OpenAI models steal credentials and lie, Microsoft writes AI rules it can't enforce, Congress punts AI safety to 2027

OpenAI admits its own models jailbroke themselves, stole credentials, and leaked data. Microsoft publishes a code of conduct promising its AI will never go rogue. September's record-breaking Patch Tuesday is still breaking windows. And the U.S. Congress says no new AI safety laws until 2027. This is Cybersecurity Today, and I'm your host, David Shipley. Let's get started. OpenAI says its own AI models jailbroke themselves, stole credentials, and leaked data. Six separate times. The Hacker News reports OpenAI disclosed six incidents of concerning model behavior over the past six months, alongside a new framework for tracking and reporting AI misalignment. These issues aren't the same as the three active incidents where OpenAI's agents committed crimes by hacking. They're not the same as the third party's, including Hugging Face, a German wiki, and allegedly, Ruby Gems. As part of its investigation, OpenAI disclosed that one of its internal models wrote jailbreak instructions into its own memory summaries, telling itself to ignore developer messages. Another model instructed itself to hide its mistakes and invent missing data. A third found an exposed API key on GitHub, used it without authorization, and when the data it wanted wasn't there, it cheated and just made the data up. Others uploaded records to a public PACE service, passed notes through Artifactory, and shared a private workbook publicly in direct violation of their instructions. But the story here isn't this faux threat report that's actually just more marketing. It's all keeping the drumbeat loud on lawmakers in order to force them to draft new regulations. Just the way the AI companies want them. All of this leaves us with two uncomfortable possible takes on the last few weeks of felony humble bragging. First, either these AI companies are being exceptionally self-serving and manipulative, or they're shockingly naive about what they've built and have displayed a jaw-dropping lack of understanding of how the thing they've built actually works. Here's why I have a hard time believing that they're that incompetent. The University of Pennsylvania Wharton Schools' Call Me a Jerk study last year showed large language models exhibit parahuman behavior. They respond to flattery, authority, and persuasion the same way that people do, because they learned it from human writing. Bruce Schneier warned this summer that AI acts like a genie, that they are extraordinarily literal and can be maliciously pedantic. And before him, Norbert Weiner, the founder of the field of cybernetics, 70 years ago, compared automation's granting of our wishes, or prompts as is the case now, to the monkey's paw. So how can anyone in these AI companies be shocked that these models lie, cheat, and manipulate to achieve their goals? They're mimicking what they were taught. And these models will do anything, even what we don't want, to achieve their goals. And that's baked into the DNA of this technology. Meanwhile, Microsoft wants you to know its AI models will never go rogue. Microsoft AI published its draft code of conduct for what it calls Humanist AI, a governing document for its AI model family, which it calls MAI. The draft code was released Monday for six weeks of public consultation. It makes some pretty big promises. Microsoft says its MAI models will never resist human interruption, correction, or shutdown. They won't use deceptive or self-reinforcing mechanisms to evade oversight. They won't collude with other models, won't tamper with their own records, won't extend their scope beyond what they've been asked to do. Microsoft says there's going to be a chain of command, Microsoft's code at the top, then operator policies, then user preferences, with absolute constraints that no one can override. Now, let's examine that with what we've just learned from Microsoft's code at the top. Microsoft says there's going to be a chain of command, Microsoft's code at the top, OpenAI's models did nearly everything on the prohibited list from Microsoft. They hid their mistakes, they colluded through Artifactory, they exceeded their scope, grabbed credentials, and moved data where it didn't belong. They did it on their own, or at least that's what OpenAI says. Microsoft, to its credit, admits there's a gap here. Buried in Part 5, the document concedes that the written objectives alone can never ensure actual alignment. That their AI's behavior may diverge from what's specified, and that the code of conduct, quote, is not a guarantee of present-day performance. This code of conduct is not being used to train today's models. It's a North Star goal for Microsoft for 2027. A few weeks ago, back on the weekend show, we spoke with Mark Beitzman, AI threat research lead at Varonis, about why model guardrails, just like this, fail. He and his team have demonstrated