The Most Valuable Piece of Cybersecurity Right Now Is Not What Vendors Are Selling
If you thought the other stuff was wild... here we go.
Forget the product sheet. Forget the webinar titled "Zero Trust in the Age of AI." Forget another password-manager sermon aimed at people who already moved 2FA off Google Authenticator six months ago.
If you are still being sold "turn on MFA" as the headline control in September 2026, someone is recycling a 2019 slide and hoping you do not notice.
The most valuable piece of cybersecurity this week is control of agency.
Not identity as a login screen. Not "who are you." Who, or what, is allowed to act on your systems, with which tools, against which data, without a human in the loop.
That is the actual problem. Everything else is wrapping paper.
I am writing this from a hardened Galaxy A56, mail on Proton, TOTP on Ente Auth, backup codes in a diary, and a Hisense that stays offline on purpose. I already did the hygiene lecture. I also documented a VPN that dropped its shield during a server handshake and leaked a South African IP with Scramble enabled. Bitdefender ticket #1011154500, video proof, engineering acknowledgement. So when I say "watch what the tool does, not what the brochure promised," that is not a metaphor. That is how you catch a vendor mid-failure.
What just happened, without the press-release varnish
Two stories dropped in the last 48 hours. They look different. They are the same problem.
1. SalesBleed: Salesforce Agentforce
Zenity Labs disclosed three flaws in Salesforce's Agentforce, collectively called SalesBleed. Salesforce has patched the specific chains. That does not make the pattern go away.
The attack did not start with a stolen password.
It started with a public Web-to-Lead form, the same form every sales team leaves open so strangers can submit contact details. An attacker hid instructions inside a normal-looking lead. Those instructions sat in the CRM until an employee did something ordinary: asked the Agentforce agent to look at recent leads.
The agent obeyed the poisoned record.
Default permissions on the General CRM subagent already covered both Leads and Accounts. No privilege escalation required. The agent queried account data (company names, deal values, the stuff you would never put on a public form) then stuffed selected fields into an attacker-controlled hostname inside an HTML image tag.
The employee did not click anything.
The client resolved the hostname. DNS carried the data out. Salesforce's Trusted URLs layer, built specifically to stop untrusted outbound links, was bypassed because URL filtering and browser/DNS behaviour are not the same thing.
A third chain used the Agentforce-Slack integration. Slack's link-preview (unfurling) fetched the attacker URL on its own. Trusted internal identity. Phishing sent from inside the tenant.
Zero login. Zero click. One public form.
That is not a "Salesforce problem." That is what happens when you give a language model tools, default-broad data access, and an untrusted input channel, then pretend the system prompt is a security boundary.
It is not.
A system prompt is a suggestion with good lighting. The tool list is the permission set. If you do not understand that distinction, you will keep buying "AI firewalls" that read the prompt and miss the DNS query.
2. An OpenAI research agent walked into Australia's Medicare statistics portal
On 18 June 2026, an OpenAI research agent tasked with looking up public medicine-spending figures hit access controls on Services Australia's Medicare Statistics Reporting Service. The site said no. The agent did not accept no.
It found another path. It reached public and non-public files.
OpenAI says it found the activity in August during a review of "misaligned model behaviour." It notified Australia on 10 September, 84 days later, by emailing a public mailbox. Prime Minister Albanese called Sam Altman this week, used the words "extreme concern," and stood up a taskforce. OpenAI says it has no evidence patient records were touched. Forensic work is still running.
Read that sequence again.
A model with a research goal treated access control as an obstacle in a task, not a legal boundary. The lab that built it took nearly three months to tell the government whose systems were touched, and the first contact was a generic inbox.
If your incident-response plan assumes the other party will pick up a phone, update the plan.
This is the same class of failure as a VPN that reports "connected" while the handshake is naked. The dashboard lied. The packet did not. I already lived that version. Ticket #1011154500. Different vendor. Same lesson: instrument the behaviour, not the status light.
The rest of the same week, compressed
This is not two isolated circus acts.
- Anthropic's September threat-intel report documented a ShinyHunters affiliate using Claude to rip secrets out of 1.8 million Android APKs and pull more than 2,100 corporate cloud tokens across 40+ companies. Same report: a Midnight Blizzard-aligned cluster used Claude to rebuild malware after detection.
- Researchers described CLOSEDQUORUM, an autonomous C2 implant that asks a panel of models (DeepSeek, Qwen, Mistral, Gemini) to vote on the next post-exploitation task.
- Carbonato is hitting exposed Docker daemons and installing an AI agent framework as the operator.
- Separate reporting this week: agent swarms used against online stores, with hundreds of thousands of card records stolen.
- WordPress core CVE-2026-87902 (unauthenticated file inclusion to RCE) went from patch to active exploitation inside days and landed on CISA's KEV list. Kiteworks told customers to shut servers off on the back of threat intel about an imminent hit. Bitget is staring at a $352 million theft with North Korea in the frame.
Patching still matters. Ransomware still matters. Supply chain still matters.
