Find It, Disclose It, Detect It: A Week in AI and Cloud Security

A national safety partnership

OpenAI says it signed an agreement with Poland's NASK to collaborate on AI safety, security, and technical research. NASK's AI Research Center serves as the Polish Artificial Safety Institute, according to OpenAI, which puts a national safety institute on the other side of the table from a frontier lab. m:…3117

The partnership aims to evaluate increasingly capable AI systems and identify potential vulnerabilities in them, OpenAI says. It also extends a pattern: OpenAI says it has existing collaborations with the US Center for Advancing Standards and Innovation for Super Intelligence and with the UK AI Security Institute, so Poland joins an existing set of national-institute relationships rather than starting a new model. m:…3117

The partnership has a track record to point to. CERT Polska, which operates within NASK, gained access to OpenAI's cyber-capable models through Daybreak in July 2026, OpenAI says, and used OpenAI models to discover six vulnerabilities in MikroTik RouterOS. m:…3117

The identified MikroTik RouterOS vulnerabilities included flaws that could be combined to take control of devices without authentication, according to OpenAI. The vendor released fixes for those vulnerabilities, and CERT Polska confirmed the vendor's fixes prevented the observed attacks, which gives the partnership a closed loop from discovery to verified fix. m:…3117

A 9.1 disclosure from Oracle

Oracle says it released Security Alert CVE-2026-114820, which affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The breadth across three product lines is part of the story: one alert covers the runtime and the GraalVM editions together. m:…8686

The CVSS v3.1 base score for CVE-2026-114820 is 9.1, Oracle says, which places it at the severe end of the scale and makes patching order a practical question for teams running Java and GraalVM workloads. m:…8686

Detection for the cloud estate

Oracle says it is releasing 18 new Cloud Guard detectors to help customers strengthen their cloud environments. The new detectors identify exposed databases, unnecessary access paths, weak connections, and missing recovery protections, according to Oracle, which covers the misconfigurations that most often turn a cloud deployment into an exposure. m:…2314

The specific flags show what the detectors watch for: Autonomous Database without private endpoints, MySQL DB Systems without deletion protection, pre-authenticated requests on Object Storage buckets, and users able to create auth tokens. Cloud Guard detectors are service-side rules and do not require software agents to be installed on workloads, Oracle says, and users must clone the OCI Detector Recipe to implement the new detectors, with problems appearing within 24 hours after applying a new recipe to a target compartment. m:…2314

Three stages of the same job

The three items line up as stages of one job. The NASK partnership hunts for vulnerabilities in increasingly capable systems, the CVE alert discloses a severe flaw in widely used runtimes, and the Cloud Guard detectors watch for the misconfigurations that let attackers in through the cloud door rather than the model door. m:…3117 m:…8686 m:…2314

The throughline is verification. CERT Polska confirmed vendor fixes prevented observed attacks, and Cloud Guard surfaces problems within 24 hours of a recipe change, so both ends of the week reward checking that a fix actually worked rather than assuming it did. m:…3117 m:…2314

For executives, the week translates into three concrete checks: whether national-institute partnerships like the NASK one are producing verified fixes rather than announcements, whether the 9.1 Java alert is patched across all three affected product lines rather than just the best-known one, and whether cloud detector recipes are actually cloned and applied so the 24-hour detection window starts running. m:…3117 m:…8686 m:…2314