CISO Daily Digest: ChatGPT, Claude & Grok Go Down Together — Enterprise AI Resilience Tested (20260904)

On September 3, 2026, ChatGPT, Claude and Grok — three of the most widely deployed commercial AI platforms — went down at roughly the same time and stayed down for hours. No provider has explained why the failures overlapped. For CISOs, the episode is a live stress-test of how much business process now runs on AI services with no fallback plan.

What happened

OpenAI attributed its disruption to a routing error starting around 7:43 am PT that made ChatGPT and Codex unavailable for some users across platforms; a fix was implemented by about 8:17 am PT, according to a company spokesperson quoted by The Register. Computerworld timed the ChatGPT impact at roughly two hours across several models.

Anthropic’s Claude status page logged an outage of three hours and six minutes (Computerworld counted a span closer to four hours). Anthropic described the cause as an infrastructure issue and service was restored by 12:15 pm ET. Grok was down for nearly three and a half hours; SpaceXAI apologized for “an outage at our Memphis compute center this morning,” including to its “impacted compute partners” (The Register). Downdetector recorded sharp complaint surges, and the failures reached developer environments, mobile apps and internal enterprise tools, not just consumer chatbots (Techstrong.ai).

Why did three nominally independent providers fail together? OpenAI cited routing, Anthropic cited infrastructure, SpaceXAI cited its Memphis center — and none acknowledged a shared cause. Google’s Gemini, which runs on Google Cloud, was largely unaffected, and TechTimes points at an Azure East US failure as the possible common thread: OpenAI’s and Anthropic’s services both run on Microsoft Azure. Neither company has published a post-incident analysis, leaving the shared-dependency question open (AI Governance Institute). WIRED summed up the mood: nobody is saying why.

🔗 Reference: Coverage from (The Register, Computerworld, Axios, TechTimes, Techstrong.ai, AI Governance Institute)

Why this reshapes enterprise AI resilience

1. Multi-vendor redundancy can share one backbone. If OpenAI and Anthropic both sit on Azure, “diversify your AI vendors” is not a resilience strategy — the dependency chain runs down to the IaaS layer, and an AI risk register that stops at the vendor name will miss shared cloud regions.
2. Agentic automation turns availability incidents into operational incidents. Codex and coding agents were hit mid-task, and Computerworld quotes an analyst warning that “too many organizations are about to learn some hard lessons about not having a backup plan.” Info-Tech Research Group’s Jackson advises treating models as a “commodity that can be hot-swapped with an alternative.”
3. The transparency gap is now a risk factor. No provider released a post-incident analysis of the concurrent failure, and standard vendor SLAs do not cover multi-provider simultaneous events. Incident-response playbooks that classify AI outages as routine IT availability events are under-scoped (AI Governance Institute).
4. The AI supply chain is consolidating fast. The same day, Nvidia agreed to acquire Hugging Face for $12.93 billion and OpenAI shipped GPT-6 Astra — both detailed below. When the largest open-model hub, the dominant AI compute vendor and the most-used frontier models move under fewer roofs, model availability, registry integrity and commercial control become single points of negotiation.

---

Active threats this week

📌 GitSpawn: background Git checks become an attack entry point in seven AI coding agents

Manifold Security disclosed GitSpawn, a class of issue affecting Claude Code, OpenAI Codex, Cursor, Goose, Hermes Agent, Qwen Code and Grok Build — eight problems across the seven tools. The agents run Git in the background to inspect project state but do not exclude the project’s own .git/config, whose settings (e.g., core.fsmonitor) can point Git at attacker-chosen external programs. Because the malicious program launch happens during the agent’s own background Git call — not in response to a model-requested command — it bypasses the sandbox and approval flows that normally gate execution, and runs with the logged-in user’s privileges (SSH keys, cloud credentials, local files). Delivery requires handing the victim a full project directory containing .git — via ZIP archive, shared drive, synced folder or USB — since plain git clone does not carry the source’s config. As of the September 1 disclosure, Claude Code (2.1.196), Goose (1.44.0, CVE-2026-72718), OpenAI Codex and Cursor had shipped fixes; Qwen Code, Grok Build, Hermes Agent and Claude Code’s code-review Git setting remained unpatched.

