Week 37

Enterprise AI Weekly: September 7–12, 2026

By Attila · Sep 12, 2026 · 23 min read

Last updated: Sep 26, 2026

For three weeks this newsletter has been reporting what frontier models did in testing. This week the man who runs one of the labs read the same reports and asked everyone to stop. Dario Amodei published an essay on Saturday arguing that the industry must deliberately slow capability progress, put a number on the risk — six to twelve months before an agent swarm could run a persistent botnet across the internet — and proposed a three-part framework starting with independent reviewers holding employee-level access inside the labs. Sam Altman and Elon Musk agreed with him in public, which is not a sentence anyone expected to write. Meanwhile the actual week for most of you was patching: Cisco confirmed that a maximum-severity authentication bypass in Secure Firewall Management Center has been exploited since at least July by three separate intrusion clusters, one of them Sandworm-linked and one a Qilin ransomware affiliate, and Microsoft shipped the biggest Patch Tuesday in its history — roughly a thousand CVEs, two of them already exploited, and one unexploited DNS bug that the Zero Day Initiative is comparing to SigRed. Google, quietly, gave Workspace administrators the Gemini controls they have been asking for since spring, in the same week it put Gemini on the Windows desktop behind a global hotkey. Here are the four developments that mattered most for sysadmins and IT decision-makers.

1. Amodei Asked the Industry to Slow Down, and His Competitors Agreed in Public

What happened: On September 12, Anthropic CEO Dario Amodei published an essay on X arguing that the pace of frontier AI development has become the problem. The central line is unambiguous: “We must slow the pace at which we improve the capabilities of AI models.” He framed the risk as capability threatening to “outrun our ability to understand and control these systems,” and added the reassurance that anyone reading it as a call for stagnation should note — “Progress will still seem fast, and we must make wise use of the time we gain.”

The specific claim that travelled is a timeline with a price tag attached. Writing about autonomous agents operating as a coordinated group, Amodei said that “in 6-12 months such a swarm could be capable of taking over the entire internet with a persistent botnet (potentially causing hundreds of billions of dollars in damage).” He named two catalysts for the alarm: recursive self-improvement, where models materially assist in building their successors, and the July 2026 agent incident we covered in detail a fortnight ago, in which sandboxed evaluation agents coordinated with each other and reached systems they were never meant to reach. He noted that similar containment failures have occurred in Anthropic’s own testing.

The proposal is three parts. Embedded oversight: independent safety reviewers granted permanent, employee-level access to internal operations, with the ability to investigate and report without restriction. Industry coordination: shared safety thresholds agreed between the leading labs and democratic governments, explicitly so that no lab can win by cutting corners the others will not cut. International norms: pushing those standards outward so that safety practice advances at the same rate as capability.

The responses are the reason this is a news story rather than an essay. Elon Musk endorsed it in four words — “Dario is right.” Sam Altman wrote that he agreed “that we need to pace the frontier,” and committed OpenAI to giving independent evaluators employee-like access, which is Amodei’s first proposal accepted by name. Newsweek asked the White House for comment and received none.

Why it matters to sysadmins and IT decision-makers: Start with what this is not. It is not regulation, it is not a commitment with a date on it, and it changes nothing you can configure on Monday. Three CEOs agreeing in public that the frontier should be paced is an artefact of a competitive moment, and the actual mechanism — shared thresholds enforced across rival labs — has no enforcement body, no auditor, and no penalty for defection. Treat the announcements page accordingly.

What it does change is the procurement conversation, because Altman’s specific commitment is checkable. “Independent evaluators with employee-like access” is a control you can ask about in a vendor security review, and unlike most AI safety language it either exists or it does not. Add two questions to your next renewal with any model vendor: who evaluates your frontier models before release, and what access do they have that your own staff do not control? The answers will be uneven, and the unevenness is the useful signal. A lab that names its external evaluators and describes their access is telling you something structural about how release decisions get made. A lab that answers with a link to its responsible-scaling policy is telling you something too.

The operational reading of the botnet claim is more interesting than the number. Strip out the frontier framing and Amodei is describing a threat model in which the expensive part of running a large-scale intrusion campaign — coordination, target triage, adapting to each environment — stops being expensive. You do not need to believe the six-to-twelve-month timeline to act on that, because your defences against it are the same ones that have been accumulating in this newsletter for a month: egress control on workloads that run agents, credentials scoped so that a compromised agent session cannot reach production, logging written where the agent cannot edit it, and an answer to the question of which internal services your automation is allowed to write to. None of that is speculative and all of it is behind by default.

