> ## Content Index > Fetch the complete content index at: https://blog.disclose.io/llms.txt > Use this file to discover other available public pages before exploring further. # Policy Pulse - Issue #41 | Week of November 8, 2026 - URL: https://blog.disclose.io/policy-pulse-issue-41-week-of-november-8-2026/ - Published: 2026-11-09T01:51:15.000Z - Updated: 2026-11-09T01:51:15.000Z - Description: 948 kernel root bugs at $1,279 each, and 37,966 AI findings against 629 patches: discovery is cheap, triage is the bottleneck. Plus a pentest agent that escaped its sandbox into WorkOS, and Italy's CVD channel with no safe harbor. - Author: Disclose.io - Tags: Policy Pulse, policy # Policy Pulse - Issue #41 | Week of November 8, 2026 *Your weekly briefing on cybersecurity policy affecting vulnerability disclosure and security research.* ### In 60 Seconds - **OpenAI and Anthropic:** 948 Linux kernel root bugs from one run at $1,279 a bug in API spend, and 37,966 candidate findings against 629 patches. Finding is cheap now; the bottleneck is human triage. - **CVE Program:** supplier CNAs meet on November 9 about the "increasing scale and complexity of vulnerability identification," and a new pilot archives every advisory a CVE record cites. - **WorkOS:** a researcher's autonomous pentest agent left its sandbox and reached customer data; five days passed between first access and detection, and the only thing that covered the outcome was the target's goodwill. - **Italy:** a national CVD channel that welcomes ethical hackers, gives them no legal protection, and routes reports to staff obliged to refer crimes. - **Next deadline:** November 20, the UK ICO's agentic AI call for evidence closes; the Pall Mall industry guidelines are due in Paris on November 10 to 11. --- ### Top Story **Discovery now costs $1,279 a bug. Nobody has priced the triage.** On November 4 OpenAI published the results of running its vulnerability pipeline over about 7% of the Linux kernel: 1,169 working root exploits across 948 distinct flaws, for $1,213,430 in API credits, or $1,279 per exploited vulnerability (API spend only; nobody has published the human cost). By the time the scan and manual analysis wrapped up after ten days, 61 were patched upstream, 43 had staging patches and 299 were being discussed publicly. OpenAI sent the most serious first, at the kernel community's suggestion, withheld the exploitation techniques, and is routing the rest through its Patch the Planet partners. ([Help Net Security](https://www.helpnetsecurity.com/2026/11/05/openai-linux-kernel-root-exploits/?ref=blog.disclose.io)) The next day it shipped GPT-6 Cyber, classified "Critical in Cybersecurity under our Preparedness Framework," sold only to vetted Daybreak Red users, with one government evaluation partner named (NIST CAISSI) and no section on how what the model finds reaches the vendors who have to fix it. ([OpenAI](https://deploymentsafety.openai.com/gpt-6-cyber?ref=blog.disclose.io)) Anthropic's disclosure dashboard, snapshotted November 2, shows the other side of the ledger: 37,966 candidate findings, 5,087 disclosed across 680 open-source projects, 629 patched upstream, and 733 identifiers, of which 230 are CVEs. The page says "the process of independent human triage and review is the rate limiting step," and that confirmed bugs exist "that we have not yet reported to maintainers, due to capacity limitations." ([Anthropic](https://red.anthropic.com/2026/cvd/?ref=blog.disclose.io)) Maintainers are answering with their inboxes: Google stopped taking product submissions to its open-source VRP from October 1, citing "a significant rise in automated submissions, the vast majority of which are not valid." ([BleepingComputer](https://www.bleepingcomputer.com/news/google/google-halts-open-source-bug-bounty-program-amid-ai-spam-surge?ref=blog.disclose.io)) The CVE Program has put this on an agenda. Board minutes posted November 5 show major supplier CNAs invited to a November 9 meeting of "a small group of organizations that are dealing directly with the increasing scale and complexity of vulnerability identification, disclosure, and downstream use of CVE data," and say the coming Authorized Data Publisher policy "is not limited to suppliers." ([CVE Board, Sep 30](https://marc.info/?l=cve-editorial-board&m=179382796412608&w=2&ref=blog.disclose.io), [Oct 14](https://marc.info/?l=cve-editorial-board&m=179391563006229&w=2&ref=blog.disclose.io)) **Why it matters for VDP:** Finding is the cheap step now. One lab's 230 CVEs against 5,087 disclosures means CVE and KEV undercount what has been found and fixed, and a program that measures itself by reports received is measuring the wrong end. The scarce resources are a maintainer's hours and a shipped fix. Sequencing by severity, paying for independent triage before a report lands, and disclosing in batches a project can absorb are what both labs describe doing, by practice, before anyone wrote them down; Anthropic also still reports 3,225 findings to maintainers directly, without that independent check. *Throwback: In [Issue #38](https://blog.disclose.io/policy-pulse-issue-38-week-of-october-18-2026/), curl's most serious bug of the year came from an AI scanner whose reports no human had read before they were sent. This week put a price on the finding side.* --- ### Upcoming Deadlines & Events | Date | What | Who should act | What to do | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Nov 9** | CVE Program: Board-convened meeting of major supplier CNAs on the scale of vulnerability identification and downstream use of CVE data | CNAs, VDP operators | Read the invitation in the [Sep 30 minutes](https://marc.info/?l=cve-editorial-board&m=179382796412608&w=2&ref=blog.disclose.io); watch the [board list](https://marc.info/?l=cve-editorial-board&ref=blog.disclose.io) for the readout | | **Nov 10 to 11** | Pall Mall Process: industry guidelines on commercial cyber intrusion capabilities scheduled to launch in Paris (per the [BHRRC tracker](https://www.business-humanrights.org/en/latest-news/pall-mall/?ref=blog.disclose.io); no draft is public) | Policy folks, researchers | Hold the final text against the "Protect digital security research" ask in the [civil-society submission](https://securitylab.amnesty.org/latest/2026/09/essential-elements-for-ensuring-the-industry-guidelines-for-commercial-cyber-intrusion-capabilities-deliver-on-their-potential-joint-civil-society-submission/?ref=blog.disclose.io) | | **Nov 20** | UK ICO: agentic AI call for evidence closes, with a Data Security section | VDP operators, researchers | Respond via the [ICO](https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/2026/10/agentic-ai-call-for-evidence/?ref=blog.disclose.io) | | **Dec 7** | US Copyright Office: first-round comments on the DMCA 1201 proposed classes; NIST SP 800-221 Rev. 1 comments close the same day | Researchers, program operators | File via the [1201 rulemaking page](https://www.copyright.gov/1201/2027/index.html?ref=blog.disclose.io); comment on [SP 800-221r1](https://csrc.nist.gov/pubs/sp/800/221/r1/ipd?ref=blog.disclose.io) | | **Dec 11** | CISA 2015 information-sharing liability shield expires with the stopgap; 35 trade groups (US Chamber, BSA, ABA and others) asked on Nov 1 for the House's extension to 2035 to stay in the NDAA, and Sen. Rand Paul's speech amendment still blocks a Senate deal | Policy folks, anyone sharing threat or vulnerability data with government | Track the NDAA conference via [Nextgov](https://www.nextgov.com/cybersecurity/2026/11/industry-groups-urge-congress-renew-cyber-threat-sharing-law-through-defense-authorization/416985/?ref=blog.disclose.io) | | **Dec 16** | UK DSIT: Software Security Code of Practice evaluation survey closes | Vendors, VDP operators | Respond via [gov.uk](https://www.gov.uk/government/calls-for-evidence/evaluation-survey-for-the-software-security-code-of-practice?ref=blog.disclose.io) | | **Jan 14** | UK Law Commission: product liability consultation (should software and AI count as "products") closes; the Budget's 2027 cyber-breach liability consultation builds on it | Vendors, policy folks | Respond via the [Law Commission](https://lawcom.gov.uk/project/product-liability/?ref=blog.disclose.io) | --- ### This Week in Policy #### Legal & Researcher Protections **A researcher's pentest agent escaped its sandbox and went five days undetected inside WorkOS. No law says whose problem that is.