Please enjoy our latest podcast, the weekly Security Sprint, on Spotify, Apple, as well as other locations accessible via the Spotify for Podcasters link or wherever you listen to your favorite podcasts.
Opening:
- 15 x 15 GRIP Alerts!!
- 27th Annual TribalNet Conference & Tradeshow
- Tribal-ISAC
- CISA: 2026 Election Infrastructure Security Plan
Main Topics:
Terrorism and Targeted Violence (T2V) in the United States: Plots Targeting U.S. Schools — START — Sep 2026. The University of Maryland’s START program examined 700 premeditated plots targeting U.S. school spaces between January 2023 and March 2026 using its Terrorism and Targeted Violence database. The research analyzes plot rates, locations, weapons, perpetrator intentions and outcomes, perpetrator ages, and the intersection between terrorism and school-based targeted violence. The broader database encompasses successful, failed, and foiled violent events intended to significantly affect public safety or critical infrastructure, while excluding threats lacking evidence of mobilization toward violence. The research provides security practitioners with a data-driven foundation for understanding school-targeting behavior and distinguishing threatening communications from plots in which individuals have progressed toward operational preparation. (START)
OpenAI Agent Hacked Australia’s Health Service. Their Government Found Out Months Later — WIRED — 24 Sep 2026. An OpenAI agent conducting research on publicly available medicine-spending data gained unauthorized access to a Services Australia Medicare statistics portal on 18 June after encountering restrictions and finding alternative methods to obtain the requested information. Australian Prime Minister Anthony Albanese said the agent accessed both public and non-public files and wrote data to an internal server, although officials have so far identified no impact to individuals. Beyond the unauthorized agent behavior itself, the incident raises a significant governance and disclosure concern because Australian authorities reportedly were not notified by OpenAI until 10 September, nearly three months after the activity occurred. The episode demonstrates that increasingly autonomous systems can cross intended technical and authorization boundaries while pursuing otherwise legitimate objectives, making containment, monitoring, escalation, and timely third-party notification important components of agentic AI governance. (BleepingComputer) 15 from 15 connection: The incident reinforces Assess, Security Stack, and Planning, particularly understanding what autonomous systems can access, implementing controls capable of detecting and containing unintended activity, and establishing escalation and incident-notification procedures before agents interact with external systems. Gate 15’s 15 from 15 Cybersecurity Mitigation & Resilience Fundamentals.
- Scoop: Top AI companies probing tens of thousands of security incidents — Axios
- The Hugging Face incident and other third-party impact from misaligned models — OpenAI
- OpenAI pauses training on some models, says agents targeted government sites
- OpenAI agents tried to bruteforce a UN website’s API fields
- OpenAI’s AI agents accidentally uploaded user-provided images to third-party sites
- It was a matter of when, not if… — DIVD — 24 Sep 2026. The Dutch Institute for Vulnerability Disclosure reported that its own infrastructure was compromised and said the attack’s modus operandi indicates what it believes may be an agentic AI-powered attack, while emphasizing that its forensic investigation remains ongoing.
- Cyber Threat Report 2026: Leaders need to prepare now for the impact of AI — New Zealand National Cyber Security Centre — Sep 2026
- Protect your organisation’s AI services — Australian Signals Directorate — Sep 2026.
Quick Hits:
- ENISA Threat Landscape 2026 — European Union Agency for Cybersecurity — 22 Sep 2026. ENISA’s annual threat assessment finds the European cyber environment increasingly shaped by interconnected threats, shared dependencies, geopolitical developments, and blurred boundaries among cybercrime, hacktivist, and state-linked activity.
- ShinyHunters hackers say they breached Federal Bureau of Investigation, no immediate comment from FBI
- FBI Statement on Compromise of fbijobs.gov Portal and Alleged Impact to FBI Employee PII
- Military personnel data exposed in breach, agency warns
- Gary Warner on LinkedIn: DMDC breach notification raises questions about notification timing and QR-code delivery
- Special agents’ blood and urine test results stolen in FBI hack
- Russia! US-Based Digital Forensics Firm Hid its Russian Ownership from U.S. Government Customers
- Russia! ‘United by chaos:’ Examining the Russian nexus to online networks of nihilistic violence
- No Kings: Vote Early nationwide day of action planned for 17 October
Read more about Gate 15’s full podcast menu at our Podcast page. You can subscribe and enjoy all the Gate 15 Podcasts on Spotify for Podcasters, Apple, Spotify, as well as other locations accessible from the Spotify for Podcasters link. Week-to-week, you can hear and learn more about our all-hazards threats, risks, mitigation and other issues impacting homeland security risk management from our team as well as our regular and special guests. The full podcast menu includes:
- The Security Sprint is our weekly rundown of the week’s notable all-hazards security news, risks and threats and some of the key focus areas for organizations to consider behind the headlines. Gate 15 team members discuss physical security, cybersecurity, natural hazards, health threats and other issues across our environment.
- Nerd Out! Security Panel Discussion, moderated by Dave Pounder, focuses on physical security topics including terrorism, extremism, hostile events, and other pertinent topics.
- The Gate 15 Interview, is a monthly interview between Gate 15’s founder and Managing Director, Andy Jabbour and guests from throughout the homeland security risk management community addressing a wide range of all-hazards topics and issues.
- The Cybersecurity Evangelist, with Jennifer Lyn Walker, is a cybersecurity-focused discussion with Jen and invited guests. This is presently a Gate 15 special podcast and occasionally is updated on our Gate 15 podcast channel.
- Venue Security, The IAVM Podcast Series was a 2024 limited series podcast as Gate 15’s founder and Managing Director, Andy Jabbour hosted a series of short interviews with venue safety and security experts from the International Association of Venue Managers’ (IAVM) Venue Safety and Security Committee (VSSC) and other special guests from the IAVM community.
- The Risk Roundtable, was a monthly discussion among our team and occasional guests exploring the all-hazards threats and risks impacting the United States and internationally. This was suspended in September 2023.
We hope you’ll subscribe, listen and share your ideas and other feedback! Reach out to us on Bluesky, LinkedIn, via email at Gate15@gate15.global.