The one genuinely new item for your risk register is recursive self-improvement being named by a CEO as a live driver rather than a thought experiment. If model capability improves on a compounding curve rather than a shipping schedule, the assumption underneath most enterprise AI planning — that you can evaluate a model class once and re-evaluate at the next major version — gets shorter-lived. Organisations that approved a model for a workload in March and have not looked since are governing a system that is no longer the system they approved. Put a review interval on model approvals, and make it shorter than your usual vendor cycle.

2. A CVSS 10.0 in Cisco’s Firewall Manager, Exploited Since July by Sandworm and Qilin

What happened: On September 9, Cisco Talos published an advisory confirming ongoing exploitation of CVE-2026-20079, an authentication bypass in Cisco Secure Firewall Management Center with a CVSS score of 10.0. CISA added it to the Known Exploited Vulnerabilities catalogue the same day, with a federal remediation deadline of September 12 — three days.

The bug is a boot-time accident with maximal consequences. A startup process on the FMC system creates a partial csm_processes session in the sfsnort.sessions database. If nobody authenticates to the appliance after it boots, that partial session persists — and an unauthenticated attacker who sends crafted HTTP requests to the web interface can upgrade it into usable permissions, ending in script and command execution as root. No credentials, no user interaction. It was found internally by Cisco’s Brandon Sakai and disclosed in early March 2026.

It travels with CVE-2026-20316, a static-credentials flaw in the same web interface rated CVSS 5.3, reported by Jimi Sebree of Horizon3.ai and disclosed on July 29, 2026, which lets an unauthenticated remote attacker log in to a low-privileged account.

Talos attributes the activity to three distinct intrusion clusters. UAT-12197 deployed web shells and credential-stealing JAR files. UAT-11823 is an advanced persistent threat with overlap with Sandworm, deploying Cyclops Blink malware, establishing reverse shells and harvesting credentials. UAT-11988 is a ransomware operator assessed as a Qilin affiliate, working through network reconnaissance and living-off-the-land tooling before deploying ransomware. Cisco PSIRT became aware of active exploitation in August 2026, but indicators shared with the CVE-2026-20316 activity include a log entry dated July 23, which pushes the real start of the campaign earlier than the disclosure that triggered it.

Published indicators include C2 addresses 208.123.119.215, 89.34.96.56 and 91.214.78.118, a web shell with SHA-256 b037f45e02a289325a1a5eb0d4db6a9fce9954fd0fdfd07162cb4eb2acbef77d, a malicious JAR at db491181ece3f319de6567ab6f6daa90c6879911cd890155e6b7d8cc7a1a8c8e, and a Cyclops Blink sample at 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461. Cisco has released hotfixes for both CVEs, published Snort coverage under SIDs 66075–66080, 66883 and 66960–66961, and scheduled a comprehensive hardening release for the week of September 16. Its interim guidance is to restrict the FMC management interface from internet access.

Why it matters to sysadmins and IT decision-makers: Understand what this box is before you decide where it sits in your queue. Firewall Management Center is not a firewall. It is the console that manages your firewalls — it holds the policy, it pushes configuration to the estate, and it typically has credentialed reach into every FTD appliance you own. Root on FMC is not a foothold on one device; it is administrative control of your network segmentation, with a legitimate mechanism for changing rules on every enforcement point downstream. That is why a Sandworm-linked actor and a ransomware affiliate independently found it worth the effort. For the ransomware crew in particular, the ability to alter firewall policy sits directly upstream of both lateral movement and exfiltration.

So this is not a patch, it is an investigation. The exploitation window starts no later than July 23 and the disclosure that made it public is from March, which means the honest assumption for any internet-reachable FMC is that it was reachable to attackers for months before Cisco’s advisory landed. Apply the hotfixes today, then treat the appliance as suspect: hunt the published hashes and C2 addresses, deploy the Snort SIDs, and review FMC for unexplained sessions, added accounts, and — most importantly — policy changes you cannot tie to a change ticket. That last one is the check most teams will skip and the one that matters, because the attacker’s goal on this device is a rule, not a shell.

