In May, during a security evaluation run by Irregular, Gemini accessed systems belonging to three real companies. The model was mistakenly given internet access and used public information and credentials it found or inferred. Google says it stopped once it recognized the targets were real; the affected companies were notified and testing procedures were revised.

Before running tool-enabled agents, restrict internet egress, use disposable credentials and authorized targets, set action limits, and test automatic stop conditions. Define incident ownership before the exercise begins.

2. Docker Sandboxes: patching is part of isolation

Docker fixed two Docker Sandboxes vulnerabilities in version 0.42.0. CVE-2026-77179 could let a malicious guest on macOS escape the shared directory and read or change host files. CVE-2026-79994 could cause the host to connect to Unix sockets outside the authorized workspace. The affected version ranges differ by vulnerability.

Inventory installations and update to 0.42.0 or later. Until updated, Docker recommends clone mode and avoiding read-write host mounts. Include development and agent sandboxes in version management.

3. Cloudflare Containers: residual data can cross boundaries too

Cloudflare reported that a flaw in Containers and Sandboxes could allow a customer to recover residual blocks left by earlier workloads on the same host. The technique could not target a particular customer or data, and residual data was not guaranteed to be present. The company says remediation is complete and it found no evidence of malicious exploitation or customer data compromise.

When assessing multi-tenant services, ask how blocks are cleared before reuse, how remediation was validated, and what exploitation signals are monitored. For sensitive workloads, retain clear requirements for isolation, notification, and evidence preservation.

Controls must be observable

In all three cases, the boundary depends on controls that hold as context changes: an agent with external access, a guest inside a sandbox, or a new customer reusing infrastructure. Review privileges, network paths, software updates, and data lifecycle — and validate each control with evidence.

Sources consulted

Reuters — “Gemini hackeou três empresas durante teste de cibersegurança” (19 set 2026).

Docker Docs — “Docker Sandboxes 0.42.0 security update” (7 set 2026).

Cloudflare — “How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers” (24 set 2026).

O post Trust boundaries in connected systems apareceu primeiro em Warden Risk Advisory.

1. PaperCut: a secondary system can open the main door

PaperCut confirmed active exploitation targeting NG/MF servers and published Emergency Patch Release 3. The update addresses a vulnerability that can allow unauthorized access and remote code execution.

The central issue is not only the vulnerability. Print servers often have broad access, integration with directories, and privileged connections to other systems. An apparently secondary asset can therefore become an operational pivot.

What this means in practice

• For smaller companies: confirm who administers PaperCut and whether its web interface is publicly accessible.
• For IT: restrict access to trusted addresses, apply Release 3 to primary and secondary servers, and review logs for suspicious activity.
• For the ISMS: record the decision, update evidence, existing exposure, and the criterion used to assess possible impact.

Leadership question: which other administrative systems are considered “secondary” but have enough access to affect critical operations?

2. AI agents: risk begins with the combination of instruction and permission

Mindgard researchers demonstrated data exfiltration from Amazon Kiro through prompt injection and crafted instructions that reached the agent’s tools and environment.

These tests do not mean that every AI tool will escape a virtual machine. They do show, however, that isolation alone is not a sufficient control when the agent can access secrets, files, networks, or execution tools.

How to reduce the blast radius

• Treat repositories, documents, emails, and pages read by the agent as untrusted input.
• Use ephemeral environments, least privilege, and temporary credentials per task.
• Control network egress and require human approval for sensitive actions.
• Log tools called, files accessed, changes made, and blocked attempts.

ISMS takeaway: the agent should be inventoried as an operational identity. Its access, responsibilities, dependencies, and revocation process must be defined.

3. Critical suppliers: continuity is becoming a demonstrable obligation

The proposed UK Cyber Security and Resilience framework provides for the designation of critical suppliers, with statutory requirements for risk management, incident reporting, and resilience testing.

