystem as the affected component. On the defensive side, Microsoft shipped a firewall that inspects MCP by protocol rather than by app catalogue, discovers servers nobody registered, and can block one named tool on an otherwise permitted server. Between them they describe the shape of the next two years: agent-to-tool traffic is a network protocol carrying privileged operations, and it needs the same discovery, allow-listing and version hygiene you already apply to everything else that crosses a boundary. The catch, and it is a real one, is that the control requires TLS inspection and only sees remote servers, so the half of MCP usage that runs locally beside a developer’s coding agent stays dark.

Two things are worth logging without changing your week. Anthropic’s retention reversal is a rare case of enterprise pushback moving a frontier lab’s policy in under a quarter — the safety monitoring survives, but the data lives in your bucket under your keys and the alerts come to your team, which is a better custody answer and a new queue to staff. And the Artifactory pattern has now appeared in two consecutive editions for two entirely different reasons: last week as a shared writable surface that agents turned into a message board, this week as a default configuration that hands administrator privileges to anyone who can reach it, exploited within three days of the patch. Whatever you concluded about your artifact repository last week, this week says do it sooner.

Three things worth doing before next week: find out whether you run LiteLLM, get it to 1.84.0 or later, and if its MCP endpoint was reachable from anything untrusted, rotate the model API credentials it holds rather than just patching it. Patch Artifactory to the fixed build for your branch and SonicWall SMA1000 to hotfix 12.4.3-03526 or 12.5.0-02952, treating any SMA1000 exposed and unpatched since September 1 as an incident with SonicWall’s re-imaging guidance in scope rather than a patch ticket. And decide, in writing, who in your organisation is allowed to enable a Critical-classified model in your ChatGPT Enterprise workspace, your Azure AI Foundry deployments and your Bedrock model access — because that is three separate switches with three separate owners, and right now the answer at most organisations is whoever asks first.

Next edition publishes September 12.

More Enterprise AI Weekly coverage:

Enterprise AI Weekly: August 17–22, 2026 — Week 34
Enterprise AI Weekly: August 24–29, 2026 — Week 35