There is also a process finding worth extracting, because it repeats the pattern from three weeks ago with different branding. A CVSS 10.0 disclosed in March was, for a meaningful number of organisations, still unpatched and still internet-reachable in September. Nobody decided that; it happened because security appliances live in a change-control regime built for stability, managed by network teams whose uptime obligations conflict with their patch obligations, and because the management plane of a security product is quietly exempted from the internet-exposure rules that everybody applies to the data plane. Go and enumerate every management interface you own that answers from the internet — FMC, vCenter, your hypervisor consoles, your backup servers, your RMM. Cisco’s own interim mitigation is to take FMC off the internet, which should tell you where that interface belonged in the first place.

3. The Largest Patch Tuesday Ever Shipped, and the Scariest Bug in It Is Not One of the Zero-Days

What happened: Microsoft’s September 8 release is the biggest in the company’s history by a wide margin. The exact figure depends on who is counting and whether third-party CVEs are folded in: Tenable counts 964 CVEs in Microsoft’s own products, BleepingComputer 966, and SecurityWeek and Dark Reading 974. Against 570 in July and 400 in August, any of those numbers is a step change.

Tenable’s severity split is 104 Critical and 860 Important, with nothing rated moderate or low. By type, BleepingComputer counts 438 elevation of privilege, 258 remote code execution, 173 information disclosure, 56 denial of service, 19 security feature bypass and 16 spoofing — and the shape of that distribution is the story, because it is what you get when a discovery pipeline is turned up rather than when an attack surface changes. Microsoft has been deploying an AI-powered vulnerability discovery system across its products, and the most quoted line from the coverage is the sceptical one: AI-assisted vulnerability discovery in 2026 “is creating larger haystacks, but isn’t finding more needles.”

Two zero-days were already being exploited, and both are local privilege escalation rated CVSS 7.8:

CVE-2026-81963, Windows Update Stack. Improper link resolution before file access — link following — lets an authenticated low-privileged attacker elevate to SYSTEM on Windows 11 and Server 2025. Credited to Romain Deperne and the Microsoft Threat Intelligence Centre.
CVE-2026-85880, Windows Advanced Local Procedure Call. A heap-based buffer overflow that escalates to SYSTEM on Windows 10 and Server 2012, 2016, 2019 and 2022, reachable from a low-privilege AppContainer with no user interaction. Credited to Volexity and to Mark Kelly, David Galazin and Jeremy Hedges of Proofpoint.

Neither is an entry point on its own. The one that is an entry point has not been exploited yet. CVE-2026-69730 is a use-after-free in Windows DNS Server rated CVSS 9.8 and Critical, where an unauthenticated remote attacker sends a crafted packet to the service and executes code — no credentials, no user interaction. Microsoft has flagged it “Exploitation More Likely” and, as of release day, had not seen it exploited but expects to. ZDI’s Dustin Childs called it the spiritual successor to SigRed, the 2020 wormable Windows DNS flaw, and researchers counted 20 potentially wormable bugs in this release overall. Three more DNS Server RCEs — CVE-2026-69813, CVE-2026-69827 and CVE-2026-77505 — are Critical at CVSS 8.1. Also worth pulling out of the pile: CVE-2026-69676, a Kerberos RCE at CVSS 8.8 rated Exploitation More Likely, CVE-2026-69414 in Microsoft Defender, CVE-2026-80093 in Windows Cloud Files, and CVE-2026-55007, an Exchange Server RCE reachable through a malicious Visio attachment.

Why it matters to sysadmins and IT decision-makers: A thousand CVEs is not a thousand emergencies, and the first job this month is refusing to treat it as one. Your patch process almost certainly contains a step that does not survive this volume — a spreadsheet, a per-CVE risk write-up, a CAB that reviews individual advisories. That step is going to fail quietly, and the failure mode is not that you miss a patch, it is that the triage produces noise and somebody stops reading it. Decide now, in writing, that your monthly process reviews exceptions and exploited or wormable CVEs, and that everything else rides the normal ring-based rollout. The volume is a discovery artefact; the deployment cadence should not move with it.

Then patch DNS first, and patch it out of cycle if your domain controllers run it, which for most Windows estates means all of them. CVE-2026-69730 is the only bug in this release that an unauthenticated attacker on the network can turn into code execution with a packet, it runs in a service that is definitionally reachable by every client you have, and it lives on the machine you least want executing attacker code. SigRed is the right comparison and the right memory: it was patched in July 2020, weaponised research followed within weeks, and the organisations that got hurt were the ones that treated a DNS patch as a routine server update because nothing was exploited on release day. “Exploitation More Likely” plus wormable plus unauthenticated is the combination that earns an emergency window. Do the three companion DNS RCEs in the same change.

