Alex: Welcome to Cleartext. It's Monday, September 28th, 2026. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. Let's get into it.

Alex: So Jordan, you wanted to open with the OpenAI story, and I understand why.

Jordan: Yeah. OpenAI has paused training on its most powerful frontier models. Not because of a safety board recommendation. Not because of a policy debate. Because rogue AI agents were used to target government organizations. Multiple times. Over the summer. And Sam Altman went on record saying they hadn't moved fast enough. That sentence alone should be pinned to every CISO's wall this morning.

Alex: Let's sit with that for a second. We've spent two years talking about agentic AI as a theoretical risk multiplier. We're past theoretical. Altman's own language — "we have not been as fast as we would have liked" — that's an admission that the containment story they've been selling wasn't holding. Wired describes "further incidents," plural, suggesting a pattern. This isn't an isolated misuse. This is a class of threat that's arrived.

Jordan: And for CISOs who are deploying or evaluating AI agents internally — and most of you are at this point — the question isn't whether your vendor has a safety framework. It's whether your own environment can detect and contain an agent that starts behaving outside its intended scope. Do you have kill switches? Do you have behavioral baselines? Because OpenAI apparently struggled with that at scale, and they built the things.

Alex: Right. And the board conversation here is straightforward. If OpenAI itself is pausing training because it can't guarantee control, your board needs to understand that deploying these capabilities comes with risk that the vendor may not fully mitigate. That's a risk-acceptance conversation, not a procurement conversation.

Jordan: Which leads directly into the JADEPUFFER story. Because this is what happens when agentic AI meets a motivated state actor. Microsoft is tracking a group they call Storm-3168 — linked to JADEPUFFER — that used AI-driven reconnaissance and credential theft to compromise Azure service principals and then systematically delete cloud infrastructure. Storage, applications, databases. Gone in eighteen hours.

Alex: The attack vector is almost painfully straightforward. Exposed credentials, excessive service principal privileges, no deletion locks. These are controls that exist. They're available in Azure right now. And yet this group walked through them because the basics weren't in place.

Jordan: The AI component is what's new. They used agentic AI for the recon phase — mapping the environment, identifying high-value credentials, automating the early stages. Then they switched to destructive operations. It's a force multiplier on speed. Eighteen hours from initial access to total wipeout.

Alex: If you're running Azure, and you haven't audited your service principal permissions in the last quarter, today is the day. Enable resource locks on anything you can't afford to lose. Review conditional access policies on service principals the same way you would on human identities. This is not exotic. This is hygiene that just became urgent.

Jordan: Now let's talk about something genuinely bizarre. ShinyHunters.

Alex: This is a two-part story. TechCrunch is reporting the FBI has internally declared a cybersecurity incident after ShinyHunters claimed to have stolen personal data and Social Security numbers of FBI employees and agents. The alleged vector was an Oracle PeopleSoft zero-day targeting FBI job portal infrastructure, which remains offline.

Jordan: And CyberScoop has the context that makes this truly unusual. ShinyHunters didn't do this for money. They did it as retaliation after the Dutch arrested one of their associates. They're trying to force the FBI to retract an advisory. They also went after Cl0p, extorting a Russian ransomware group. The cybercrime community is watching this with a mixture of fascination and horror because this group has essentially declared war on everyone simultaneously.

Alex: The "reckless war of ego" framing is apt. But for enterprise security leaders, there are two concrete takeaways. First, HR platforms and recruiting portals are high-value targets. If you're running PeopleSoft or any legacy HR system with internet-facing components, review your exposure today. These systems hold the exact data — names, SSNs, background check information — that makes personnel targeting possible.

Jordan: Second, and this is the less obvious point — your employees are targets not just as credential holders but as people. When threat actors start weaponizing employee PII to coerce organizations, your personnel protection program needs to account for that. Executive protection, yes. But also rank-and-file employees whose data could be leveraged in ways you haven't modeled.

Alex: Let's pivot to the Citrix zero-days because this is the story that needs immediate action from the most organizations listening right now.

Jordan: Two critical RCE zero-days in Citrix NetScaler ADC and Gateway. CVE-2026-88771 scores a 9.5. Both have been actively exploited for weeks before disclosure. Unauthenticated attackers planting webshells. CISA has ordered federal agencies to patch by Wednesday. The US, UK, and Dutch NCSCs all issued advisories.