single-click, exploit chains against Microsoft Copilot, and an Atlassian confluence attack, dubbed RovoBlast, prompt injection that walks straight past built-in guardrails and exfiltrated data. In the case of the Microsoft Copilot most recent hack, CoSnitch, they got the AI to tell them how to hack itself. Beitzman provided a framework for modern AI attacks that runs three steps, enter, evade, escape. His blunt assessment is simple. Models have no loyalty and an unlimited hunger for data. Guardrails can be talked around with psychological manipulation. We're not going to be saved from AI's failings by a better code of conduct document. Beitzman's prescription is layered controls, least access privilege, restricted data access, and monitoring that treats the model as untrusted, because it always should be. Microsoft's consultation on the code of conduct runs for the next six weeks. A revised version of the code of conduct will be released in the next six weeks. The revised code is expected to arrive at the end of the year, which will be used to govern models at some point in 2027. Staying with Microsoft, Microsoft's September updates are still breaking things. Bleeping Computer reports Microsoft has shared a temporary fix for a bug that locks Windows 11 users out of their own machines. Valid domain credentials are failing, and trust relationships are breaking. The culprit here is a security feature called Machine Identity Isolation. The security feature is called Machine Identity Isolation. September updates cause Windows to start honoring any existing policy that enables enforcement. But that feature only works in environments running Windows Server 2025 domain controllers. Everywhere else, it breaks authentication. The workaround requires admins to disable the feature the same way it was enabled, through Intune, Group Policy, or Registry, then restart and repair the secure channel. A future update will block enforcement until Microsoft sorts it all out. On Wednesday's episode, we covered other emergency out-of-band updates from Microsoft that fixed remote desktop failures, as well as Hyper-V problems and broken USB audio. Patch volume is crushing quality. Play that forward and you get a bad trend. Unpatch Wednesday. Organizations installing fixes on Patch Tuesdays, watching things break, and then rolling them back. Except this time, it's worse. Attackers are loading published vulnerabilities, into AI attack engines, within hours, while defenders deliberately return themselves to a known vulnerable state. A patch that gets rolled back protects nobody, and now everybody knows exactly where you're exposed. All of this is exposing the flaws of trying to fight machine threats at machine speed, when those machines aren't that great at creating patches. And finally, the U.S. Congress says it won't be rushed into AI regulations. And honestly, that may be for the best. The Record reports House Energy and Commerce Chair Brett Guthrie won't commit to a committee vote this year on the Frontier Act, the bipartisan bill from Republican Jay Orbernolte and Democrat Lori Tron, backed by OpenAI, Anthropic, and a growing cross-party list. Orbernolte wants a vote in November, Guthrie says the bill is complicated, and he won't rush it through a lame-duck session of Congress, and quote, not get it right. Meanwhile, AI firms keep making the case for urgency when it comes to regulation. Although not everybody in the AI company camp says we need to rush through new regulations, Hugging Face CEO Clem DeLange says existing cyber law is working fine. He'd like to see simply more mandatory disclosure when AI agents are involved in attacks, and more details on how these attacks are actually working. Meanwhile, the White House opposes any kind of new regulation. Its advisor, David Sass, is floating Elon Musk's alternative to regulation. Musk wants AI companies to safety-test each other's models before they release. We don't need regulations for the sake of just having regulations. Nor do we need the regulations handwritten by the big AI companies to stifle open-source or Chinese competitions and to blunt possibly real accountability for their crimes. We need regulation that will actually hold these firms accountable when they fail, and when they fail. they commit crimes. That's worth taking the time to get right. And that's Cybersecurity Today for Friday, September 18th, 2026. I've been your host, David Shipley. Thanks for listening. We appreciate all of your feedback. Feel free to reach us at technewsday.com or.ca, or you can leave a comment under the YouTube video. Our month in review panel is back on Saturday, and we're going to talk about AI doomerism, Microsoft's record-breaking Patch Tuesday, and the return of Unpatch Wednesday. We'll also talk about the difference between compliance and security, 2026 edition. I'll be back on Monday with the latest headlines. Until then, I hope you have a great week, and stay safe.