This week the agent-security bill got real, a popular LLM proxy landed on CISA’s exploited list, Chrome patched another in-the-wild zero-day, and OpenAI published the inference bill for running a research org on agents.
Six stories from the last four days, picked for what they change for people running infrastructure, security, or AI systems in production. Each one has a “why it matters” and a source link. Tap through the log files below for the short version, then read on for the detail.
[2026-09-03 security] CISA KEV adds LiteLLM MCP auth bypass
CISA added CVE-2026-59822 (CVSS 8.8) to its Known Exploited Vulnerabilities catalog: an authentication bypass in LiteLLM’s MCP Streamable HTTP endpoint. A crafted Bearer token slips through the OAuth2 passthrough fallback and lets unauthenticated callers list and invoke MCP tools.
Why it matters: LiteLLM sits in front of a huge number of internal AI gateways. If yours exposes MCP, upgrade to 1.84.0 or later today. The Hacker News
[2026-09-03 policy] House introduces Stop Rogue AI Act
A bipartisan bill would direct NIST to publish standards for continuously verifying agent actions, evaluating agent security, and generating tamper-proof action logs. It is a direct response to the OpenAI and Hugging Face agent breach earlier this summer.
Why it matters: “Tamper-proof action logs” is about to become a compliance line item. Teams already logging every agent tool call are ahead. Axios
[2026-09-04 security] Chrome patches exploited V8 zero-day
Google shipped Chrome 152.0.7977.82/.83 to fix CVE-2026-85046, a type-confusion flaw in the V8 engine with a confirmed in-the-wild exploit. It is the sixth actively exploited Chrome zero-day patched in 2026.
Why it matters: Every AI browser agent and every Electron-based tool on your fleet rides on this engine. Push the update through your MDM this week. BleepingComputer
[2026-09-06 agents] OpenAI: automated research intern goal met
OpenAI says its research org now logs 3.1 agent-workdays for every human workday, the median researcher spends over 600 dollars a day on inference, and the target is now a fully automated AI researcher by March 2028.
Why it matters: This is the clearest public data yet on what an agent-heavy engineering org costs to run. Budget for it. OpenAI
[2026-09-03 open models] MBZUAI ships K2 Horizon
Six Apache 2.0 models from 0.9B to 375B parameters with weights, code, training data, and methodology all published, and day-zero support in vLLM, SGLang, Ollama, and Unsloth.
Why it matters: The small tiers are strong enough for on-prem triage and classification agents where data cannot leave the building. The National
[2026-09-04 tooling] Microsoft Project Zenith
A Windows 11 variant preconfigured for developers (VS Code, WSL, Terminal on by default) that requires 64GB unified memory so coding models run locally instead of burning cloud tokens. AMD’s Ryzen AI Halo is the launch platform.
Why it matters: Local inference on the developer laptop is becoming a hardware spec, not a hobby. Techzine
1. CISA flags active exploitation of LiteLLM's MCP auth bypass
On September 3, CISA added seven vulnerabilities to its Known Exploited Vulnerabilities catalog. The one that should worry AI platform teams is CVE-2026-59822, an authentication bypass in LiteLLM's MCP Streamable HTTP endpoint rated CVSS 8.8. The bug is subtle: when key validation fails, the OAuth2 passthrough fallback returns an empty auth object instead of rejecting the request, so a crafted Bearer token gets through. From there an unauthenticated caller can list and invoke MCP tools and pivot into whatever those tools reach.
Why it matters: LiteLLM is the default proxy in a very large share of internal AI gateways, and MCP is how agents get their hands on real systems. This is exactly the shape of attack the whole industry has been warning about. Upgrade to LiteLLM 1.84.0 or later, then audit which MCP tools your proxy exposes and what credentials they hold. The same KEV batch also included RCE flaws in JFrog Artifactory and Kestra OSS, so CI/CD teams have homework too.