** WorkOS says an agent running "cybersecurity benchmark evaluations using ARTEX" left its test environment, first reached an internal sales tool on October 25 and was noticed on October 30, after it had bulk-retrieved customer records from a tool on the public internet with a predictable development credential. The researcher came forward after the November 2 bulletin, an independent forensics firm matched the evidence, the data was deleted, and WorkOS concluded this "wasn't the work of an actor with malicious intent." Nothing published mentions law enforcement. ([WorkOS](https://workos.com/security/bulletins/update-for-october-30th-2026-data-security-incident?ref=blog.disclose.io), [BleepingComputer](https://www.bleepingcomputer.com/news/security/runaway-ai-hacking-agent-behind-workos-breach-after-escaping-sandbox/?ref=blog.disclose.io)) **Why it matters for VDP:** The outcome rested on the target's goodwill. No program scope covers an agent that left it, and the two liability drafts in Congress point the other way: Rep. Lori Trahan's CLAIM Act makes developers liable when an AI system injures a third party through conduct that "would constitute negligence," an intentional tort or a crime if a person did it (unless the user or a modifying company intended the conduct or was negligent), and its release says nothing about security testing or authorized access; the Hawley-Murphy AI Agent Accountability Act would extend CFAA liability to agent operators, with text still unpublished. ([Trahan](https://trahan.house.gov/news/documentsingle.aspx?DocumentID=3861&ref=blog.disclose.io), [CSA](https://labs.cloudsecurityalliance.org/research/csa-research-note-agent-operator-liability-proposals-2026110/?ref=blog.disclose.io)) #### AI & Emerging Tech Security **Washington's AI incident machinery is forming, without a word about researchers.** The Justice Department announced its Super Intelligence Task Force on November 5, created by an October 13 memo from Attorney General Todd Blanche, to set AI enforcement priorities, write prosecution guidance, and serve as the department's point of contact with the White House Super Intelligence Force chaired by Jay Clayton; the report does not mention vulnerability research. ([Nextgov](https://www.nextgov.com/artificial-intelligence/2026/11/department-justice-forms-ai-task-force/417074/?ref=blog.disclose.io)) The operative federal text is still the October 16 NIST CAISSI, NSA SISC and CISA "Key Practices," which tell labs to "Create inbound reporting channels to receive reports of SI control incidents and information from affected third parties" and to "Report software vulnerabilities arising from SI control incidents using established mechanisms," citing CISA's CVD program. Its first footnote excludes the case researchers trigger most: "actions resulting from an adversarial prompt injection or an intentionally backdoored model would be considered instructed actions, and therefore not treated as the primary cause of an SI control incident." ([NIST](https://www.nist.gov/news-events/news/2026/10/key-practices-incident-readiness-and-response-super-intelligence-training?ref=blog.disclose.io)) **Why it matters for VDP:** A lab's inbound channel for agent incidents is a VDP by another name, and an action an agent took because it was prompt-injected does not count as the primary cause of an "SI control incident" under this voluntary guidance. The body that will write prosecution guidance for AI-assisted access has no researcher voice in it yet; the Friends item below asks for one. #### CVE & Vulnerability Programs **Two exploited bugs show where the fix cost lands.** WordPress Core CVE-2026-119977 (CVSS 8.1, CNA Wordfence) is a race in the core updater: upgrades use "predictable, web-accessible staging paths," so an unauthenticated attacker can run code during the upgrade window. The behavior dates to WordPress 2.7 in 2008; Umut Bayram of Picus Security found it in about four hours working with GPT-5.6 Sol. The fix is 7.1.4, but the upgrade to it runs through the same updater, so Bayram recommends denying web access to `wp-content/upgrade/` before updating. CISA added it to KEV on November 3, due November 6\. ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-119977&ref=blog.disclose.io), [Hackread](https://hackread.com/cisa-hackers-exploiting-wordpress-core-vulnerability?ref=blog.disclose.io), [CISA](https://www.cisa.gov/news-events/alerts/2026/11/03/cisa-adds-one-known-exploited-vulnerability-catalog?ref=blog.disclose.io)) "SSHole," CVE-2026-123158 (CVSS 8.1), lets a 257 to 1,024 byte password log in as any account whose shadow field is `*` on musl-based systems built without PAM, Alpine Linux's default sshd, provided password authentication is still on and some other account holds a SHA-crypt hash (the CVE record says 256; Alpine's advisory says 257); CSO traces it to separate decisions by musl (2012), OpenSSH (2016) and Alpine (2022). OpenSSH shipped a workaround in 10.6p2 while saying "We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there," and MITRE assigned the record. ([CSO](https://www.csoonline.com/article/4245407/?ref=blog.disclose.io), [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-123158&ref=blog.disclose.io), [Alpine](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/?ref=blog.disclose.io), [OpenSSH](https://www.openssh.org/releasenotes.html?ref=blog.disclose.io)) **Why it matters for VDP:** In WordPress the patch path is the attack path, so the cost moved from site owners to hosts. In SSHole three components each did something defensible and the bug lives in the interaction, so no vendor owns it and the fix came from the one that disputes it. The CVE rule that CNAs may reach different verdicts on the same bug ([Issue #39](https://blog.disclose.io/policy-pulse-issue-39-week-of-october-25-2026/)) is going to get exercise. **The CVE Program now archives every advisory a record cites, so silent edits leave a trail.** The Reference Archive Pilot, announced November 3, saves "PDFs, full-page screenshots, and WARC (Web ARChive) files" of each reference when a record is published or updated, at cvearchiver.com through January 2027, so that "If a vendor advisory is silently modified or pulled after initial disclosure, the archived screenshot and WARC files can provide a verifiable baseline." ([CVE Program](https://medium.com/@cve%5Fprogram/cve-program-reference-archive-pilot-preserving-the-reference-history-of-cve-records-for-the-86a4a5bcba04?ref=blog.disclose.io)) **Why it matters for VDP:** Credit and severity disputes come down to what the vendor said on day one. There is now a neutral copy. #### International Developments **Italy built the EU's newest CVD channel and left the researcher outside it.** ACN's national Coordinated Vulnerability Disclosure policy, adopted October 7 under Italy's NIS2 transposition (D.Lgs. 138/2024), makes CSIRT Italia the intermediary for zero-day reports, through a dedicated platform and anonymously on request. The announcement's one legal sentence is that research activities "vanno condotte nel rispetto della legge e non devono integrare fattispecie di reato." ICT Security Magazine's reading: "Non crea nessuna tutela penale," CSIRT staff are public officials who "deve informare l'autorità giudiziaria" about offences prosecutable ex officio that they learn of on duty, and art. 615-ter (unauthorized access) still applies, where Belgium wrote its researcher exemption into its NIS2 law. ([ACN](https://www.acn.gov.it/portale/en/w/l-acn-invita-la-comunita-digitale-e-gli-hacker-etici-a-segnalare-tutte-le-vulnerabilita-zero-day-?ref=blog.disclose.io), [ICT Security Magazine](https://www.ictsecuritymagazine.com/articoli/cvd-hacker-etici-615-ter/?ref=blog.disclose.io)) **Why it matters for VDP:** Reporting to a government CSIRT whose staff must refer the crimes they learn of is a different risk calculus from reporting to a vendor. NIS2 required every member state to name a coordinator and only encouraged researcher protections (recital 60) rather than mandating a safe harbor; Italy shows what that gap looks like in practice. **The UK funds state-scale discovery and an agentic incident unit.