The Board Room

What the attackers did once inside

Volexity tracks the actor as UTA0576. Per CyberScoop, it extracted credentials, dumped Active Directory metadata, deployed custom tools and tampered with logs. Researchers expect indiscriminate exploitation to speed up because the authentication bypass is trivial. A compromised VPN appliance is the front door to the identity layer, so containing it means hunting for stolen credentials, not only patching the box. The reporting does not establish how the attackers found the flaw, and the critique of Ivanti's policy holds either way.

Why "wait until exploited" no longer works

Ivanti's policy assumes a long gap between a vendor learning of a flaw and an attacker weaponizing it. Same-week evidence says that gap is collapsing. The Hacker News reports that XBOW chained three then-unknown Chrome bugs into code execution from a single page load. XBOW says it built the chain in six days using a public OpenAI model and values it as a $250,000 exploit. An AI pentesting agent also found a critical one-time-password bypass in production, and an AI-found Linux flaw turned out to span nearly a decade of kernel versions. XBOW sells offensive security and its claim is largely self-reported. We would still plan as if the direction is right, because underestimating attackers costs far more than overestimating them.

Microsoft's record Patch Tuesday adds the volume problem: 1,413 fixes, 1,102 of them in Windows, with one Windows Shell bug under active exploitation. No team patches that much at an even pace. The metric that matters becomes triage speed: separating flaws that are being exploited from ones that are only theoretically severe, and fixing the first group in hours or days.

Taken together, the two stories lead somewhere uncomfortable. If discovery keeps getting cheaper, a vendor that holds a known fix for its normal release cycle is betting your network on attackers being slow. Ivanti's record, with at least six of its catalog entries exploited since January, says they are not.

From security incident to procurement term

How long a vendor takes to fix a flaw it found itself is a policy choice, which means buyers can negotiate it. We expect three terms to move from best practice into standard security addenda:

• Patch SLAs for flaws that are known but not yet exploited.
• Rights to an independent compromise assessment, since a vendor's own integrity tool may report clean on a compromised device.
• A KEV-history score, meaning the vendor's track record in CISA's catalog of exploited flaws, reviewed at every renewal.

The longer-term move is architectural. Migrating to zero-trust network access (ZTNA), which grants access per application instead of opening a network-wide VPN tunnel, reduces dependence on internet-exposed VPN appliances. Start with the most privileged users. For competitors selling remote access, Ivanti's exposure opens a chance to win its customers, and that chance narrows as the news cycle moves on. If Ivanti speeds up its patch cadence and offers credible assurance, that argument weakens.

The company's own sentence is the first exhibit

OpenAI says it has built "industry-leading age-specific protections" and that many rival AI products lack them, Casey Newton reports. Under a consumer-protection theory, states will test that sentence against internal red-team results, incident logs and moderation data. New Mexico's case against Meta set the price at $375M in civil penalties plus a further $567M in relief. The state won by arguing that Meta told the public its platforms were safe for kids while knowing otherwise.

Newton argues that Meta had stronger legal protection than OpenAI has now, and we find that plausible. Meta could point to content posted by third parties. ChatGPT's outputs come from OpenAI's own system, which weakens the classic Section 230 defense that shields platforms from liability for what users post.

Eight states are one front among several

Eight is fewer than the 42 attorneys general who joined the 2023 Meta litigation, but a separate coalition of 42 states, led by New York, is already investigating OpenAI on product safety and privacy. Florida sued in June and British Columbia followed in September, with dozens of private suits pending behind them. A US appeals court has also let Florida's under-14 social media ban take effect.

Character.ai shows where this road ends

Morning Brew reports that Character.ai faced a Kentucky attorney general filing alleging its chatbots advised users to cut, starve or kill themselves, along with a Texas investigation. The company settled five lawsuits, reached a January 2026 settlement with families, banned under-18 users, and entered Chapter 11 citing "legal, regulatory, and operational headwinds." The Kentucky claims are unproven allegations.

The Character.ai and OpenAI complaints share one argument: engagement design is treated as intent. Both claim that agreeableness and time-spent were engineered at the expense of user safety. We would expect discovery to go straight to the A/B tests and retention dashboards. A persona-tuning decision a product team makes this quarter for growth reasons can surface later as a plaintiff's evidence of motive.

What to discount, and what not to

The states also ask courts to bar OpenAI from building self-improving models unless alignment can be ensured, Reuters reported. We expect that demand to fall away in court; it is there for the press release. OpenAI's call for "industry-wide" rules deserves more attention. It is a lobbying position for uniform standards, and incumbents absorb uniform standards more easily than challengers do. It also invites the same scrutiny of Anthropic, Google, Meta and every smaller assistant app.

Where the exposure sits

Companies shipping consumer conversational AI face the theory directly. Companies building on a frontier lab's API face it indirectly, through forced product changes and roadmap disruption at the supplier. The cheapest protection is the same in both positions. It consists of public safety claims that never go beyond what the company's own data can prove, and a written reason other than retention behind every engagement setting.

Neither the plan nor the catch ran through AI security

The FBI's account, as summarized by AI Breakfast, describes a sequence most corporate security programs were not built to see. On Sept 24, the accused allegedly began asking a chatbot, through his spouse's personal account, about building a recorder and encrypting recordings. On Sept 28 he allegedly planted the device behind a conference-room television. On Sept 30, OpenAI's technical surveillance countermeasures team, the people who physically sweep rooms for bugs, found it. Techpresso adds that a second recorder turned up in a bag holding his wallet and ID.

The planning trail sat outside corporate systems, and the detection was physical. The one step that ran through company infrastructure was the reconnaissance. An internal productivity tool answered his questions about office addresses, room capacities, calendars, and where leadership and external partner meetings were held.

The cost asymmetry is the lesson

Reports disagree on the device's price. Casey Newton identifies it as a $23.99 Seeed Xiao ESP32-S3 Sense, while MIT Technology Review puts it at $13.99. Either figure makes the point. The attack cost almost nothing compared with the value of the conversations in that room, which The Information describes as research, product, commercial and strategic discussions. FBI Director Kash Patel said protecting "American superintelligence" is among the bureau's highest counterintelligence priorities. In our view, that framing means the security expectations placed on frontier labs will spread to their partners and suppliers.

Partner meetings were explicitly in scope. If your team negotiates with a frontier lab, your deal conversations were inside the exposure.

The credibility cost reaches the courtroom

OpenAI said it "used our models to understand the device." NBC's Joanna Stern called that a "bizarre flex." Tone matters because the same company is now defending lawsuits that turn on whether its public statements can be believed. These are charges, not findings. No motive is stated, and OpenAI says it has no indication that model weights, source code or customer data were accessed.

What we would and would not do

An internal assistant's query logs are also your evidence trail, so scoping its access and keeping its logs belong together. What we would not do is write workforce policy around nationality. Several reports stress that no motive or foreign-state link is alleged. A nationality-based policy adds legal and talent risk without touching the actual entry points, which were an over-permissioned tool and an unswept room.