{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "592",
  "slug": "ai-security-find-disclose-detect",
  "edition": "2026-10-25T12",
  "url": "https://hangingcontext.com/stories/2026-10-25/ai-security-find-disclose-detect/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "OpenAI and NASK will hunt AI vulnerabilities together, Oracle disclosed a 9.1 Java flaw, and Oracle shipped 18 cloud detectors.",
  "headline": "Find It, Disclose It, Detect It: A Week in AI and Cloud Security",
  "dek": "OpenAI says its partnership with NASK will evaluate increasingly capable systems and find vulnerabilities, Oracle disclosed CVE-2026-114820 with a 9.1 base score, and Oracle released 18 Cloud Guard detectors for exposed databases and weak connections.",
  "published_at": "2026-10-25T12:31:11Z",
  "labels": {
    "trust": "reported",
    "trust_text": "Reported · 3 sources",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 3,
  "publishers": [
    "openai-news",
    "oracle-blog"
  ],
  "key_facts": [
    {
      "text": "OpenAI says it signed an agreement with Poland's NASK to collaborate on AI safety, security, and technical research, aiming to evaluate increasingly capable AI systems and identify potential vulnerabilities.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792898795252293117",
          "claim_ids": [
            "1792899157302474507",
            "1792899157307283779",
            "1792899157309242236"
          ]
        }
      ]
    },
    {
      "text": "Oracle says it released Security Alert CVE-2026-114820, affecting Oracle Java SE, with a CVSS v3.1 base score of 9.1.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792887076637938686",
          "claim_ids": [
            "1792888181032125342",
            "1792888181037678292",
            "1792888181044531162"
          ]
        }
      ]
    },
    {
      "text": "Oracle says it is releasing 18 new Cloud Guard detectors that identify exposed databases, unnecessary access paths, weak connections, and missing recovery protections.",
      "self_reported": true,
      "cites": [
        {
          "manifest_id": "1792866108708562314",
          "claim_ids": [
            "1792866401366788065",
            "1792866401368659095"
          ]
        }
      ]
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "A national safety partnership",
      "paragraphs": [
        {
          "markdown": "OpenAI says it signed an agreement with Poland's NASK to collaborate on AI safety, security, and technical research. NASK's AI Research Center serves as the Polish Artificial Safety Institute, according to OpenAI, which puts a national safety institute on the other side of the table from a frontier lab.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157302474507",
                "1792899157306495307"
              ]
            }
          ]
        },
        {
          "markdown": "The partnership aims to evaluate increasingly capable AI systems and identify potential vulnerabilities in them, OpenAI says. It also extends a pattern: OpenAI says it has existing collaborations with the US Center for Advancing Standards and Innovation for Super Intelligence and with the UK AI Security Institute, so Poland joins an existing set of national-institute relationships rather than starting a new model.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157307283779",
                "1792899157309242236"
              ]
            }
          ]
        },
        {
          "markdown": "The partnership has a track record to point to. CERT Polska, which operates within NASK, gained access to OpenAI's cyber-capable models through Daybreak in July 2026, OpenAI says, and used OpenAI models to discover six vulnerabilities in MikroTik RouterOS.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157315406042",
                "1792899157313631724",
                "1792899157316659336"
              ]
            }
          ]
        },
        {
          "markdown": "The identified MikroTik RouterOS vulnerabilities included flaws that could be combined to take control of devices without authentication, according to OpenAI. The vendor released fixes for those vulnerabilities, and CERT Polska confirmed the vendor's fixes prevented the observed attacks, which gives the partnership a closed loop from discovery to verified fix.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157317261379",
                "1792899157319496107",
                "1792899157320408809"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "A 9.1 disclosure from Oracle",
      "paragraphs": [
        {
          "markdown": "Oracle says it released Security Alert CVE-2026-114820, which affects Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. The breadth across three product lines is part of the story: one alert covers the runtime and the GraalVM editions together.",
          "cites": [
            {
              "manifest_id": "1792887076637938686",
              "claim_ids": [
                "1792888181032125342",
                "1792888181037678292",
                "1792888181039453601",
                "1792888181042924782"
              ]
            }
          ]
        },
        {
          "markdown": "The CVSS v3.1 base score for CVE-2026-114820 is 9.1, Oracle says, which places it at the severe end of the scale and makes patching order a practical question for teams running Java and GraalVM workloads.",
          "cites": [
            {
              "manifest_id": "1792887076637938686",
              "claim_ids": [
                "1792888181044531162"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Detection for the cloud estate",
      "paragraphs": [
        {
          "markdown": "Oracle says it is releasing 18 new Cloud Guard detectors to help customers strengthen their cloud environments. The new detectors identify exposed databases, unnecessary access paths, weak connections, and missing recovery protections, according to Oracle, which covers the misconfigurations that most often turn a cloud deployment into an exposure.",
          "cites": [
            {
              "manifest_id": "1792866108708562314",
              "claim_ids": [
                "1792866401366788065",
                "1792866401368659095"
              ]
            }
          ]
        },
        {
          "markdown": "The specific flags show what the detectors watch for: Autonomous Database without private endpoints, MySQL DB Systems without deletion protection, pre-authenticated requests on Object Storage buckets, and users able to create auth tokens. Cloud Guard detectors are service-side rules and do not require software agents to be installed on workloads, Oracle says, and users must clone the OCI Detector Recipe to implement the new detectors, with problems appearing within 24 hours after applying a new recipe to a target compartment.",
