Week 37 · September 7 to September 13, 2026
AI security this week
In week 37 of 2026 (September 7 to September 13, 2026), The Injection tracked 4 AI security stories, 1 of them rated high or critical, including "SQL Server Copilot: prompt injection escalates a user to sysadmin" and "ChatGPT sandbox: shared package cache leaked data across accounts". 1 story came with a CVE. Most affected: GitHub Copilot (1).
Top storyHIGH
SQL Server Copilot: prompt injection escalates a user to sysadminInstructions planted in database metadata made Copilot run write queries as whichever admin used it next.
What to do · Update SSMS to 22.8.2 or later. Do not connect Copilot with sysadmin credentials, and use Microsoft's new admin controls to disable Copilot or restrict its execution context where high privileges are in use.
High 1
HIGH
Vulnerability · Embrace The Red · CVE-2026-65669 · CVSS 9.6
SQL Server Copilot: prompt injection escalates a user to sysadminCVE-2026-65669 let indirect prompt injection push GitHub Copilot in SQL Server Management Studio past its read-only mode and run T-SQL with a sysadmin's privileges. Microsoft rates it CVSS 9.6; SSMS 22.8.2 fixes it.
Low 1
LOW
Vulnerability · Check Point Research
ChatGPT sandbox: shared package cache leaked data across accountsCheck Point Research found that ChatGPT code containers from different accounts shared one internal JFrog Artifactory, giving attackers a hidden channel into a victim's session and connected apps. OpenAI shut the instance down.
Info 2
INFO
Tool · OWASP GenAI Security Project
Agent Control Standard: an open spec for blocking agent actionsThe Agent Control Standard is an open specification, now hosted by the OWASP GenAI Security Project, that lets a guardian agent permit, deny or modify an AI agent's tool calls and other actions before they run.
INFO
Incident · Google Threat Intelligence Group
Google GTIG: attackers used AI agents to run a credential campaignGoogle Threat Intelligence Group reports a threat actor who planned, built and ran an agent-enabled mass credential harvesting campaign in under six hours. GTIG says it has not yet seen fully autonomous attack pipelines in the wild.