Skip to content
ROAI

August 28, 2026 · Issue 12 · 5 min read

A hundred companies asked governments to act on AI attacks the same week ServiceNow shipped three CVSS 10.0 fixes

On Thursday, more than 100 companies including OpenAI, Anthropic, Google, Microsoft, Amazon Web Services, Cisco, CrowdStrike, Visa, Mastercard, and General Motors signed an open letter(opens in a new tab) warning that AI-enabled cyberattacks are about to scale and that the window to strengthen defenses may last only months. The asks are directed outward: coordinate defense across borders, fund hospitals and water utilities that have neither staff nor budget, make attacks more expensive to run. The letter cites CrowdStrike's finding that AI-enabled attacks rose 89 percent in 2025 over 2024.

On the same day, ServiceNow published four advisories, three of them scored 10.0. The Hacker News detailed them(opens in a new tab): CVE-2026-18885 in the GraphQL Composite Data API permits unauthenticated arbitrary code execution against instance data, CVE-2026-18886 permits unauthenticated privilege escalation through a configuration image upload, and CVE-2026-74820 permits unauthenticated arbitrary SQL against the instance's underlying database. All three are network-accessible, low complexity, and require no user interaction and no privileges. BleepingComputer notes(opens in a new tab) that the affected AI Platform runs more than 100,000 enterprise AI apps at 85 percent of the Fortune 500. ServiceNow patched its own hosted instances and told self-hosted customers to patch theirs. It says it has no evidence of exploitation yet.

Put the two side by side. The letter's ask points at governments. The exposure that landed the same week points at a patch queue you already own and a hosting decision you already made. Nothing in the letter changes what a Chief AI Officer does on Monday. The advisory does: find every self-hosted instance, name the person accountable for patching it, and put a number on how long that takes today.

Two other findings this month locate the control failure in the same place, which is not the model. Reco's City-Forum research, reported by Help Net Security(opens in a new tab), traced a single address pulling records out of Salesforce and ServiceNow portals worldwide for 17 months, arriving every time as an unauthenticated guest, across telecom operators, banks, software vendors, and public-sector portals. No exploit was required, only a permission setting nobody revisited. Separately, researchers at Anthropic and EPFL demonstrated(opens in a new tab) that a payload written into an agent's persistent system prompt file infected the next agent 55 percent of the time, against 17 percent through an ordinary workspace file, with four action payloads surviving 20 hops. Their mitigation was one paragraph of added instruction.

The pattern a budget owner should take from this week is that AI risk is arriving through configuration, persistence, and patch latency rather than through model capability. None of these three findings needed a frontier model to matter. Two of them needed a default left alone. That is a cheaper problem than the open letter implies and a harder one to fund, because it does not look like AI spend on a slide.

Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.

The open letter and the advisory arrived within a day of each other, and only one of them has an owner inside your company.

Three things are answerable before the next review, and none of them require a new budget line.

First, the self-hosted inventory. ServiceNow patched what it hosts. Everything else waits on someone in your organization. The question is not whether you are exposed, it is how many instances exist, who owns each one, and what the median time to patch has actually been over the last four advisories. That last number is the one that predicts the next incident, and most enterprises have never measured it.

Second, unauthenticated access on the platforms your AI workflows read from. The City-Forum finding involved no vulnerability at all. Guest permissions on customer portals were doing exactly what they were configured to do, for 17 months, across banks and telecom operators and security vendors. Any AI feature that reads from a SaaS portal inherits that portal's access model, and inherits it silently. Ask for a list of guest-readable objects, not an assurance that guest access is disabled.

Third, the write path between your agents. The Anthropic and EPFL work matters less as a threat forecast than as a design note. Persistent instruction files are shared mutable state between processes that read instructions as instructions. If two agents in your stack can write to a file the other one reads at startup, that is an unmarked trust boundary. The fix the researchers found was a paragraph of text, which tells you the current cost of getting this wrong is close to zero and the current cost of ignoring it is not.

The uncomfortable read on this week is that the industry's own coalition is asking governments to move faster on a threat whose most concrete enterprise expression, so far, is a patch cycle and two configuration defaults. Those are unglamorous, they sit in operations budgets sized before any of this, and they are entirely within your control. Fund them now, while they still read as hygiene.

Also worth knowing