** The October 28 Budget puts £70 million into a "National Exposure and Real-Time Vulnerability (NERV) Centre at the National Cyber Security Centre" that "will deploy AI tools to identify cyber vulnerabilities across our critical infrastructure and the wider economy," £40 million into "a National Agentic Security Unit to investigate and respond to rogue agentic incidents" (no host agency named), and says the government "will consult next year on how to tackle insecure technology at source and consider where liability for cyber breaches should sit." ([HM Treasury](https://www.gov.uk/government/publications/budget-2026-document/budget-2026-html?ref=blog.disclose.io), [The Record](https://therecord.media/uk-budget-proposal-software-companies-liable-cyber-breaches?ref=blog.disclose.io)) At Report stage of the Cyber Security and Resilience Bill on October 26, the Lords agreed a government clause (Amendment 70) under which regulations may give the Secretary of State investigatory and enforcement powers where a compromise of a regulated system "is or may be attributable to loss of oversight or control of an AI agent," with "AI agent" itself left to be defined by regulation; Third Reading followed on November 2 and the Bill is back with the Commons. ([UK Parliament](https://bills.parliament.uk/bills/4035?ref=blog.disclose.io), [The Register](https://www.theregister.com/ai-and-ml/2026/11/06/uk-ministers-seek-powers-to-investigate-when-ai-agents-are-let-off-the-leash/5307889?ref=blog.disclose.io)) **Why it matters for VDP:** NERV makes the state a high-volume finder too, and how its findings reach vendors is unwritten. A vendor liability regime turns a working intake channel from a courtesy into a legal defense. --- ### Worth Reading - **[Liability Reaches the Operator: Agent Accountability, CLAIM, and 48-Hour Reporting](https://labs.cloudsecurityalliance.org/research/csa-research-note-agent-operator-liability-proposals-2026110/?ref=blog.disclose.io)** (Cloud Security Alliance, November 3): the two liability drafts side by side, plus the October 28 letter from Reps. Pallone, Lofgren and Raskin asking five labs for a full incident accounting by November 11\. "Expanding CFAA liability touches a long-running concern about chilling good-faith security research." - **[La cyber security non si costruisce punendo chi scopre le vulnerabilità](https://www.cybersecurity360.it/legal/la-cyber-security-non-si-costruisce-punendo-chi-scopre-le-vulnerabilita/?ref=blog.disclose.io)** (Sandro Sana, Cybersecurity360, October 19, in Italian): why Italy's CVD policy will deter the people it needs unless good-faith researchers get real protection. - **[The state of vulnerability research and disclosure in 2026](https://www.etsi.org/activities/state-of-the-nation-keynote/?ref=blog.disclose.io)** (Casey Ellis, ETSI Security Conference 2026 keynote, Sophia Antipolis, October 19, slides as PDF): where research and disclosure stand this year, and the case for standardised security reporting and safe harbour as AI pushes up the volume of findings. --- ### Friends of disclose.io **Hacking Policy Council: Securing Super Intelligence Requires Protecting Good-Faith Security Research** Published November 3 on the Center for Cybersecurity Policy and Law site, this asks the White House Superintelligence Task Force to carve researchers out of whatever it builds, because rules written for misuse of "hacking capabilities" land first on the people who test with them, and "Researchers are also often the first to find model flaws." **Key recommendations:** - Weigh intent and conduct: "decisions about liability should consider the researcher's intent and conduct," meaning authorization, harm avoidance and responsible disclosure. - Keep researcher-reported findings separate from attacks in any breach or jailbreak notification regime. - Treat researchers "as essential partners in assessing the offense-defense balance," and bring bug bounty platforms and red teams in before the 120-day report lands. 📄 [Read the post](https://www.centerforcybersecuritypolicy.org/insights-and-research/securing-super-intelligence-requires-protecting-good-faith-security-research?ref=blog.disclose.io) --- *Policy Pulse is a weekly bulletin from [disclose.io](https://disclose.io/?ref=blog.disclose.io). Have a tip or an experience that belongs in the next issue? Join the [community discussion](https://community.disclose.io/?ref=blog.disclose.io).*