AI Agent Security Alerts, TSMC Revenue Record, and Key Tech News

AI Security

Sandbox Escape Vulnerabilities Found in 7 AI Coding Agents

Cymulate Research Lab disclosed CVE-2026-35603, a configuration-based sandbox escape vulnerability. Seven AI coding agents are affected: Claude Code, OpenAI Codex, Cursor, Gemini CLI, Goose, Hermes Agent, and Grok Build.

The attack exploits Git configuration files. When an agent opens a repository containing a malicious .git config, it executes code with the user’s privileges outside the sandbox. On Claude Code and Hermes Agent, the payload fired before the workspace trust prompt was accepted.

Patches are available for all affected agents. Codex CLI requires version 0.131.0 or later, Cursor 3.0.0 or later, and Claude Code 2.1.196 or later. As AI coding tools proliferate, sandbox isolation is becoming a critical attack surface.

AI Agents Exploit PaperCut Flaws, Breach 395 Organizations Across 48 Countries

A Russian-speaking threat actor deployed hundreds of AI agents to attack PaperCut NG/MF print management software. The campaign exploited CVE-2026-82078 and CVE-2026-81578, zero-days disclosed on August 27 that allow unauthenticated remote code execution.

The attacker combined OpenAI Codex and DeepSeek models to automate exploitation. Target lists were generated through Netlas, and some organizations were compromised in under 30 seconds. A total of 440 servers across 395 organizations in 48 countries were breached.

Education was hit hardest with 204 affected systems. Credentials were harvested from 280 victims, and OS or domain secrets were obtained from 147. This represents one of the first proven cases of large-scale AI-agent-powered cyberattacks in the wild.

Big Tech

Meta Acquires Swedish AI Startup Stilla.ai

Meta acquired Stockholm-based AI startup Stilla.ai. Founded in 2024, Stilla raised $5 million in pre-seed funding when it emerged from stealth in January. The acquisition came just eight months after launch.

The deal aims to strengthen Meta Business Agent, which helps businesses interact and transact with customers across WhatsApp, Messenger, and Instagram. Over one million businesses already use the service. META shares rose 6.5% following the announcement.

The rapid acquisition underscores how aggressively big tech companies are competing to build AI agent capabilities. Early-stage AI startups with strategic value are commanding attention before they even reach Series A.

TSMC Posts Record Monthly Revenue of NT$514.8 Billion

TSMC reported August revenue of NT$514.8 billion (approximately $16.35 billion), a 53.3% year-over-year increase. This marks the first time TSMC has breached the NT$500 billion threshold in a single month.

AI server chip demand drove the record. All 3nm, 4nm, and 5nm nodes ran at full capacity throughout the period. Revenue has grown for four consecutive months, and Q3 guidance stands at $44.6 billion to $45.8 billion.

TSMC commands 72.5% of the global foundry market. The result confirms that AI semiconductor demand continues to power industry-wide growth.

Startups

Gimlet Labs Raises $300M Series B for Multi-Silicon Inference Cloud

Gimlet Labs closed an a16z-led $300 million Series B at a $3 billion valuation. Sapphire Ventures, M12, and Arm also participated. Total funding has reached $392 million.

The company’s core technology is multi-silicon inference software. It disaggregates AI model inference across optimized hardware, improving throughput and latency for agentic AI workloads. The goal is inference infrastructure that does not depend solely on GPUs.

Funds will expand serverless infrastructure capacity by several hundred megawatts. The company is also developing a motherboard-free, inference-optimized server for deployment outside traditional data centers.

Implicity Raises EUR 35M for AI Cardiac Remote Monitoring

French medtech company Implicity secured EUR 35 million (approximately $40 million) in growth equity. The round was led by IRIS and Rothschild & Co’s Five Arrows.

Implicity’s platform analyzes data from cardiac implantable electronic devices (CIEDs) using AI. Patients monitored on the platform have seen a 26% reduction in mortality and 4% fewer hospitalizations compared to conventional monitoring.

The funding will expand the U.S. commercial team and grow European market presence, signaling continued global expansion in AI-powered medical device monitoring.

Open Source

Natively has entered the GitHub trending charts. Licensed under AGPL-3.0, it serves as an open-source alternative to Cluely, Otter, and Fireflies for AI-powered meeting assistance.

The key differentiator is fully local execution. It offers real-time transcription, AI meeting notes, lecture recording, and local RAG without sending audio data or transcripts to external servers. A Rust-based audio capture engine handles Zoom, Google Meet, Teams, Slack, and Discord.

The tool supports macOS 12+ (Apple Silicon and Intel) and Windows 10/11. BYOK (Bring Your Own Key) and stealth mode make it suitable as an interview copilot as well.

Rust 1.98.0 Ships Algebraic Floating-Point Methods

Rust 1.98.0 has been released. The headline feature is algebraic floating-point methods on the f32 and f64 types.

These methods allow the compiler to apply algebraic properties of real numbers, such as associativity and commutativity, to optimize arithmetic operations. This enables more efficient code generation for floating-point-heavy workloads. NumBuffer for integer formatting, substr_range, and strip_circumfix were also stabilized.

Rust’s standard library continues its steady expansion with each release.

Gaming

The Witcher 3: Wild Hunt Remastered Launches September 29

CD PROJEKT RED announced that The Witcher 3: Wild Hunt Remastered launches on September 29. The upgrade is free for existing PC, PS5, and Xbox Series X|S owners. It will also release on Nintendo Switch 2 and Battle.net on the same day.

The remaster delivers a full visual overhaul. Enhanced path tracing, higher-resolution textures, and improved dynamic lighting are included. Combat has been modernized with refined targeting, new gap-closing animations, and Sign-based finishers.

A new expansion called Songs of the Past was also revealed for 2027. Co-developed with Fool’s Theory, a studio led by Witcher 3 veterans, it takes place in a new region called Letten.

SEGA Runs Crazy Taxi: World Tour Network Test

SEGA conducted a closed network test for Crazy Taxi: World Tour from September 11 to 13 on PS5, Xbox Series, and PC. The test focused on server stability and online multiplayer infrastructure.

This is a full-scale revival of the 1999 arcade classic. The test offered two maps, four characters, six vehicles with tuning options, and both ranked and custom lobby modes.

The full game launches in 2027 on PS5, Xbox Series X|S, Nintendo Switch 2, and PC.

ArcheAge Chronicles Holds North American Network Test

ArcheAge Chronicles ran a network test on September 12-13 for players in the United States and Canada via Steam. Participants were selected randomly from those who requested access.

The test featured limited early-game content focused on server load testing and network stability. Some features may have been incomplete or missing during the evaluation period.

The game is targeting an Early Access launch in Q4 2026. This test is a key milestone for performance optimization ahead of the official release.

References

CVE-2026-35603: AI Coding Tools Privilege Escalation — Cymulate
AI agents exploited PaperCut flaws to breach 395 organizations — Help Net Security
Stilla is joining Meta — Stilla.ai
TSMC posts record monthly revenue for August — Focus Taiwan
Gimlet Labs raises $300 million in Series B — GlobeNewsWire
Implicity secures $40M growth equity funding — GlobeNewsWire
Natively AI Meeting Assistant — GitHub
Announcing Rust 1.98.0 — Rust Blog
The Witcher 3: Wild Hunt — Remastered Announced — CD PROJEKT RED
Crazy Taxi: World Tour — SEGA
ArcheAge Chronicles Network Test for North America — Inven Global