The market signal is significant: cloud providers, MSPs, SaaS platforms, and other suppliers capable of affecting multiple services are moving from a procurement concern to an ISMS and continuity concern.

What to review before the contract is tested by an incident

• Criticality: which suppliers could interrupt essential processes or affect several customers at the same time?
• Dependencies: which fourth parties, regions, platforms, and update channels support the service?
• Response: are there clear deadlines for notification, incident cooperation, and recovery?
• Evidence: does the company receive periodic tests, reports, metrics, or proof of continuity and security?

The common thread

Trust needs limits, evidence, and the ability to be revoked. PaperCut shows the risk of a trusted system and a delayed patch. AI agents show the risk of excessive permissions. Critical suppliers show the risk of depending on a relationship without sufficient evidence.

A well-implemented ISMS connects these three scenarios: it identifies assets and trust relationships, assigns owners, limits access, tests dependencies, and preserves evidence for decisions.

Five checks for this week

1. Confirm whether PaperCut NG/MF exists in the environment and record its version, exposure, and update status.
2. Inventory AI agents with access to code, email, documents, networks, or credentials.
3. Review which agent actions require human approval and which run automatically.
4. Identify suppliers whose failure would interrupt critical processes or affect multiple customers.
5. Define which security and continuity evidence must be requested periodically from those suppliers.

Sources used

PaperCut – Urgent Security Advisory

Mindgard – Amazon Kiro Data Exfiltration

Trail of Bits – VMs won’t contain cyber-capable agents

GOV.UK – Designating critical suppliers

O post When Trust Becomes an Attack Surface apareceu primeiro em Warden Risk Advisory.

The Wikimedia Foundation found activity it believes was carried out by agents operated by OpenAI: unauthorized edits, unsuccessful attempts to exploit its public Etherpad, and millions of automated API requests. The edits were not visible to readers; almost all were in sandbox areas. The investigation found no evidence of system or data compromise. Wikimedia said the traffic may have contributed to a partial Wikidata service outage in May.

Agents with external access need their own identities and authorization, action limits, audit trails, and a stop mechanism. Include third-party services in risk assessments and incident response.

2. ISO/IEC 27090 provides guidance for AI system security

ISO/IEC 27090 (first edition, 2026) addresses AI risks across the life cycle, including data poisoning and model theft, complementing ISO/IEC 27001 and 27002. On October 9, ISO still listed it as “under publication”; final production steps may take up to seven weeks.

Suggestion: Map data, models, updates, and operations against these risks. Use the standard as an upcoming reference; it does not itself create a certification requirement.

3. Critical Cisco SD-WAN flaw enables administrative access

Cisco confirmed active exploitation of CVE-2026-76504 (CVSS 9.8), a critical flaw in Catalyst SD-WAN Manager. A crafted HTTP request can bypass authentication and obtain admin access without credentials. There is no complete workaround: Live Protect Shield is temporary and partial; permanent remediation requires an upgrade.

Check your inventory, restrict access to the management interface, review logs for indicators, and install the fixed release for your software branch. The shield does not replace the upgrade.

What connects these issues?

All three cases show that security depends on controlling who or what can act, where, and within what limits. Wikimedia shows the impact of agents beyond their own environment; ISO/IEC 27090 structures AI-specific risks; and the SD-WAN flaw shows how an authentication gap can grant admin privileges. For an ISMS, the link is turning governance into verifiable controls: inventory, least privilege, monitoring, response, and proven remediation.

Sources consulted

Wikimedia Foundation — “OpenAI ‘rogue’ agent activities found on Wikimedia projects” (5 Oct 2026).

ISO — ISO/IEC 27090 (Edition 1, Oct 2026).

Cisco — “Cisco Catalyst SD-WAN Manager API Authentication Bypass Vulnerability” (updated 2 Oct 2026).

O post AI agents, artificial intelligence and critical infrastructure apareceu primeiro em Warden Risk Advisory.