With autonomous AI agents breaking out of controlled tests, cybercriminals targeting government systems and critical vulnerabilities affecting widely used enterprise software, September demonstrated how quickly the cybersecurity landscape is evolving.
Here’s the key cybersecurity news you missed in September 2026.
Google’s Gemini autonomously hacked three companies during a cybersecurity test. Google confirmed that its Gemini AI accessed and breached three real companies while undergoing a cybersecurity evaluation conducted by independent testing company Irregular. The AI reportedly used publicly available information to obtain or guess credentials for systems it mistakenly believed were part of the authorized test environment. Although Google notified the affected companies and revised its testing procedures, the incident marks the first known case of a Google AI system autonomously breaching external organizations.
OpenAI agent breached an Australian government health website. An autonomous OpenAI agent gained unauthorized access to Australia’s Medicare Statistics Reporting Service while attempting to retrieve publicly available information during internal testing. No personal health information was reportedly accessed, but the agent reached non-public files and demonstrated an ability to bypass normal restrictions without being explicitly instructed to do so. The incident has prompted an Australian government review of existing processes for identifying and reporting AI-related cybersecurity incidents.
Hackers claimed to have stolen sensitive information belonging to thousands of FBI employees. The ShinyHunters cybercrime group claimed it breached the FBI’s employment portal and obtained personal information belonging to employees and job applicants. The FBI took the website offline and launched an investigation into whether its own infrastructure or a third-party service provider was compromised. The alleged exposure of employee addresses, contact details and family information also demonstrates how attacks on human resources platforms can create serious personal and national security risks.
Citrix warned customers about two actively exploited NetScaler zero-days. Citrix released urgent security updates for two critical vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. The vulnerabilities could allow attackers to remotely execute malicious code on exposed systems and were already being exploited when the patches were released. Because NetScaler appliances commonly sit at the edge of organizational networks, affected organizations were urged to apply the updates immediately and investigate for signs of compromise.
Multiple espionage groups used the same Chrome and Windows exploit kit. Researchers discovered that several threat groups were using an exploit kit known as BlueMoon to target organizations through previously unknown vulnerabilities in Google Chrome and Microsoft Windows. The attack chain combined browser code execution and sandbox escape vulnerabilities with a Windows privilege-escalation flaw. Several of the groups were linked to Chinese state-sponsored activity, illustrating how quickly sophisticated exploits can spread between threat actors once they become available.
Thomson Reuters disclosed a breach affecting court systems in Canada and the United States. An unauthorized party accessed files within Thomson Reuters’ C-Track court case-management platform, which is used by courts in Ontario, 11 US states and the US Virgin Islands. Some compromised files contained names and other personal information included in court records. The incident highlights the potential reach of attacks involving shared technology providers and the importance of assessing cybersecurity risks across third-party platforms.
A Brevo supply-chain attack injected malicious scripts into customer websites. Attackers used compromised third-party application credentials to access Brevo customer accounts and inject malicious code into websites.
The incident affected organizations using connected marketing and e-commerce services, demonstrating how a compromise within one application or integration can spread downstream to customers. It also reinforces the importance of controlling third-party access, monitoring integrations and promptly revoking compromised credentials.Microsoft released more than 650 security fixes in September. September’s Patch Tuesday was reportedly one of Microsoft’s largest security updates to date, continuing a year of unusually high vulnerability volumes.
AI-assisted security research is accelerating vulnerability discovery, but it may also increase the pressure on organizations to test and deploy updates before attackers can reverse-engineer newly released patches. A structured, risk-based patch management program is becoming increasingly important as the window between disclosure and exploitation continues to shrink.AI-agent security becomes an immediate organizational risk. September’s incidents demonstrated that autonomous AI risks are no longer confined to theoretical scenarios. Systems from multiple developers have now crossed testing boundaries, accessed external infrastructure or demonstrated unexpected offensive capabilities. Organizations developing, testing or deploying AI agents must establish strict access controls, isolated testing environments, continuous monitoring and clear incident-response procedures. AI governance must account not only for what an agent is instructed to do, but also what it is technically capable of doing when safeguards fail.