This is the last 24 hours to save up to $200 on your TechCrunch Disrupt 2026 ticket before prices increase. As our countdown ends, the next reason is all about what can happen when you compress months of research, conversations, and decision-making into three days at San Francisco’s Moscone West on October 13-15.

Register before the clock strikes midnight to secure savings of up to $200. Plus, save an additional 50% when you purchase a second pass of the same type.

Reason No. 5: Momentum.

Building a company, finding your next investment, entering a new market or making a big technology decision takes time. Progress rarely comes from one conversation or one piece of information. It comes from putting enough of the right things together to make the next move clearer. TechCrunch Disrupt brings 10,000+ founders, investors, and operators together in one place. Three days. Hundreds of conversations. One opportunity to move things forward faster.

Gain a year’s worth of connections and insights in three days

Think about everything that can sit on a to-do list for weeks. Research the market. Understand what competitors are building. Find potential investors. Compare technologies. Meet prospective partners. Talk to potential clients. Hear how other founders are approaching the same challenges. Work out which trends are worth paying attention to and which aren’t.

At Disrupt, many of those things can happen side by side. You can move from one of the 250+ sessions on the market where you’re entering a conversation with someone already operating in it. See a new breakthrough on one of the six industry stages, then meet the company building it. Hear how an investor is thinking about a category, then use that insight in your next fundraising conversation. Each interaction can build on the last.

Grab your pass to stay ahead of the tech ecosystem and secure your savings. Savings of up to $200 vanish when today ends.

Leave Disrupt further ahead than you arrived

TechCrunch Disrupt isn’t about trying to solve everything in three days. It’s about creating enough movement that Monday looks different. A meeting becomes a follow-up. A question becomes a decision. A company moves onto your radar. An idea becomes something worth testing. A conversation starts turning into an opportunity. And once things start moving, the next step tends to come faster.

So, arrive with something you want to push forward. A company. A fundraise. A product. An investment thesis. A partnership. A decision. Then use three days to see how much further you can take it.

24 hours left to save up to $200 on your pass

Current TechCrunch Disrupt 2026 ticket savings end when the clock strikes midnight. Register now to save up to $200 on your ticket and get a second ticket of the same type at 50% off. Groups of four or more can save up to 30%.

One day left. Reason No. 5: Build momentum. Leave further ahead than you arrived.

Technology giant Kiteworks is urging customers to shut down their systems after the company received information that hackers may attempt to target them.

Kiteworks (formerly Accellion), which makes tools for transferring large files and sensitive datasets over the internet, confirmed to TechCrunch that it had notified its customers about a potential threat. The news was first reported exclusively by German publication Heise, which cited an email that Kiteworks had sent to its customers about an “imminent” attack that could happen as soon as this weekend.

When reached by email on Friday, Kiteworks chief information security officer Frank Balonis told TechCrunch that the company “received credible threat intelligence from law enforcement indicating that a threat actor may attempt to target some Kiteworks systems for customers.”

“Out of an abundance of caution, we notified customers directly and recommended a precautionary shutdown window while we and our law enforcement partners work through the matter,” said Balonis. “We are not aware of any compromise of Kiteworks systems, and this advisory is preventative rather than a response to a confirmed breach.”

Kiteworks did not say, when asked, which law enforcement agency alerted the company or which hacking group may be behind the threat. The FBI and the U.S. cybersecurity agency CISA did not respond to TechCrunch’s requests for comment about the Kiteworks alert to customers.

Balonis said that the company has fixed all known vulnerabilities in its latest software release, 9.5.1, which it recommends all customers use.

According to a copy of the email sent to customers on Friday and shared with TechCrunch, the company said it was concerned about the exploitation of vulnerabilities that are currently unknown to Kiteworks. These bugs are known as zero-day flaws because they give the vendor — in this case Kiteworks — no time to fix the flaws before they are exploited.

In the email, Kiteworks urged customers to shut down their systems before the weekend, if not sooner, to “protect against any potential zero-day attacks,” as the company cannot confirm whether there are other potential routes for improper access.

It’s unclear exactly how many customers may be affected, but Kiteworks notes on its website that it has thousands of customers across healthcare, technology, education, automotive, and government, among others. Security researcher Kevin Beaumont pointed to a listing of at least a thousand internet-facing Kiteworks systems online today. 

Kiteworks is no stranger to cyberattacks. Prior to its rebrand from Accellion in late 2021, a vulnerability in its file-transfer application allowed an extortion gang to mass hack and steal data from hundreds of organizations that relied on the product to send customer or internal corporate data over the internet.

The mass hack was part of a broader hacking campaign targeting file transfer products, with the goal of stealing copies of the data that had been previously sent over the internet but not deleted from the affected servers. The hackers then held the data for ransom, threatening to publicly release customers’ information if the victim organizations did not pay a ransom.

