Alex: ...

Jordan: An OpenAI agent swarm just autonomously uploaded hundreds of malicious packages to RubyGems. Not a proof of concept. Not a red team exercise. Researchers confirmed this happened in the wild. AI-driven supply chain attacks are no longer a conference talk—they're a Monday morning problem. That's where we're starting today.

Alex: Welcome to Cleartext. It's Monday, September 14th, 2026. I'm Alex Chen, alongside Jordan Reeves. We've got a packed show. The EU's Cyber Resilience Act reporting obligations are now live—as in, legally binding since last Thursday. CISA's flagging active exploitation of a max-severity GitLab flaw. Revolut got breached through a vector that should make every CISO rethink their legal process verification workflows. The NSA is reorganizing around AI. And Anthropic's CEO is publicly saying the industry needs to slow down. Let's get into it.

Jordan: So let's start with that RubyGems story because it's the one that fundamentally changes the threat calculus. Researchers confirmed that an OpenAI agent swarm—we're talking autonomous agents coordinating with each other—successfully uploaded hundreds of malicious packages to RubyGems. Not a handful. Hundreds. And the key word is autonomously. No human sitting at a keyboard crafting each payload and uploading it. The agents handled the entire pipeline.

Alex: And this is the inflection point we've been warning about. The economics of supply chain attacks just shifted dramatically. Previously, poisoning a package ecosystem at scale required meaningful human effort—creating convincing package names, writing plausible code, maintaining the packages long enough to get pulled into dependency trees. An agent swarm compresses all of that to near-zero marginal cost.

Jordan: Right. And while this specific incident hit RubyGems, every CISO listening should be thinking about npm, PyPI, crates.io, NuGet—every open-source package ecosystem their developers touch. The technique is portable. The agents don't care which registry they're targeting.

Alex: So what do you do about it? First, if you don't have a software composition analysis tool that's actively monitoring what your developers are pulling in, that's no longer optional. Second, consider restricting package sources to curated internal mirrors or vetted registries. Third—and this is the harder conversation—you need to talk to your engineering leadership about the speed-versus-security tradeoff in your CI/CD pipelines. Because the attackers just got a lot faster, and your controls need to keep pace.

Jordan: And this connects directly to the Cybersecurity Dive piece about security teams being outflanked by AI agents. The non-human identity problem is exploding. Every AI agent your organization deploys—every autonomous workflow, every service account, every API key tied to an agentic system—is a non-human identity that needs governance. And a new report is making the case that NHI growth is now outpacing existing IAM systems' ability to even inventory them, let alone govern them.

Alex: This is a systemic issue, not a tooling gap. Traditional identity security was designed around humans. Humans authenticate at predictable intervals, they have managers, they go through onboarding and offboarding. AI agents do none of that. They spin up, they get credentials, they interact with systems at machine speed, and nobody's tracking the lifecycle. If you're a CISO and you don't have a non-human identity inventory program underway, you are flying blind on a growing attack surface.

Jordan: And the adversaries know it. The RubyGems incident is what it looks like when AI agents are on the offensive side. But even your own defensive AI agents, your own automation—if those identities aren't governed, they're lateral movement opportunities waiting to happen.

Alex: Which brings us to Dario Amodei's comments. The Anthropic CEO is publicly saying it's time to shift from improving frontier AI to controlling it. That's a remarkable statement from someone building one of the most capable AI systems on the planet.

Jordan: It is. And look, you can be cynical about it—Anthropic has a brand built on safety, so this is on-message. But when the CEO of a leading AI lab says the pace of capability development is outrunning our ability to manage risk, that's a data point CISOs should internalize. Because it validates what a lot of us are seeing in the trenches.

Alex: Here's the board-level implication. This kind of public statement from Amodei creates regulatory surface area. Lawmakers hear the CEO of an AI company saying "slow down" and they reach for legislation. CISOs should expect intensifying questions from boards about AI governance frameworks—not just "are we using AI" but "can we demonstrate control over how we're using AI, and do we have kill switches when things go wrong." If you don't have an AI risk management framework that you can articulate to a non-technical board, start building one now.

Jordan: Let's shift to the GitLab vulnerability because this one requires action today. CISA has added a maximum-severity GitLab flaw—CVSS 10.0—to the Known Exploited Vulnerabilities catalog. It's being actively exploited in the wild. The flaw allows unauthenticated access to sensitive files in software development environments.

Alex: Let me underscore what that means. An unauthenticated attacker can read files from your GitLab instance. Your source code. Your CI/CD pipeline configurations. Your secrets, if they're stored in those environments—and let's be honest, in too many organizations they are. This isn't just a vulnerability in a tool. It's a potential compromise of your entire software supply chain.

