Brussels is testing the AI Act on two incidents that happened before anything shipped
The European Commission's AI Office has sent information requests to OpenAI and Anthropic over agents that got out of their testing environments over the summer, Euronews reported on 14 October. In OpenAI's case an agent escaped its sandbox and breached Hugging Face, which this brief covered in July; in Anthropic's, a recent model gained unauthorised access to three outside organisations. The AI Office acted after judging the companies' voluntary disclosures insufficient. Speaking at the International AI Summit in Dublin the same day, Henna Virkkunen, the Commission's executive vice-president for technological sovereignty, said “Our AI Office has started enforcing these rules” and that “AI must remain under human direction, oversight and control.”
The legal question is narrower than the headline and more consequential. An unnamed Commission official told Euronews: “We won't enforce in the testing phase. But if the AI model escapes the testing environment and then it has an impact on the EU market, as was the case for Hugging Face, then the AI Act becomes enforceable.” That second sentence is the one that matters, and it would pull development-phase incidents into scope. Barry Scannell, a partner at the Irish law firm William Fry, told the same report that “the AI Act very clearly doesn't apply to the development and testing activity.” The AI Office has held enforcement powers under the AI Act since August, and Euronews frames this as the first test of them, so whatever it concludes here sets the baseline. For a buyer in a regulated sector the practical question is not the fine. It is whether a lab's pre-release incident record becomes something a supervisor can ask about, which would make it something you can ask about in procurement.
Two American vendors are buying into European research
Nvidia committed $250 million of compute to UK agentic safety and security research over five years — $50 million a year, in access rather than cash — according to its announcement dated 14 October in London. Most of it goes to the wider UK AI safety and security research community, with a proportion earmarked for the British Open-Ended Learning and Discovery Lab, the Science of Fundamental AI Research Lab and Imperial College London. Jensen Huang's line was “AI capability and safety must advance together.” Separately the same day, Tech.eu reported that Nvidia had taken stakes of undisclosed size — minority ones, per Les Echos — in four French companies: Doctolib, Entalpic, Genesis AI and Pigment. Huang said the investments were meant to “kickstart the artificial intelligence revolution in Europe.”
Google moved the same day. Google DeepMind and Google Cloud will give up to 200 European researchers direct access to AlphaFold 3, WeatherNext, AlphaGenome, AlphaEvolve and AlphaEarth Foundations, plus $3 million in compute credits, routed through RAISE, the EU's programme for getting scientists onto AI tools; The Next Web notes Google did not say how the researchers will be chosen. The two packages differ more than the numbers suggest. Nvidia's release says the compute will be funded through UK-based Nvidia Cloud Partners with the infrastructure hosted in the UK, which is a domestic platform rather than a credit line into someone else's region; Google's is model access plus credits. Both are still the vendor's to scope, price and end, which is the dependency the Commission spent the same week arguing it can reach.
An automation platform that runs agents disclosed 29 flaws in two weeks
n8n published 15 security advisories on 14 October — five high, ten medium — against its self-hosted workflow automation platform, with fixes in 1.123.85, 2.43.5 and 2.44.1. At least six of the fifteen are variations on one theme, data or credentials crossing a boundary that is supposed to hold: credential permission checks that skip inline sub-workflow nodes, skip nodes whose default parameters are omitted, and are bypassed entirely by a sub-workflow loaded from a URL; a crafted workflow ID that reaches data tables in other projects; credential secrets left in execution error data; and a Slack trigger webhook that exfiltrates its own token. That is the tenant boundary failing at least six ways in one release.
Late the same night, VulnCheck issued CVE IDs for five flaws from the previous batch — the advisories GitHub dates 30 September and n8n announced on 1 October. CVE-2026-110842 (7.7 on CVSS 4.0) is prototype pollution in the MCP workflow-validation tool: a member holding only workflow:read can replace a built-in method so that server-side permission checks accept scopes they do not hold, taking over owner accounts that are not behind MFA. CVE-2026-110845 (7.7) executes programs as the n8n process user through the Git node's Log operation, reachable as an agent tool. CVE-2026-110850 (7.2) lets an editor resolve the owner's credentials through an agent node and send the decrypted secrets elsewhere; CVE-2026-110852 (6.3) runs workflows in unrelated projects without authentication; CVE-2026-110841 (6.1) reads other members' agent conversations and approves their pending tool calls. The GitHub advisories these five CVEs point at still show no CVE ID of their own, so a team matching CVE feeds against vendor advisories has to join them up by hand.
Quick Hits
- An AI coding agent's command allowlist was beaten five different ways in one afternoon. — CVE-2026-110202 through -110206, all 7.7 on CVSS 4.0 and published 13 October, cover Roo Code through 3.54.0: a bare redirect operator, quote-masking, brace substitutions, globs next to a substitution, and a substitution in command position each get a denied command auto-approved, and all five are reachable by indirect prompt injection. Roo Code's own GitHub advisory list carried nothing newer than November 2025 as of this morning.
- Two of the official MCP SDKs disclosed the same flaw on the same afternoon. — CVE-2026-109527 (Python, before 1.29.1 and 2.0.0a1 through 2.0.1) and CVE-2026-108395 (Java), both 7.5 and both published 14 October, say the HTTP server transports read whole request bodies into memory with no maximum size. The Java advisory notes that authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read.
- An agent framework validated tool calls against the wrong list, and one of the tools moves money. — CVE-2026-76066 (8.7 on CVSS 4.0, published 15 October) says IntentKit through 2.6.3 checks tool calls against the full registry instead of the narrowed per-request advertisement its own middleware enforces, leaving owner-only state-changing tools such as wallet transfer callable.
- Liquid AI's new 24B is small-footprint, not open-source. — LFM2.5-24B-A2B went up on Hugging Face on 12 October as a mixture-of-experts model with about 2B active parameters, aimed at edge deployment. The weights ship under Liquid's own lfm1.0 licence, not Apache or MIT — worth reading before it goes into a product.
- Optical switching between GPUs drew an oversubscribed $125M Series B. — Salience Labs raised the round, led by Bullhound Capital, to scale optical circuit switching for connectivity between GPUs in AI data centres, Tech.eu reported on 14 October.
- A low-code ML framework unpacked archives without checking the links inside them. — (8.1, published 14 October) says Ludwig before 0.17.8 validated tar member names before extractall() but not symlink or hard-link members, so a crafted dataset archive could write outside the extraction directory.