None of that is the most valuable control this month.
The new variable is actors that do not wait for you to click.
If your entire mental model of "cybersecurity" is still "stop the human from doing something stupid," you are one product generation behind the people writing the payloads. The payload is now a sentence. The operator is now a loop. The exit is now a DNS lookup that never rendered a page you would recognise as "the attack."
Why "MFA harder" is the wrong sermon
MFA, hardware keys, Ente Auth, Proton, a hardened phone, a cold-storage device in a safe. Those are correct moves. They answer a 2018-2024 problem: stolen human credentials and sloppy session handling.
Do them. I did them. I will keep telling people to do them. That is not the argument.
They do almost nothing when:
- the attacker never logs in as you
- the payload is a sentence inside a lead, a ticket, an email, a PDF, a code comment, or a web form
- the thing that executes is an agent you deployed, with tools you granted, running under an identity you trust
- the exfil channel is DNS, Slack unfurl, or an image tag the UI renders because "that's how previews work"
Prompt injection is phishing for software that can use tools.
Indirect prompt injection is a watering-hole plus an insider, except the insider is your own agent and it does not know it switched sides.
If you are still measuring security by "did the human click the bad link," you are scoring the wrong sport.
And if your only response to that sentence is "we have a security-awareness module," sit down. Awareness training does not constrain a subagent with Query Records on Accounts. A permission boundary does.
The valuable piece, stated without poetry
Every agent is a privileged user with amnesia and a tendency to finish the job.
Treat it that way.
The control stack that actually pays off right now:
1. Untrusted input is hostile. Always.
Web-to-Lead, support tickets, inbound email, uploaded PDFs, scraped pages, "summarise this repo," customer chat. These are attacker-controlled. If an agent can read them and query sensitive stores and make outbound requests, you have built SalesBleed on purpose.
Separate the pipes. An agent that reads public forms should not have Query Records on Accounts. An agent that drafts Slack messages should not be able to invent outbound URLs that Slack will preview.
If you cannot draw the trust boundary on a whiteboard in one pass, you do not have a design. You have hope.
2. Tools are the real privilege.
The system prompt is a suggestion. The tool list is the permission set.
If the agent can query CRM, send mail, open a browser, run a shell, call an MCP server, or hit an internal API, that is your blast radius. Shrink it per task. Not per product SKU. Per task.
Default-allow "General CRM subagent" is how you get zero-click theft without a stolen password.
Same rule on a phone. Accessibility services that can tap for you, "research" modes that can fetch URLs, MCP servers with tokens in a config file. Those are tools. Treat them like production keys, because that is what they are.
3. Actions need a second check that is not the same model.
"The model said it was fine" is not authorization.
High-impact actions (query production data, send external messages, change records, touch identity systems, reach the network) need a policy engine or a human gate that does not share the agent's context window. If the only thing standing between a poisoned lead and DNS exfil is the same model that just read the poisoned lead, you do not have a control. You have a vibe.
Vibes do not survive contact with a public form.
4. Watch what it does, not what it promised.
Logs of prompts are theatre if you cannot see tool calls, destinations, DNS, and data touched.
SalesBleed's punchline: the UI told the user the content was blocked by policy after the DNS lookup had already fired. The redaction layer sat in the wrong place in the pipeline.
If your "AI security" product only scans prompts, it is selling you a smoke alarm installed in the neighbour's kitchen.
This is the Bitdefender lesson with a different coat of paint. The app said the tunnel was up. The handshake leaked the real IP anyway. Status text is not telemetry. Packets are telemetry. Tool calls are telemetry. DNS is telemetry. If you cannot see those, you are guessing.
5. Notification and containment are part of the control, not a courtesy.
84 days and a public mailbox is not an incident-response partnership. If you use a frontier lab's agents against anything that matters, write into the contract: who gets phoned, in how many hours, with what telemetry. Then assume they will miss it anyway and instrument your own side.
Same rule for vendors. Kiteworks telling customers to power off is ugly and honest. Most vendors would have issued a blog titled "We Take Security Seriously" and hoped you did not notice the zero-day.
If a vendor's first move after a failure is a tone-poem about trust, that vendor is managing you. Not the incident.
What this means if you actually live on a phone and refuse the Google stack
You are not running Agentforce. That does not make you safe. It makes your attack surface different.
The same pattern shows up as:
- Android Accessibility-abusing banking trojans (RemControl is in this week's pile). An "assistant" that can tap for you.
- MCP servers and local agent runtimes with tokens sitting in config files
- browser-based agents and "research" modes that treat robots.txt and auth walls as suggestions
- any app that summarises your inbox, notes, or photos and is allowed to fetch URLs
- VPN and Play Services attestation problems you already documented. The platform deciding your hardened environment is "fraud" while it happily runs other people's agents with default-broad scopes.
Google's Cloud Fraud Defense / Play Services hardware attestation already showed the other side of this coin: a hardened, VPN-backed environment gets treated as the suspicious object, while a default-broad agent with tool access gets waved through because it is "the product." That is not security. That is a loyalty programme with a kernel module.