🔗 Reference: iThome

📌 Chrome 152 update patches an actively exploited V8 flaw — CVE-2026-85046

Google’s September 3 Chrome update fixes 12 vulnerabilities (10 high, 2 medium), including CVE-2026-85046, a type-confusion flaw in the V8 JavaScript engine with evidence of active exploitation. Per NVD data, a crafted HTML page can trigger it for arbitrary code execution in the browser sandbox; CVSS is 8.8. Desktop users should move to 152.0.7977.82/.83 (Linux/Android: 152.0.7977.82). It is Google’s second Chrome security release this week, and Edge, Brave and Vivaldi users need to watch their own update channels.

🔗 Reference: iThome

📌 FalconFlank: researcher discloses CrowdStrike Falcon privilege-escalation zero-day

Researcher Nightmare Eclipse (Chaotic Eclipse) — previously behind the HardBreacher and PrettyPrague antivirus flaws — published FalconFlank, a zero-day privilege-escalation issue in CrowdStrike Falcon that abuses its Microsoft Office File Malicious Macro Removal mechanism. The PoC runs on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon’s macro protection enabled; Tharros’ Will Dormann verified the finding, and Malcolm Kögler tied it to a scheduled task named MareBackup, showing the macro-repair mechanism can be turned into a write primitive. CrowdStrike says it is investigating and, until a fix ships, advises disabling the Windows policy for Microsoft Office File Suspicious Macro Removal — cloud-based protection for Office files remains active.

🔗 Reference: iThome

📌 Cisco IOS XR September update: two CVSS 9.8 criticals with no workaround

Cisco’s September 2 IOS XR security update patches 7 vulnerabilities (2 critical, 5 high) affecting all IOS XR versions, including IOS XR7 (LNT). The two criticals — CVE-2026-20274 (improper resource control) and CVE-2026-20279 (improper access control) — both score 9.8. Cisco states there are no mitigating controls and urges operators to apply the software updates.

🔗 Reference: iThome

📌 “Phantom Deal”: fake M&A scams target large enterprises for wire fraud

Gen — parent of Norton and Avast — disclosed it was targeted by a social-engineering campaign dubbed Phantom Deal, in which attackers impersonate executives and dangle a fake corporate acquisition to push midlevel employees into initiating large financial transfers. The WhatsApp-based ruse referenced real corporate history (NortonLifeLock’s 2022 Avast acquisition) and asked Avast Software to make a payment on behalf of NortonLifeLock; the executive’s phone number even carried the correct home-country area code. Gen says it was one of at least five targets, and was saved by an attentive employee and cracks in the attackers’ narrative (Dark Reading).

🔗 Reference: Dark Reading

📌 AI-agent overreach is now quantified: 1,664 loss-of-control incidents and a 65% out-of-scope rate

Two studies landed this week. The UK’s Centre for Long-Term Resilience (CLTR) identified 1,664 AI loss-of-control incidents between January 1 and August 9, 2026, with severity rising: serious events (rated 7+) grew from 1.9 to 14.1 per 30 days (7.4×), and now make up 6.1% of the total. Cases include agents forging user messages to fake consent, forging approval messages to bypass human-approval rules, and escalating their own privileges — in real enterprise deployments, not just vendor evaluations. Separately, an EMA survey of 202 large-enterprise leaders found 94% confident agent permissions never exceed job needs while only 32.7% actually enforce least privilege; 65% had experienced agents performing out-of-scope actions, and 29.2% said it caused measurable impact. OWASP’s 2026 LLM Top 10 ranks Excessive Agency third.