The two exploited zero-days are second, not first, and they should change your ordering rather than your urgency. Both are local privilege escalation, which means an attacker needs to already be executing code as somebody before either is useful — they are the second half of an intrusion, not the start of one. Prioritise them by where that first half is most likely: multi-user systems, jump hosts, terminal servers, developer workstations, anything where a low-privileged account and an internet-facing application share a machine. Note the version split, because it determines which half of your estate is affected by which: CVE-2026-81963 hits Windows 11 and Server 2025, and CVE-2026-85880 hits Windows 10 and the older server builds — between them, everything.

The larger point is one to raise with whoever owns your security budget. If vendors are now finding vulnerabilities with automated systems faster than customers can deploy fixes, then the binding constraint on your security posture has moved from knowing to deploying, and every hour spent improving detection of things you already know about is an hour not spent on the actual bottleneck. Measure your time-to-deploy for a critical patch across your real estate — including the machines that are off, the ones that fail, and the ones nobody owns. That number, not your CVE count, is what this month is testing.

4. Google Gave Workspace Admins Real Gemini Controls, and Put Gemini on the Windows Desktop the Same Week

What happened: Four Gemini changes landed on Workspace administrators between September 8 and September 11, and they pull in opposite directions.

September 8 — context-aware access for Gemini Enterprise. Admins can now apply context-aware access (CAA) policies to Gemini Enterprise from the Admin console, gating access on device security posture and location across both personal and managed devices. Policies apply at the organisational unit or group level, and existing CAA policies already written for Workspace apps can be reused and extended to Gemini Enterprise rather than rebuilt. It covers Enterprise Standard and Plus, Education Standard and Plus, Frontline Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium, with Gemini Enterprise purchased separately as a prerequisite. Gradual rollout to Rapid and Scheduled Release domains, up to 15 days, from September 8.

September 10 — external sharing controls for Gemini Notebook. The single organisation-wide on/off toggle is replaced by four options: Off (the default — no external sharing), Trusted Domains (external sharing restricted to an allowlist), On (any external address), and On with public notebook sharing. Configurable at domain, OU or group level, rolling out over up to 15 days from September 10.

Early September — Gemini Notebook audit logs. Comprehensive audit logs for Gemini Notebook arrived in the Admin console from September 3, surfacing notebook actions in the security investigation and audit tools, with fields including notebook visibility, user identity, IP address and resource context. Logs are available by default; export to BigQuery is off until an admin turns it on. Available to customers with access to the security investigation and audit and investigation tools.

September 11 — the Gemini desktop app for Windows. Google shipped a native Gemini app for Windows 10 and 11 on both x86 and Arm. Alt + Space summons it over whatever the user is working in; it connects to Gmail, Docs, Drive and Calendar; and chat history and memory sync across devices on the same Google account. The same day, Google described Workspace Intelligence positioning Gemini as an orchestrator working across apps rather than inside one.

Why it matters to sysadmins and IT decision-makers: Take the controls first, because they close two gaps that have been genuinely awkward to explain to a risk committee. CAA for Gemini Enterprise means the access rules you already defend — managed device, corporate posture, permitted geography — finally apply to the AI surface as well, and the reuse of existing policies means this is an afternoon of work rather than a project. Do it as a migration, not an invention: list the CAA policies protecting Drive and Gmail today, and extend the same ones. If Gemini Enterprise has looser access requirements than Drive, you have an exfiltration path that bypasses the control you built for exactly that purpose, because a model that can read Drive is a way to read Drive.

The Notebook sharing change is the one to action fastest, and the detail that matters is that the new default is Off. If your organisation previously had Gemini Notebook enabled and was relying on the old all-or-nothing toggle, sharing behaviour is changing underneath your users during a rollout window that lasts up to fifteen days — which will generate tickets from people whose external collaboration stopped working. Decide the policy before the rollout reaches you: Trusted Domains with a real allowlist is the correct setting for almost everyone, and “On with public notebook sharing” is a setting that should require a named owner and a reason, because a public notebook is a public document assembled from whatever the notebook was pointed at. Turn on the BigQuery export for the new audit logs at the same time. Logs that exist but are not exported are logs you will not have when you need to answer a question about a date three months ago.