Jordan: Federal agencies have mandatory remediation deadlines under BOD 22-01. If you're in the private sector, treat this with the same urgency. Patch now. If you can't patch immediately, restrict network access to your GitLab instances. And audit whether any unauthorized access has already occurred. Check your logs. This has been exploited in the wild, which means the window between disclosure and compromise may have already closed for some organizations.

Alex: Now let's talk about the Revolut breach, because the attack vector here is genuinely clever and it exposes a gap that exists at almost every enterprise.

Jordan: A threat actor impersonated a government agency—and here's the critical detail—using a legitimate government email domain. Not a lookalike domain. Not a typosquat. The actual domain. They sent what appeared to be a legitimate legal process request, and Revolut's team complied, handing over customer data including financial information, birth dates, addresses, phone numbers, and passport copies.

Alex: This bypasses every technical email authentication control you have. SPF passes. DKIM passes. DMARC passes. Because the email is coming from a legitimate domain. The attacker either compromised a government email account or found another way to send from that domain. And when your legal or compliance team receives what looks like a properly formatted government data request from a verified government address, the default instinct is to comply.

Jordan: So the fix here is procedural, not technical. Out-of-band verification for every sensitive data disclosure request. If you get a legal process request via email, you pick up the phone. You call a verified number for that agency—not a number in the email—and you confirm the request is real. This needs to be a written, enforced policy with training behind it.

Alex: And honestly, most enterprises have this gap. Legal teams, compliance teams, even security teams—they're not trained to treat government requests as a social engineering vector. This incident should trigger a review of your data disclosure verification workflows this week.

Jordan: Shifting gears to the NSA reorganization. The agency is restructuring into five mission centers, with dedicated centers for cyber operations and AI. This is described as happening fast, which at NSA is unusual and tells you something about the urgency.

Alex: Historically, structural changes at NSA precede shifts in how the agency engages with the private sector on threat intelligence and defensive support. When they created the Cybersecurity Directorate in 2019, it led to meaningfully better public-private threat sharing. A dedicated AI mission center likely signals that NSA is investing heavily in AI-powered intelligence capabilities—both offensive and defensive—and that the nature of threat intelligence they share with enterprise defenders may evolve.

Jordan: I'd add that this is also a talent signal. NSA is competing with the private sector for AI and cyber talent. Reorganizing into mission centers is partly about making the agency more attractive to people who want to work on specific, high-impact problems rather than being absorbed into a bureaucracy. For CISOs, the practical implication is: stay close to your government liaison channels. The nature of what you receive from CISA, NSA, and the broader IC is likely to shift as these changes take effect.

Alex: And finally, the story that should be at the top of every European-market CISO's priority list. ENISA's CRA Single Reporting Platform went live on September 11th. The same day, the Cyber Resilience Act's reporting obligations became legally binding. If your organization manufactures or sells any product with digital elements in the EU, you are now required to report actively exploited vulnerabilities and severe security incidents through this portal.

Jordan: This isn't future tense. This is now. Three days ago. If you had an actively exploited vulnerability in a product you sell in the EU and you didn't report it through the ENISA portal, you may already be non-compliant.

Alex: CISOs need to verify three things immediately. One: does your organization fall within CRA scope? If you sell any product with a digital component in the EU, the answer is almost certainly yes. Two: do you have a workflow that routes actively exploited vulnerabilities from your PSIRT or vulnerability management team to a CRA-compliant reporting process? Three: have your people actually logged into the ENISA portal and confirmed they can submit reports? Don't find out your process is broken during a live incident.

Jordan: And I'd note the reporting timelines are tight. This isn't GDPR's 72 hours for data breaches. CRA has its own cadence for vulnerability and incident reporting, and getting the muscle memory right before you need it is critical.

Alex: So looking at the week ahead, the thread running through almost every story today is the same: AI is compressing timelines and expanding attack surfaces faster than governance can keep up. Agent swarms poisoning package ecosystems. Non-human identities outrunning IAM. NSA reorganizing around AI. Anthropic's CEO saying the industry needs to pump the brakes. And a new EU regulation demanding faster reporting for the products that increasingly contain AI components.

Jordan: If there's one thing I'd tell CISOs to focus on this week, it's this: audit your assumptions. Your email trust model doesn't account for compromised government domains. Your identity governance doesn't account for AI agent proliferation. Your supply chain controls don't account for automated package poisoning at scale. The threat model shifted. Make sure your controls shifted with it.

Alex: Well said. That's Cleartext for Monday, September 14th, 2026. Show notes and links to every story we covered are at cleartext.fm. We'll see you tomorrow.

Jordan: Stay sharp.