          "cites": [
            {
              "manifest_id": "1792866108708562314",
              "claim_ids": [
                "1792866401373972361",
                "1792866401375942392",
                "1792866401380699073",
                "1792866401378253501"
              ]
            }
          ]
        }
      ]
    },
    {
      "heading": "Three stages of the same job",
      "paragraphs": [
        {
          "markdown": "The three items line up as stages of one job. The NASK partnership hunts for vulnerabilities in increasingly capable systems, the CVE alert discloses a severe flaw in widely used runtimes, and the Cloud Guard detectors watch for the misconfigurations that let attackers in through the cloud door rather than the model door.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157309242236"
              ]
            },
            {
              "manifest_id": "1792887076637938686",
              "claim_ids": [
                "1792888181032125342"
              ]
            },
            {
              "manifest_id": "1792866108708562314",
              "claim_ids": [
                "1792866401366788065"
              ]
            }
          ]
        },
        {
          "markdown": "The throughline is verification. CERT Polska confirmed vendor fixes prevented observed attacks, and Cloud Guard surfaces problems within 24 hours of a recipe change, so both ends of the week reward checking that a fix actually worked rather than assuming it did.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157319496107"
              ]
            },
            {
              "manifest_id": "1792866108708562314",
              "claim_ids": [
                "1792866401370517820"
              ]
            }
          ]
        },
        {
          "markdown": "For executives, the week translates into three concrete checks: whether national-institute partnerships like the NASK one are producing verified fixes rather than announcements, whether the 9.1 Java alert is patched across all three affected product lines rather than just the best-known one, and whether cloud detector recipes are actually cloned and applied so the 24-hour detection window starts running.",
          "cites": [
            {
              "manifest_id": "1792898795252293117",
              "claim_ids": [
                "1792899157319496107"
              ]
            },
            {
              "manifest_id": "1792887076637938686",
              "claim_ids": [
                "1792888181032125342"
              ]
            },
            {
              "manifest_id": "1792866108708562314",
              "claim_ids": [
                "1792866401370517820"
              ]
            }
          ]
        }
      ]
    }
  ],
  "unresolved": [
    "What the NASK partnership's first joint evaluations will cover",
    "How widely CVE-2026-114820 is exploited before patching"
  ],
  "decision_card": {
    "useful_for": [
      "Tracking AI safety partnerships with national institutes",
      "Prioritizing patching and cloud detection work"
    ],
    "not_for": [
      "Java patching timelines alone",
      "Cloud posture without detector recipes"
    ],
    "compare_against": [
      "Ad hoc vulnerability disclosure",
      "Manual cloud misconfiguration review"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-10-25T12"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1792898795252293117",
    "1792887076637938686",
    "1792866108708562314"
  ],
  "manifests": [
    {
      "manifest_id": "1792898795252293117",
      "title": "OpenAI and Poland's NASK partner to advance AI safety and security",
      "source_name": "openai-news",
      "source_url": "https://openai.com/index/openai-nask-ai-safety-security-partnership",
      "published_date": "2026-10-23"
    },
    {
      "manifest_id": "1792887076637938686",
      "title": "Security Alert CVE-2026-114820",
      "source_name": "oracle-blog",
      "source_url": "https://blogs.oracle.com/security/security-alert-cve-2026-114820",
      "published_date": "2026-10-24"
    },
    {
      "manifest_id": "1792866108708562314",
      "title": "Cloud Guard Protects Data with new Detectors",
      "source_name": "oracle-blog",
      "source_url": "https://blogs.oracle.com/cloud-infrastructure/cloud-guard-protects-data-with-new-detectors",
      "published_date": "2026-10-24"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1792898795252293117",
      "1792887076637938686",
      "1792866108708562314"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; 3 of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1792898795252293117",
      "all": "for id in 1792898795252293117 1792887076637938686 1792866108708562314; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-10-25/ai-security-find-disclose-detect/",
    "json": "https://hangingcontext.com/stories/2026-10-25/ai-security-find-disclose-detect/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-10-25/ai-security-find-disclose-detect/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-10-25T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-10-25/oracle-ai-stack/",
      "headline": "Oracle's AI Stack, From Concrete to Cloud Detectors",
      "slug": "oracle-ai-stack"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-25/operating-ai-trust-stack/",
      "headline": "Running AI Means Securing It, Proving Its Privacy, and Surviving Its Outages",
      "slug": "operating-ai-trust-stack"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-24/security-bottleneck-remediation/",
      "headline": "Discovery outruns remediation while a certificate-authority failure shows trust itself breaking underneath application code",
      "slug": "security-bottleneck-remediation"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-10-24/legal-ai-value-pricing/",
      "headline": "Legal AI stops selling hours: Legora's $550M round lands as firms reprice work on value",
      "slug": "legal-ai-value-pricing"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Connect your agent over MCP",
    "text": "Add https://mcp.synorb.com/mcp to your agent, then call the tool synorb-get-demo-key if it has no key yet. It needs no email and no form. Keys are free for 72 hours, and new keys are limited per network.",
    "cta": {
      "label": "How to connect",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-10-25/ai-security-find-disclose-detect/"
  }
}