A 9.9 in GitLab's AI gateway outscored Cisco's live bypass

Two of today's items describe the same class of failure at almost the same severity, and only one of them came with a date set by somebody other than the vendor.

Cisco said attackers are actively exploiting CVE-2026-76504, a 9.8-rated authentication bypass in Catalyst SD-WAN Manager that grants unauthenticated remote access with administrator privileges and has no workaround. CISA added it to the Known Exploited Vulnerabilities catalog on September 30, with an October 3 deadline for federal civilian agencies (BankInfoSecurity).

GitLab patched CVE-2026-90970, rated 9.9, which let an authenticated user with Duo Agent Platform access escape the prompt template sandbox and run arbitrary commands on a self-hosted AI Gateway. The response on today's record is versions 19.2.4, 19.3.2 and 19.4.1, plus a round of contact with affected self-hosted customers before the advisory went out (Cyber Security News).

Both responses are competent. The difference is that one of them is enforced.

The gateway sits where the build runner sits

The GitLab flaw is not a question of what a model says. A prompt template is the input and a shell on the AI Gateway is the output, which puts the AI layer in the position a CI runner occupies: holding credentials, reachable by anyone with a seat, trusted by everything downstream.

Three more items today put AI features into that kind of position.

• AWS released Strands Decider 2B under the Apache 2.0 licence, a 2 billion parameter decision model that runs on a local CPU or GPU and returns answers in tens of milliseconds, built on a fine-tuned version of Alibaba's Qwen (The Stack).
• ServiceNow introduced Flow, a standalone AI service desk the company says deploys instantly, built to run through agents or collaboration tools such as Slack rather than its own user interface (The Stack).
• Synopsys is working with OpenAI on GPT-Synopsys, a model trained to help with chip design, and will share revenue with OpenAI on the resulting tools (The Stack).

A decision model answering in tens of milliseconds on local hardware, a service desk with no interface of its own, and a model inside a chip design flow are three new privileged positions announced in one day, by vendors whose customers will deploy them faster than they inventory them.

The person who wrote the safety reports left

OpenAI safety leader David Robinson, who led the writing of the safety reports that accompanied product releases, resigned in an essay for The Atlantic headlined "I quit OpenAI because its culture is broken", writing that the company is failing to achieve the level of care he believes is needed as it sprints from one launch to the next (The Guardian).

Read against the ledger's own record on OpenAI, the pace he describes is the company's defining fact: $122B committed at an $852B post-money valuation in March 2026, and more than 900 million weekly ChatGPT users (OpenAI), with a confidential IPO filing in June (CNBC). His objection is about speed, and speed is what the rest of today's record is made of.

Enforcement arrives once a category is settled

Today also shows what a mature response looks like. Dutch police arrested a 24-year-old man in Amsterdam as a suspected leader of ShinyHunters, a group the FBI's Brett Leatherman says has breached more than 140 organizations and taken at least $70 million in extortion payments, and a judge ordered him held for at least 90 days of pre-trial detention. The US Treasury sanctioned 10 people and entities over an ATM jackpotting network, where reported losses from more than 1,500 attacks reached $40.73 million as of August 2025 (BankInfoSecurity).

Extortion and cash-out fraud have catalogs, deadlines, arrests and sanctions lists. The AI gateway has a severity score of 9.9 and a vendor's mailing list. The scoring has arrived; the enforcement has not.