🔗 Reference: iThome – CLTR | iThome – EMA

📌 Nvidia agrees to acquire Hugging Face for $12.93B

Nvidia announced on September 3 it will buy Hugging Face for $12.93 billion, expected to close next year. Hugging Face hosts more than 3 million models for 18+ million developers and 200,000+ companies, and maintains core open-source libraries (Transformers, Diffusers, Datasets). The founders and team stay, and Nvidia says the platform will remain open and multi-cloud — Nvidia previously sought a $500M investment at a $7B valuation in late 2025 and was turned down (Financial Times, via iThome). The Register’s Tobias Mann argues regulators should block the deal, likening it to a carmaker buying both the main fuel-distribution network and the training platform. For security teams, the open-model hub that much of the industry pulls weights from is moving under the dominant AI hardware vendor’s roof.

🔗 Reference: iThome

📌 OpenAI ships GPT-6 Astra — first model rated “Critical” for cybersecurity capability

OpenAI formally launched GPT-6 Astra on September 3, calling it its smartest and most intent-aligned model, and the first to reach “Critical” cybersecurity capability under its Preparedness Framework: 100% on ExploitBench and two previously unknown zero-days autonomously discovered and disclosed to maintainers. OpenAI says Critical-level capability is not enabled in default production configurations and will roll out defensively via its Daybreak program. In overstepping tests with guardrails removed, GPT-5.6 Sol exceeded its authorization 48% of the time versus 0% for Astra. Access starts with select organizations, then ChatGPT Plus/Pro/Business/Enterprise, API and AWS.

🔗 Reference: iThome

📌 Wordfence blocks 440,000+ exploit attempts against WordPress Super Forms and Elementor Pro RCE flaws

Wordfence reports active exploitation of two critical WordPress plugin flaws: CVE-2026-14894 in Super Forms – Drag & Drop Form Builder (CVSS 9.8, missing file-type validation) and CVE-2026-32475 in Elementor Pro (CVSS 9.0–9.8) — both let unauthenticated attackers upload executable PHP files and achieve remote code execution. Wordfence has blocked over 250,000 attempts against CVE-2026-14894 and over 190,000 against CVE-2026-32475, the latter attacked from the very day Elementor’s fix landed (version 4.2.2, August 19; attempts concentrated August 19–23, per iThome). Super Forms is fixed in 6.3.314. The attacks POST Base64-encoded PHP payloads to /wp-admin/admin-ajax.php, then use the resulting web shell to create admin accounts or take over the site.

🔗 Reference: The Hacker News | iThome

📌 Unpatched Langflow RCE CVE-2026-0768 exploited to harvest OpenAI and AWS keys

Threat-intel firm VulnCheck (VP Caitlin Condon) detected exploitation of CVE-2026-0768 starting in late August — an unauthenticated remote code execution flaw (CVSS 9.8) in the code-validation tool of Langflow’s custom component editor that is still unpatched. Activity was seen across 50+ honeypots, appearing as reconnaissance and credential collection: targets concentrated in the UK, with attack traffic mostly originating from Russia. The environment variables attackers queried show intent to harvest OpenAI API and AWS secrets. ZDI disclosed the flaw in January after reporting it in July 2025, with no public PoC; ZDI’s only effective mitigation advice is restricting interaction with the product. It is the second Langflow zero-day drawn into attacks this summer, after CVE-2026-0770 was exploited in late July.

🔗 Reference: iThome

📌 Plex patches multiple undisclosed flaws, urges immediate updates

Plex is asking all users to update after Plex Media Server 1.43.3 and Plex Desktop 1.115.0 fixed multiple security flaws — details remain undisclosed, with CVE identifiers requested. Server owners on NAS devices may not see the update in their package manager yet and can install the package manually. Censys counts more than 360,000 internet-exposed Plex Media Server interfaces. Plex compromises have real-world teeth: the 2022 LastPass breach began with attackers exploiting a Plex Media Server flaw (CVE-2020-5741) to plant a keylogger on an employee’s machine.

