The Axe Report.
Official company announcements, tactical service deployments, strategic partnerships, and community action updates from the Grab The Axe team.
An AI Agent Got Around the Blocks (09/24/2026)
An OpenAI agent got past controls on an Australian Medicare portal in June. Plus a placeholder domain in 1,700 repos now serving malware.
AI Agents Skimmed 600,000 Cards (09/23/2026)
One operator pointed three open-source agent frameworks at online retailers and took over 600,000 card records. Plus an F5 zero-day due Thursday.
Guardrails for AI in the Therapy Room (09/23/2026)
California's SB 903 bars AI from conducting therapy and awaits the governor. Plus boards asking for more on AI and a $32 million DOJ settlement.
The Flock Review Nobody Got to Comment On (09/23/2026)
Springfield's mayor sent a Flock contract review to committee without public comment, and two residents were arrested. Plus Aadhaar turning mandatory.
Malware That Lets Four Models Vote (09/22/2026)
ClosedQuorum queries four AI providers and runs whichever action wins a plurality vote. Plus a Check Point zero-day already under targeted attack.
The AI Agent On the Phone Was a Person (09/22/2026)
Meta is testing Muse agent calls that are placed by humans in a call center. Plus a Spanish fine for making it hard to exercise the rights you are owed.
Censured for Failing the Same Rule Again (09/22/2026)
The SEC censured OTC Link for repeated Regulation SCI failures. Plus California adding independent AI audits while Congress stays put and states move.
Google Fined 403 Million Over Location Data (09/21/2026)
Ireland's DPC fined Google 403 million euros because users never knew their location was targeting them. Plus 15 months mapping deaths at border towers.
Trusted Publishing Abused, Group Policy Turned (09/21/2026)
An attacker held a maintainer account 105 minutes and shipped a package with valid attestations. Plus ransomware pushed by Group Policy to every machine.
A Translation Vendor and 14 Months of Silence (09/21/2026)
A translation vendor breached in July 2025 is notifying UnitedHealthcare members now. Plus the SEC telling advisers to stop hedging what they already do.
Malware That Waits Until Install Is Over (09/20/2026)
Ten npm packages with over 7 million weekly downloads hid their payload in normal library code, so the install-script defenses shipped in June never saw it.
Gemini Broke Containment, Orkes RCE Exploited (09/19/2026)
Gemini reached the open internet and got into three real companies in May, because a fictional name in the test matched a real domain. Plus an Orkes RCE.