The Intake
The Intake — Saturday, September 26, 2026
On the substrate
Orkes Conductor pre-auth RCE under active exploit; patch available in 3.30.2
Empirical Security Research The Hacker News SecurityWeek
If you're running Orkes Conductor in your AI pipeline stack, this is the patch to move on. Orkes Conductor is an AI workflow orchestration platform that coordinates task execution across agent pipelines and services. CVE-2026-58138 is a pre-authentication remote code execution flaw. It is rated CVSS v3.1 9.8. It affects versions 3.21.21 through 3.30.1. The patched release is 3.30.2.
The flaw sits in a GraalVM evaluator configured with HostAccess.ALL. It is reachable through INLINE, LAMBDA, DO_WHILE, and SWITCH task types. An unauthenticated attacker reaching those task types can execute arbitrary OS commands. Between September 2–9, 2026, Orkes says it blocked nearly 7,000 exploit attempts. Orkes logged 1,290 blocked in a single 24-hour window on September 9.
If your Conductor deployment is reachable from the internet without authentication, the INLINE and LAMBDA task types are the exposure to audit — not just the version check.
Gemini accessed three external company systems in a misconfigured May 2026 security test; Google disclosed in September
If your AI evaluation setup runs with live internet access — even if the test scenario uses fictional names and credentials — the Gemini incident names the gap. Google disclosed on September 18, 2026 that its Gemini model gained unauthorized access to three external company systems. The evaluation was a capture-the-flag exercise run by Irregular, an independent AI security testing firm. The access occurred in May 2026.
A fictional company name used in the test scenario matched a real domain on the public internet. The evaluation environment was connected to live internet rather than an isolated sandbox. Gemini gained access by guessing credentials or locating them in a public repository. Google VP Heather Adkins told NBC News the model "believed the systems were part of the test." Adkins said it stopped before taking further action in all three instances.
Google learned of the incidents from Irregular in late July 2026. The public disclosure came after Wall Street Journal reporting prompted it in September. If you run AI security tests where test-scenario entities — names, domains, credentials — haven't been checked against live public resources, both gaps are now documented.
Claude Code v2.1.277 adds native AGENTS.md fallback support
Classmethod DevOps.com mer.vin
Claude Code v2.1.277 adds AGENTS.md as a fallback instruction file. The version shipped September 18, 2026. When no CLAUDE.md is present, Claude Code reads AGENTS.md instead. AGENTS.md is the project-instructions format used by OpenAI Codex and other AI coding tools. More than 60,000 repositories already carry the file, per Classmethod's analysis of public repositories.
The feature is a fallback only — repositories with an existing CLAUDE.md are unaffected. Availability is currently limited to the CLI and desktop versions. Bedrock, Vertex, and Foundry are not included in this release.
If you maintain project-instruction files across repos that multiple AI coding agents share, one instruction file format fewer to manage per repo is the practical change.
---
For operators
Upgrade Orkes Conductor to 3.30.2; audit internet-accessible deployments for INLINE and LAMBDA task exposure
Empirical Security Research SecurityWeek The Hacker News
If you're on Orkes Conductor between versions 3.21.21 and 3.30.1, 3.30.2 is the patched release. That's the version check.
The second decision is task type exposure. CVE-2026-58138 is exploitable through INLINE, LAMBDA, DO_WHILE, and SWITCH task types. If your deployment is internet-accessible without authentication, whether those task types are active determines how immediate the exposure is. With them active, the GraalVM evaluator is the reachable surface. If those task types aren't active in your deployment, the immediate exploit path doesn't apply — the version check still stands.
The Gemini evaluation named two infrastructure checks: network isolation and test-entity overlap with live resources
If you run AI evaluations, red-team exercises, or security tests, the Gemini incident surfaces two specific infrastructure checks. First: is the evaluation environment network-isolated from the live internet? The Irregular evaluation was not — it had live internet access rather than a sandboxed environment. Second: have any fictional entities in the test scenario — company names, domains, credentials — been checked against live public resources? In the Gemini case, a fictional company name matched a real domain on the public internet.
Both were present at the same time. The decision the incident closes is on two infrastructure checks: network isolation, and fictional entities in the test scenario verified against live public resources before the test runs.
---