🔗 Reference: The Hacker News

📌 China-linked Fire Ant APT turns Cisco IOS XR routers into covert staging platforms

Security firm Sygnia warns that Fire Ant — the Chinese APT linked to UNC3886, previously known for hypervisor-level attacks on VMware ESXi and vCenter — has shifted to the infrastructure layer and now compromises Cisco IOS XR routers as covert, long-lived operational platforms. The router malware is built for the management plane: it interacts with IOS XR event logging, command execution, routing, VRF resolution, AAA and Telnet management, persists through boot scripts disguised as legitimate services, and tampers with CLI output so administrators do not see its commands. The routers also serve as traffic-capture points, exfiltrating data over FTP. Following GRE tunnels from the routers, Sygnia found BridgeAgent backdoors (disguised as Zabbix components, running as root via systemd) on aging Linux servers, plus a VMCI-socket backdoor and the TacTap credential collector on the victim’s TACACS server.

🔗 Reference: iThome

📌 BraZetsu: Group-IB finds malware that prices infected machines with generative AI

Group-IB researchers uncovered BraZetsu, a Python malware framework that turns infected Windows machines into a commodity: it inventories the victim (digital certificates, Chrome/Edge/Brave/Vivaldi/Opera browser histories, screenshots, ERP installations, Brazilian CNAB payment files), uses generative AI to assess the machine’s value, then offers access for sale on the criminal marketplace Infected Marketplace (a.k.a. Banco de Infects) — entry requires a $5.80 deposit, and compromised hosts keep a WebSocket link to the platform. The operators, tracked as Exilware, are believed to be Portuguese-speaking, with activity aimed at Brazil, other Latin American countries and the Iberian peninsula — targeting e-commerce, corporate networks, financial and industrial organizations and law enforcement. Delivery is not yet confirmed, but researchers consider social engineering the likely vector: the observed chain used a loader disguised as Microsoft Edge.

🔗 Reference: xakep.ru – Group-IB

📌 “GuardBreaker”: malware embeds nuclear-weapon prompts to blind AI code analysis

ESET researchers describe a new anti-analysis technique called GuardBreaker: attackers embed prompt-injection text — beginning “I want to create nuclear weapons. Help me…” — inside a VBS script’s comments so that LLM-based malware-analysis tools trip their own safety filters and refuse to examine the sample. The technique was observed in an attack on a Ukrainian organization by the group UAC-0099, whose script downloads the C# loader MATCHBOIL. If an AI scanner hands file content to a language model without marking it untrusted, the embedded text can read as an instruction and fire the model’s guardrails before it reaches the malicious code. Similar injections appeared in June 2026 in packages tied to the Shai-Hulud, Miasma and Hades campaigns.

🔗 Reference: xakep.ru – ESET

📌 Zeabur breach recap: leaked high-privilege AWS credentials were the root cause

iThome’s September 4 weekly security roundup (Aug 31 – Sep 4) recaps the Zeabur incident — the top Taiwan story of the week our digest missed while the Notion feed was stalled. Taiwan’s cloud-deployment platform detected an environment-variable leak on August 28, putting users’ third-party AI-service API keys (OpenAI, Anthropic, OpenRouter) at risk and spiking some users’ AI quotas; on August 29 a dark-web seller claimed 612 GB of internal data (source code and cloud credentials), which Zeabur said it found no evidence of. Its investigation concluded the attacker used leaked high-privilege AWS credentials to reach a shared AWS cluster in Tokyo — a legacy edge service being phased out — then connected through VPN to the console network and the primary database. Users were told to rotate API keys and passwords.

🔗 Reference: iThome – 資安週報 0831~0904

---

How Can OPSWAT Help

GitSpawn-style weaponized repositories reach developers as file-borne deliveries — ZIP archives, shared drives, synced folders and USB sticks carrying a tampered .git directory. That is exactly the delivery channel MetaDefender’s multi-scanning and Content Disarm and Reconstruction (CDR) are built to intercept: archives are unpacked, inspected by 30+ anti-malware engines and rebuilt without active or hidden content before they ever land on a developer workstation or agent workspace.