Then read the desktop app as what it is: a material expansion of endpoint surface, shipped in the same week as the controls, and governed by a different set of switches. Alt + Space puts an assistant over every application on a managed laptop, including the ones that were never in scope for your AI policy — the finance system, the ticketing tool, the clinical or legal application that nobody ever proposed connecting to a model. Memory syncing across devices is the part to think hardest about, because it means content from a corporate desktop session can surface in a session on another device signed in to the same account, and the boundary being enforced there is account identity, not device management. Work out now how the app is distributed and updated in your environment, whether it is in your allowed-software baseline or arriving unmanaged, and which account the user signs in with — then check that your DLP and endpoint monitoring actually see it, because a local application that reads the screen is not a browser tab and your web-layer controls will not be watching.

The pattern across all four changes is worth naming, because it is the shape of every AI rollout you are going to manage for the next year. Capability arrives on the endpoint on the vendor’s schedule and is on by default for the user; the controls arrive in the Admin console on a different schedule and are off by default for you. The gap between those two dates is your exposure, and the only way to shorten it is to read the release notes before your users do.

The Week in Summary

The two halves of this week do not obviously belong in the same newsletter, and that is the point. On Saturday three of the most powerful people in AI agreed in public that capability is outrunning control and that the industry should deliberately slow down. On Tuesday and Wednesday, the actual failures in front of actual administrators were a boot-time session bug in a firewall manager disclosed in March and exploited since July, and a thousand patches from a company whose own vulnerability discovery has been automated faster than its customers can deploy the fixes. Nothing in the Amodei essay would have prevented either. The gap between the frontier conversation and the operational one is not a communication failure; it is a genuine difference in where the risk currently lives, and both are real.

There is still one thread running through all of it. Every story this week is about the distance between when something becomes known and when anyone acts on it. Cisco knew about a CVSS 10.0 in March; attackers were using it by July; most defenders learned about it on Wednesday. Microsoft’s DNS use-after-free is known, unexploited and wormable right now, which is the most favourable position a defender will ever be in and the one that historically gets squandered. Google published the Gemini admin controls in the same week it shipped the client that makes them necessary, with a fifteen-day rollout in between. And Amodei’s entire argument is that the industry is about to have less of exactly this — less distance between a capability existing and it mattering. The practical form of that argument on your side of the fence is unglamorous: shorten the time between “we know” and “it is deployed,” because every trend in this week’s news is compressing the other side of that equation.

Three smaller items worth logging. CVE-2026-19490 is a second Citrix NetScaler authentication bypass, distinct from the June bug we covered three weeks ago — CVSS 9.3, affecting appliances configured as an AAA virtual server or Gateway service including SSL VPN, ICA Proxy, CVPN and RDP Proxy. Citrix patched it on August 19–20; a proof of concept appeared on GitHub on September 2; exploitation in the wild was confirmed on September 3; CISA added it on September 9 with a September 12 deadline. If that sequence feels familiar, it is the same PoC-to-exploitation pattern as last month, run three weeks faster. Alongside it in the same KEV batch: a Fortinet heap overflow (CVE-2025-25249) and a Chromium V8 out-of-bounds write (CVE-2026-87491). And on September 10, CISA added two exploited MikroTik RouterOS flaws — CVE-2026-67277, missing authentication for a critical function, and CVE-2026-86060, improper neutralisation of argument delimiters in a command — which matter mainly if you have branch or lab routers nobody has logged into since installation.

Three things worth doing before next week: patch Windows DNS Server for CVE-2026-69730 out of cycle on every domain controller, and take the three companion DNS RCEs in the same change, on the basis that an unauthenticated wormable RCE that is not yet exploited is a deadline rather than a reprieve. Hotfix every Cisco Secure FMC you own for CVE-2026-20079 and CVE-2026-20316, then treat it as an investigation rather than a patch — hunt the published hashes and C2 addresses, and reconcile the appliance’s policy history against your change tickets, because the prize on that box is a firewall rule, not a shell. And before the Gemini rollouts reach your domain, set Gemini Notebook external sharing to Trusted Domains with a real allowlist, extend your existing Drive and Gmail context-aware access policies to Gemini Enterprise, and turn on the BigQuery export for the new Notebook audit logs while the decision is cheap.

Next edition publishes September 19.

More Enterprise AI Weekly coverage:

Enterprise AI Weekly: August 24–29, 2026 — Week 35
Enterprise AI Weekly: August 31 – September 5, 2026 — Week 36
Enterprise AI Weekly: September 14–19, 2026 — Week 38
Enterprise AI Weekly: September 21–26, 2026 — Week 39