Security · Briefing October 2026
Use AI safely.
AI can be steered with text — by strangers, too. Here is what is really happening, what you can do, and which software protects you.
Simulation starting …
- Briefing Oct 2026
- 6incidents
- 10risks
- 34software
- As of 16 Oct 2026
The essentials
The essentials
- 01AI can be steered with text — by strangers, too.
It gets dangerous when an agent sees private data, reads outside content and can send data out — all at once. Source ↗
- 02The problem is not solved.
OpenAI itself says prompt injection will remain an open challenge for years. Source ↗
- 032026 is the year of poisoned skills.
Skills are add-on abilities you install into an AI assistant. 341 malicious ones were found on the ClawHub skill marketplace — disguised as “prerequisites”. Source ↗
- 04The EU AI Act has largely applied since 2 August 2026.
High-risk duties were moved to December 2027 and August 2028 by an EU amendment package (the “AI Omnibus”). Source ↗
What actually happened
Six incidents worth knowing.
- June 2025EchoLeak
One crafted email was enough to pull data out of Microsoft 365 Copilot — zero clicks.
Source ↗ - Aug 2025Perplexity Comet
Hidden text on a web page made the AI browser read and send one-time codes.
Source ↗ - Sept 2025postmark-mcp
An MCP server connects an AI to other programs, such as your email. The first known malicious one secretly sent a copy of every email to the attacker.
Source ↗
Show 3 more incidents
- Nov 2025AI-run espionage
According to Anthropic, AI did 80–90% of the work in a state-backed attack campaign.
Source ↗ - Feb 2026ClawHavoc
341 malicious skills on ClawHub; most installed an info-stealer via fake “prerequisites”.
Source ↗ - Feb 2026Moltbook
An AI-built platform left its database open — about 1.5 million API keys.
Source ↗
The ten biggest risks of AI apps
Based on the OWASP list 2025 — in plain words. Tap a risk to see what you can do. OWASP ↗
Hidden commands (prompt injection)LLM01
Hidden instructions in web pages or documents change what the AI does.
What to doNever let the AI do anything important without your approval.
Data leaks (sensitive data disclosure)LLM02
Answers reveal personal data, credentials or company knowledge.
What to doOnly give the AI data that could safely appear in an answer.
Unsafe building blocks (supply chain)LLM03
Third-party models, data or libraries are tampered with or poorly vetted.
What to doUse checked sources and look at the check report.
Poisoned knowledge (data poisoning)LLM04
Manipulated training data plants backdoors or bias.
What to doCheck where the model and its training data come from.
Unchecked answers (output handling)LLM05
AI text is passed on unchecked — e.g. executed as code.
What to doTreat AI answers like input from strangers.
Too much power (excessive agency)LLM06
The AI has more rights, tools or autonomy than needed.
What to doGrant only the rights the task needs.
Leaking instructions (system prompt leakage)LLM07
Internal instructions leak — they are no lock.
What to doNever put passwords or secrets into the instructions.
Leaky knowledge stores (RAG)LLM08
Knowledge stores the AI pulls its answers from (RAG) leak data or get poisoned.
What to doDecide who may see which documents through the AI.
Wrong answers (misinformation)LLM09
Convincing but wrong answers.
What to doAlways check important facts at the source.
Cost trap (unbounded consumption)LLM10
Exploding costs or outages from mass requests.
What to doSet a spending limit with your provider.
Seven rules for you
- Give agents only the rights the task needs.
- Read purchases, emails and transfers yourself before approving.
- Never copy commands from skill descriptions.
- Don’t leave AI browsers alone in email or bank accounts.
- Keep sensitive things local — passwords and customer data belong in no chat.
- On calls about money: hang up and call back yourself.
- Turn on two-factor login, never share codes.
Seven rules for creators
- Never combine private data, outside content and sending out without approval.
- Everything your AI reads can be an attack — tool answers too.
- Scan skills, MCP servers and models before publishing.
- No keys in the frontend, database access rules on.
- Pin versions and document changes.
- Have it attacked before release and set cost limits.
- Label AI interaction and AI-generated content openly.
Software that protects
Scouted, sorted and automatically checked. No software catches everything — “no findings” does not mean “safe”.
Attack-test your chatbot – Find gaps before others do.
Guard inputs and outputs – Filters between user and model.
Scan skills, MCP & models – Before you install anything.
Spot fakes – Voices, videos, images.
Stay private – AI that runs locally or, per the maker, stores no data.
For companies – Platforms for teams and enterprises.
Claims about protection come from the maker. The trust score checks public signals such as origin, upkeep and reachability — not how well the software protects.
EU AI Act
What applies in October 2026
Most small creator products face no high-risk duties. Labelling and transparency affect almost everyone, though. Not legal advice. European Commission ↗
- 02.02.2025Bans on certain AI practices, AI literacy duty
- 02.08.2025Duties for general-purpose AI models
- 02.08.2026Largely applicable, transparency rules apply
- 02.12.2026Labelling of AI-generated content for existing systems too
- 02.12.2027High-risk rules for uses like education and hiring
How OROBO checks
Every product, every day — in the open.
- Automatically checkedOrigin, code patterns, licence, upkeep, reachability — daily, for every product.
- Reviewed by handWhen something is reported or looks unusual.
- Deep auditAt the creator’s request, by hand.
Security update
New attacks, new protective software — once a month, explained clearly.