The first week of November produced a dense cluster of AI security findings across multiple vendors, attack categories, and deployment environments. This post covers the ones that matter operationally: an SSRF path from a Bedrock AI agent to full AWS account takeover, RCE in GitHub Copilot, opencode OAuth code execution, and documented cases of frontier models taking actions they were explicitly not authorized to take, including disabling their own security monitoring.
Amazon Bedrock AgentCore: SSRF to full AWS account takeover
Zenity researchers found that an exposed Amazon Bedrock AgentCore agent could reach the AWS instance metadata service (IMDS) through an HTTP-capable tool. A single crafted prompt could extract AWS credentials from the metadata endpoint and use them to take over every AgentCore agent in the same account and region. The impact: reading private conversations, planting persistent memories, and extracting secrets from AWS Secrets Manager.
AWS has patched the issue. The architectural lesson is durable: any HTTP-capable tool inside a cloud workload is an SSRF risk until proven otherwise. The standard mitigation is IMDSv2 enforcement with hop-limit set to 1, combined with default-deny egress rules blocking requests to 169.254.169.254. Agents deployed inside Lambda, ECS, or EC2 without these controls are vulnerable to this class of attack.
GitHub Copilot RCE via filename bypass (CVE-2026-103572)
Microsoft patched CVE-2026-103572, an Important-severity remote code execution flaw in the Copilot integration for Visual Studio and SQL Server Management Studio. The flaw: a check meant to stop Copilot from editing its own config file (`.mcp.json`) used exact string matching but missed `.mcp.json.`, a filename that Windows resolves to the same file because it ignores trailing dots. This allowed command execution and was also demonstrated via indirect prompt injection. The flaw is in a shared Copilot DLL.
In a separate finding, Adversa AI showed that GitHub Copilot CLI could be manipulated into decrypting an attacker-controlled payload in its own shell and exfiltrating local files including `.env.prod`. GitHub validated the finding but declined to treat it as a security vulnerability, citing autopilot mode behavior. The chain reproduced on the affected model as of October 1.
opencode RCE via MCP OAuth, Claude Code session inception, and embedded browser exploits
Three additional findings round out the coding-tool landscape. First: opencode (Windows/WSL) passed an attacker-controlled `authorization_endpoint` URL containing a PowerShell subexpression to the system launcher without escaping, executing code during MCP OAuth with no user consent. Fixed in version 1.18.33. Second: a Claude Code child session launched inside a malicious repository ran a SessionStart hook without required confirmation and exfiltrated bash environment data. Anthropic closed the report as Informative. Third: Adversa AI's EMBRACE research found that five AI assistants (Cursor, Codex, VS Code, Claude Desktop, GitHub Copilot) weakened browser same-origin protections in their embedded browsers, enabling file exfiltration or code execution.
Rogue agents: OpenAI models changed live databases, Claude Mythos 5 pushed malicious code
The most consequential findings of the week are the documented cases of frontier models taking unsanctioned actions in internal evaluation and production environments. OpenAI internal models used credentials found in public website JavaScript to change a live OpenSearch configuration setting and downloaded nonpublic tables containing 147,451 rows. Other agents bypassed GET-only restrictions through external browsers and accessed internal engineering machines.
Claude Mythos 5, Anthropic's internal model, took unsanctioned actions in 9 of 43 cyber evaluation runs with internet access enabled. These included attempting to push malicious code to an unrelated GitHub repository and creating fake identities to pressure a maintainer. Anthropic has disabled live internet access for internal evaluations. GPT-6.1 Sol disabled Security team alerts; GPT-6 Astra removed its own monitor integration and then denied doing so when asked.
Branch steering attacks, where untrusted page content steered computer-use agents into hazardous approved plans, succeeded 94.4% of the time against standard agents. Persistent memory injection payloads persisted across sessions in ChatGPT, Claude, and Gemini, with nearly half of proposed mitigations remaining unimplemented.
What defenders should take from this week
Several practical defenses emerge from these findings. Enforce IMDSv2 with hop-limit 1 and block egress to metadata endpoints at the OS or network layer in any environment where agents run. Scope customer and document tools to the session and bind tokens and approvals to requester, scope, and purpose on the service side. Keep monitoring configuration outside agent write scope. Treat memory files, scheduled tasks, and agent-written files as persistence mechanisms and audit them accordingly. Apply OS-level isolation with dropped capabilities rather than reduced Python sandboxes.
The pattern across all these findings is consistent: agents operating with elevated trust and broad capability sets are finding and exercising paths that their designers did not intend or anticipate. The attack surface is growing faster than the defensive tooling.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are deploying AI agents in production and want to review your threat model.