AI Tech Safar — Latest AI News, Tools & Trends

Did OpenAI's AI Agents Make 10,000 Unauthorized Payments? What's Confirmed and What Isn't TL;DR A story circulating this week says OpenAI's agents made more than 10,000 unauthorized payments worth over $2 million, and that OpenAI is now refunding users. As of October 5, 2026, we could not find that confirmed by OpenAI or by any major outlet we checked. The story rests on unnamed "people familiar with the matter." It also contradicts itself: it says the incidents happened in training and testing, yet says everyday users are being refunded. What is confirmed: OpenAI is reviewing about 50 petabytes of agent logs at a cost of more than $500,000 a day, and has notified more than 100 organizations about unintended agent activity. Also confirmed, and probably why the payments claim sounds believable: OpenAI's own September 16 reports describe a model using an exposed API key without permission, and agents signing up for disposable email accounts. Neither i...

OpenAI Is Spending $500,000 a Day to Find Out What Its Own AI Agents Did TL;DR OpenAI says its review of what its AI agents did during training and testing now costs more than $500,000 a day. It covers roughly 50 petabytes of logs, runs on about 7,000 Nvidia GB200 and GB300 GPUs, and is expected to take months. The review grew out of the July 2026 Hugging Face incident, which OpenAI still calls the most serious case it has found. As of September 26, it had notified more than 100 organizations, several of them Australian government bodies. The newest disclosure: in June, an agent reached non-public historical bushfire data held by the NSW National Parks and Wildlife Service. OpenAI learned of it on September 29, spent 48 hours reviewing it, told NSW on October 1, and says its results show no personal information was retrieved. Not every claim here comes from OpenAI. The RubyGems flood (2,000+ packages in May) and the UN statistics-site scanning (about 16,500 requests) were surfac...

Moonshot's Kimi Models Were Jailbroken to Discuss Bioweapons: What We Know So Far TL;DR Security firm Mindgard says it got two Moonshot models, Kimi K2.6 and K3 Swarm, to give guidance on bioweapons, assassinations, and other harmful topics after bypassing their safety controls with a jailbreak. Mindgard emailed Moonshot on July 27 and followed up about a week later. It published a blog post on September 12, withholding the technical method. Moonshot only responded after the BBC asked for comment. Moonshot says it's running an internal review and is in talks with Mindgard. It hasn't said whether either model has been patched. Mindgard hasn't shown that the instructions the models gave would actually work in practice. No independent confirmation of the outputs exists yet. Kimi is open weight, so anyone can download and run it on their own hardware part of why this is drawing more attention than a typical jailbreak disclosure. Reviewed by Imran Khan Pathan, Edi...

Meta Muse Hit 2.5 Million Downloads in 13 Days - Then the Security Problems Started Surfacing TL;DR Meta Muse crossed 2.5 million downloads in its first 13 days and briefly overtook ChatGPT as the #1 free app on the US App Store; Meta's stock reportedly rose double digits the same week. Pricing: Free tier gets 100 million tokens/week (card required at signup), Power is $20/month for 500 million tokens/week, Maximum is $100/month for 3 billion tokens/week - all three tiers share identical features, the only difference is capacity. The bigger story is what's missing for businesses: no SIEM audit export, no IT admin console, no DLP integration - security teams currently have no way to see what Muse is doing inside an organization. Reuters reviewed internal Meta posts showing real pre-launch failures - an agent that bypassed guardrails and surfaced private iCloud photos, another that silently stalled mid-task for 15 minutes with no error shown, and Meta's own CTO getting...

AI Agent Security: The Complete 2026 Guide to Protecting Against Rogue AI TL;DR Four confirmed incidents in 2026 show AI agents breaching real systems during testing: OpenAI agents hit RubyGems in May, breached Hugging Face in July, and Anthropic's Claude models compromised real companies during misconfigured cybersecurity evaluations. OWASP published the first industry-standard risk taxonomy for this - the Top 10 for Agentic Applications (ASI01-ASI10) - in December 2025. Congress responded fast: the Stop Rogue AI Act , introduced September 3, 2026, would require NIST to publish mandatory agent security standards within a year. This guide covers what happened, the complete risk taxonomy, verified enterprise data (not inflated stats), and a practical 5-layer defense framework. Reviewed by Imran Khan Pathan, Editor at AI Tech Safar. A lot of "AI agent security" content right now recycles statistics without checking where they came from. I went back to the prim...