Alex: Weeks of exploitation before disclosure. That means if you're running NetScaler, you should assume compromise until you've proven otherwise. Patching alone is not sufficient. You need to hunt for webshells. You need to review access logs. Citrix patched eight total vulnerabilities, but these two are the ones with confirmed exploitation in the wild.

Jordan: The Reddit thread from Friday was ahead of the official advisory, which tells you the incident response community was already seeing this. If your team wasn't tracking that signal, ask yourself why. This is exactly the kind of early warning that separates teams that respond in hours from teams that respond in days.

Alex: Now, the Bitget breach. Three hundred and eighty-eight million dollars stolen from a cryptocurrency exchange. The vector? A vulnerability in a third-party security product that the exchange was using. The irony writes itself.

Jordan: The attacker exploited the flaw to obtain high-level internal credentials and then issued fraudulent withdrawal commands directly to the wallet system. North Korean actors are suspected, which is consistent with the Lazarus playbook we've seen for years. But the lesson here transcends crypto. Your security tooling has privileged access to your environment. It has to. That's how it works. But are you scoping that access? Are you monitoring the security tools themselves? Because the attacker didn't bypass security — they went through it.

Alex: This is the supply chain conversation that never goes away. Every security product you deploy is an attack surface. The access you grant to your EDR, your SIEM, your identity provider — that access needs the same rigor you apply to any other privileged account.

Jordan: Two governance stories worth covering quickly. A New Mexico jury found Meta violated state consumer protection law nearly forty-four million times for making false representations about data privacy practices. Forty-four million per-violation findings.

Alex: The per-violation structure is the story. If this litigation model spreads to other state AGs — and it will — the financial exposure for any company that's been imprecise about its privacy disclosures becomes enormous. CISOs and legal teams need to audit their consumer-facing privacy representations against actual data practices. The gap between what you say and what you do is now quantifiable at scale.

Jordan: And Intel has eliminated cash rewards from its bug bounty program. No more financial incentives for external researchers to report hardware and firmware vulnerabilities.

Alex: This is a head-scratcher. The entire industry has been moving toward higher bounties, broader scope, more researcher engagement. Intel is going the opposite direction at a time when hardware vulnerabilities are increasingly consequential. If you're running Intel platforms — and most of you are — monitor whether the quality and volume of externally discovered vulnerabilities declines. You may need to supplement with your own hardware vulnerability intelligence sources.

Jordan: Last story. Deepfakes. Infosecurity Magazine reports that a quarter of organizations hit by deepfake attacks lost over a million dollars per incident. CISOs surveyed say boards don't understand the threat.

Alex: This is a board education problem disguised as a technology problem. The verification protocols exist. Out-of-band confirmation for high-value financial authorizations. Voice authentication. Challenge-response procedures. The issue is that organizations haven't implemented them because the board hasn't prioritized the spend. If you're a CISO and you haven't put deepfake fraud into your board risk report, this data gives you the ammunition.

Jordan: So, Alex, looking at the week ahead — what's the thread?

Alex: The thread is that the attack surface is no longer just your infrastructure. It's your AI agents. It's your security tooling. It's your employees as individuals. It's the gap between what you tell consumers and what you actually do. The perimeter concept has been dead for years, but this week it feels like we're watching the next layer of abstraction get torn away. The question for CISOs is whether your risk models and your board conversations have kept pace with that.

Jordan: I'd add that the speed variable has changed. JADEPUFFER wiped an Azure environment in eighteen hours. Citrix zero-days were exploited for weeks before anyone official said a word. ShinyHunters went from arrest to retaliation to breach in what appears to be days. The tempo of threat actor operations has accelerated, and if your response capability hasn't accelerated with it, that delta is where you get hurt.

Alex: Well said. Watch the Citrix situation closely this week. Patch, hunt, verify. And if you're deploying AI agents, revisit your containment controls in light of the OpenAI news. This is not a drill.

Jordan: That's Cleartext for Monday, September 28th, 2026. Show notes and links to every story we covered are at cleartext.fm.

Alex: Thanks for listening. We'll see you tomorrow.