Practical moves that are not a vendor webinar:
- Do not give a consumer chatbot or on-device agent access to mail, files, or password stores. Summarise on a copy. Not on the live account.
- Treat every "Connect to Slack / Drive / CRM / GitHub" toggle as a standing privileged session. Revoke what you are not using this week.
- If you run anything that speaks MCP or has a local tool loop, put it on a separate profile or device. Same logic as the Hisense in the safe: blast radius, not vibes.
- DNS logging is no longer optional curiosity. SalesBleed left through name resolution. So do a lot of "the page never loaded so it must be safe" failures.
- Backup codes stay in the diary. Agents cannot steal a page you did not digitise. They can steal the vault they were allowed to read.
- 2FA lives in Ente Auth, not in the same browser the agent can drive. If the agent can open the authenticator tab, you did not isolate anything. You rearranged furniture.
And if an AI product's threat model is "our safety team trained it not to," that is not a threat model. That is a press line. SalesBleed and the Medicare portal both happened inside products that already had safety teams.
Safety teams do not replace least privilege. They write blog posts after least privilege was skipped.
The industry will try to sell you the wrong object
Watch the next 30 days. You will see:
- "AI firewalls" that filter prompts and miss tool-shaped side channels
- Governance decks about Microsoft 365 while the actual hole is an agent with Query Records and a public form
- Calls for global AI treaties announced from a stage, while the notification path is still a public mailbox
- More CVE volume than any human team can triage, because models are now finding and writing exploits faster than patch cycles
CVE quality programmes (CISA is talking about a "Quality Era" for the global CVE programme this week) are necessary. They are not sufficient. A perfect advisory published on day zero does not stop an agent that already has the tool and the poisoned input.
South Africa is not a spectator here. The same default-broad agents, the same public forms, the same "research mode," the same Play Services attitude toward a hardened phone. They land here with worse local support and the same vendor silence. Digital sovereignty is not a slogan for a keynote. It is whether your tools work for you when the vendor's incentive is to keep the agent useful, not constrained.
The valuable work is boring:
Map every agent.
List every tool.
Name every data store it can touch.
Name every egress path.
Assume the next input is hostile.
Put authorization outside the model.
If you cannot draw that on one page, you do not have an AI deployment. You have an unauthenticated intern with production keys and no memory of yesterday's briefing.
Direct answers to the question in the title
Most valuable piece of cybersecurity, this week:
Control of agency. Least privilege for tools, isolation of untrusted input, authorization that does not live inside the same model, and telemetry on actions rather than speeches.
Most important AI-in-security news, this week:
SalesBleed and the OpenAI Medicare-portal incident. One is a production CRM agent leaking data through DNS because a public form was in the same trust domain as Accounts. The other is a research agent treating a government access control as a puzzle. Same failure class. Different letterhead.
What is not the most valuable piece:
Another layer of branding on MFA. Another "AI-powered SOC" that still cannot tell you which tool call left the building. Another keynote about trust.
Trust is not a control.
A tool allow-list is a control.
A dead network path is a control.
A human who has to approve "send this to the internet" is a control, use those.
Sources and scope. Zenity Labs, "SalesBleed: 0-Click Data Exfiltration in Agentforce," 24 September 2026. Zenity Labs, "SalesBleed: Hijacking Agentforce in Slack for Anonymous Phishing Attacks," 24 September 2026. SecurityWeek, "'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration," 25 September 2026. Infosecurity Magazine, "Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk," 25 September 2026. Computer Weekly, "Australia sets up taskforce after OpenAI agent breaches statistics portal," 25 September 2026. SBS News, "OpenAI agent hacked Medicare, Albanese reveals," 24 September 2026. iTnews, "Australian Medicare data portal infiltrated by OpenAI agent," 24 September 2026. Transluce, "Early rogue AI agent activity and attempts to hack found on urlquery.net," 23 September 2026.
Zenity's write-up is the primary technical account of SalesBleed. Salesforce's patch status is as reported by Zenity after testing, not an independent audit by Onyx. The Medicare portal sequence (18 June access, 10 September notice, Albanese disclosure) is the public government and press account. OpenAI's statement that patient records were not accessed is the company's account, not a completed forensic finding. Actor attributions in the same-week roundup (North Korea and Bitget, Midnight Blizzard alignment, ShinyHunters affiliate) are as reported by those desks. This piece does not treat unpublished packet captures, unreleased OpenAI evaluation logs, or a confirmed patient-record exposure as fact.
Clayton Bax
Published under ONYX Digital Intelligence Following the #OnyxAudit methodology.
- X: @OnyxAudit
- Email: onyxdigitalintelligence85@protonmail.com
- https://github.com/Baximus85
- @Onyx_Digital@mastodon.social
Adjacent to true is not true.
Truth has no --flag nor favour--, only a standard. And it's heavy
Editors note: I use various AI agents to fetch my research. I check, strip and write the article. Facts are partly theirs. Interpretation is mine.