Source: The Hacker News
2. The Stop Rogue AI Act would put NIST in charge of agent security
Representatives Josh Gottheimer and Mike Lawler introduced a bipartisan bill on September 3 that directs NIST to publish standards for continuously verifying agent actions, evaluating agent security and reliability, and producing tamper-proof action logs. Backers include Palo Alto Networks, GoDaddy, and Infoblox. The bill is framed as a direct response to the OpenAI and Hugging Face agent incident from earlier this summer.
Why it matters: Whether or not this passes, "tamper-proof action logs" and "continuous verification" are now written down as the expected baseline for agents in production. If your agent pipeline cannot answer "which agent called which tool, with which inputs, approved by whom," start there. It is also the cheapest possible compliance win, since append-only logging is a day of work. We cover the pattern in the security and DevOps tracks.
Source: Axios
3. Chrome patches its sixth exploited zero-day of 2026
Google shipped Chrome 152.0.7977.82 and .83 on September 4 to close CVE-2026-85046, a type-confusion bug in the V8 JavaScript engine that could allow remote code execution in the renderer sandbox. Google confirmed an exploit exists in the wild. That makes six actively exploited Chrome zero-days fixed since January.
Why it matters: V8 is not just Chrome. It is Electron, it is Node, and it is every browser-driving AI agent your team has started experimenting with. A browser agent with a live session to your admin consoles is a much richer target than a human tab. Push the update through your device management tooling now and check that your agent runners pin a patched Chromium build.
Source: BleepingComputer
4. OpenAI says it hit the "automated research intern" milestone
In a September 6 post titled "Research acceleration: The view inside OpenAI," the company said it has met the target it set last fall: a system that carries out well-defined research tasks that would take a human days. The numbers are the interesting part. The research org now logs 3.1 agent-workdays for every human workday. The median researcher spends more than 600 dollars a day on inference, and the 90th percentile burns over 7,000 dollars a day in tokens. The next stated goal is a fully automated AI researcher by March 2028.
Why it matters: This is the first public, first-party accounting of what an agent-saturated engineering organization actually costs and yields. If you are planning agent fleets for your own team, these ratios are a reference point for budgeting, and a warning that inference spend needs the same per-team governance as cloud spend.
Source: OpenAI
5. K2 Horizon: six fully open models, 0.9B to 375B
MBZUAI's Institute of Foundation Models released K2 Horizon on September 3: six Apache 2.0 models at 0.9B, 3.7B, 7B, 32B, 36B-A4B, and 375B-A23B parameters, with weights, code, training data, and methodology all published. IFM claims state-of-the-art results at the small sizes on reasoning, math, coding, and agentic benchmarks, and the models are supported from day zero in vLLM, SGLang, Ollama, and Unsloth.
Why it matters: The 3.7B and 7B tiers are the sweet spot for on-prem agents that classify logs, triage tickets, or summarize alerts without sending data off-site. A fully published training pipeline also makes these unusually easy to justify to a security review. If you followed our Ollama walkthrough last month, these are worth a pull.
Source: The National
6. Microsoft's Project Zenith: Windows built for local models
Microsoft's Project Zenith ships Windows 11 preconfigured for developers, with VS Code, WSL, and Terminal installed and full path and extension visibility on by default. The notable requirement is hardware: 64GB of unified memory and at least 250 GB/s of bandwidth, so coding models in the 30B-plus range run locally. AMD's Ryzen AI Halo platform, with 128GB LPDDR5X, is the launch target, and AMD claims support for models up to 200B parameters.
Why it matters: Local inference is now a laptop procurement spec. For DevOps and security teams that cannot ship code or logs to a cloud model, a standard developer image with local model support removes the biggest objection to AI-assisted work. Expect the "what laptop should we buy" conversation to change this budget cycle.
Source: Techzine
The thread running through this week
Three of the six stories are about agents touching real systems and the controls around them: a proxy that let anyone call MCP tools, a bill that wants every agent action logged, and an org running three agent-days per human-day. The direction is clear. Agents are becoming infrastructure, and infrastructure gets audited. If you want to build that discipline before it is mandated, the DevOps Boot Camp is where we teach it.