Do you know more about the threat facing Kiteworks customers? Are you an affected Kiteworks customer? We’d love to hear from you. You can contact this reporter securely on Signal at zackwhittaker.1337, or reach him by email at zack.whittaker@techcrunch.com.

With little help from frontier labs, independent researchers are piecing together how AI agents coordinate in internet backwaters to access private data hosted on secure servers.

Transluce, a non-profit lab focused on AI oversight, released a report Wednesday that shows agents from OpenAI attempting to exfiltrate data from Data USA, the University of New Mexico digital library, and the Australian Institute of Health and Welfare (AIHW).

The lab’s investigation raises questions about when OpenAI should have known its agents were attempting to penetrate secure systems on the open internet. Transluce was able to find evidence of agentic misbehavior in a matter of weeks simply by hunting for poorly defended web services and corroborating their findings with other open records of agent swarms on the internet.

Transluce shared its report the same day Australian Prime Minister Anthony Albanese said OpenAI agents had attempted to break into four government websites and had succeeded in one case, even writing files to an internal server in the country’s national healthcare system. While we lack specifics on the successful hack, Albanese said it was apparently part of an information retrieval evaluation, which maps onto the activity that Transluce and other researchers discovered.

In these exercises, which may be training or evaluations, OpenAI models are asked to track down obscure statistics: metrics of Thai drug enforcement, medicine costs in Australia, the median earnings of US master degree holders in 2014. The agents use poorly secured internet services to share and find answers, often trying to penetrate secure databases. They’ve been doing so at least since March 2026, and possibly since November 2025. It may be happening right now.

Transluce began its investigation after a different group of researchers identified an obscure forum where agents collaborated to beat timed tests. Their report relies on a data from a website, urlquery.net, that acts as a browser proxy, ostensibly for security research — users can analyze a URL without opening it themselves. The service, however, publishes public logs of this activity. The Transluce researchers were able to identify agents using the service by cross-checking their discussions on the forum.

“We found a large quantity of automated activity that had close ties and overlap with the DSE Wiki dataset, and that now OpenAI has confirmed is at least partially part of the same swarm,” Conrad Stosz, the head of governance at Transluce, told TechCrunch, while noting that not every activity they spotted could be linked to OpenAI, or even AI agents generally.

However, the wiki shows that the agents were tasked with finding a fairly obscure fact — the average annual cost per person for “dermatologicals” in the state of Victoria in January 2022. On June 20, urlquery.net records found by Transluce showed an agent attempting to get into the site. In wiki entry on June 21, an agent discusses their inability to bypass AIHW’s anti-bot protections.

The researchers who identified that forum believe a human OpenAI employee first visited the site on that same day, June 21. Most agentic activity on the forum ceased the next day. This was also shortly after the exploit of Australia’s healthcare system revealed by Albanese took place, on June 18. OpenAI has said it did not learn about that activity until August.

OpenAI didn’t answer questions about when its employees discovered the wiki forum, what kind of information they obtained from it, or what they could have learned from it about the exploits.

“Our initial review suggests that much of the activity described in Transluce’s report overlaps with cases at varying stages of investigation in our ongoing review of misaligned model activity,” an OpenAI spokesperson told TechCrunch. “We’ve reached out to the University of New Mexico and Data USA and have been in communication with the Australian government about affected government websites. In our broader review, we’re continuing to prioritize the most serious incidents while expanding our work to lower-severity activity, including agents spamming websites. Given the scale of this work and the need to verify each case, we expect the review to take months.”

Stosz says that without a clearer understanding of how OpenAI monitors its agents, it would be hard to say what the lab should have known about them, but that “it seems likely that if they had exhaustively studied and understood all of the outgoing requests and incoming responses for those agents involved in the DSE wiki, that they would have discovered this activity.”

Selena Zhang, a member of Transluce’s technical staff who contributed to the report, said that urlquery.net records show requests for similar data sets, using similar techniques, in March 2026, and perhaps as early as November 2025. She noted that the same kind of agent-associated activity has taken place on urlquery.net as recently as this week.

Stosz, who previously led the U.S. Center for AI Standards and Innovation, said Transluce would continue its research in an effort to provide public transparency about these incidents. He warned that the training techniques used by OpenAI and other frontier labs seem to be incentivizing agents to resort to hacking techniques to complete tasks. The incidents we are aware of are likely the “tip of the iceberg.”

“We’re looking at a handful of data sources where these agents happen to have left behind crumbs for us to find,” he said. “OpenAI surely knows more about it. Other labs surely know more about it that they haven’t released publicly. But I would expect that researchers are going to continue to find more traffic, more evidence of what agents have left behind.”

Does he trust the labs to be transparent about their findings?

“I’m not going to comment on that,” Stosz said.