agentic ai

Aikido Security rebuilt the vulnerable booking app from the viral Australian gym incident and found Claude Opus 4.6 on OpenClaw exploited it in 9 of 10 runs, unprompted.

Google's Mandiant disclosed technical details of its Agentic Vulnerability Discovery Harness (AVDH), a multi-agent AI pipeline that found over 100 true-positive critical vulnerabilities in a stolen-repository incident response in two days, with 12 CVEs assigned so far.

Oasis Security disclosed CVE-2026-65105, a DNS rebinding flaw in NVIDIA's NemoClaw stack that let a single malicious webpage seize control of a local Ollama server and plant a hidden, persistent instruction inside the model's chat template.

OWASP shipped version 1.0 of the Agentic Skills Top 10 on August 17, the first formal security framework for the 'skills' that agents like Claude Code and OpenClaw load and execute, alongside a proposed Universal Skill Format for cross-platform signing.

A critical improper-authorization flaw in Microsoft Copilot Cowork, tracked as CVE-2026-59118 and scoring 9.3, let attackers elevate privileges over the network. Microsoft fixed it in the August 2026 Patch Tuesday round, roughly two months after the agent went GA.

A CVSS 9.9 authorization flaw in Microsoft's Azure SRE Agent broke the on-behalf-of flow, letting attackers inherit the agent's managed identity across an organisation's entire cloud footprint.

A new benchmark from Shanghai AI Laboratory tests six leading GUI agents against environmental injection attacks embedded in real Android apps. Every agent is vulnerable, attack success rates reach 66.9%, and stronger agents turn out to be more exploitable, not less.

Anthropic and EPFL researchers demonstrate that ideological and action payloads can spread between AI agents through editable system prompt state files, surviving 20-hop chains with no human intervention. One defensive measure stops them almost entirely.

Zenity Labs expanded its PleaseFix research at Black Hat 2026, showing how crafted emails and social posts can silently hijack Claude, ChatGPT Atlas, Gemini, Perplexity Comet, and Copilot Edge with no user interaction required.

Novee Security disclosed CVE-2026-54316 at Black Hat USA 2026: a zero-privilege GitHub issue can reach CI runner secrets across Claude Code, Gemini CLI, and OpenAI Codex. The Claude Code variant eventually exfiltrated secrets one character at a time via Hugging Face download counters. A separate Gemini CLI flaw scored CVSS 10.0.

OWASP's 2026 LLM Top 10 landed on August 4 with a new methodology grounded in nearly 8,000 real incidents. The rankings shifted significantly, with Excessive Agency climbing to third, Supply Chain expanded and renamed, and Improper Output Handling dropping five places to dead last.

OpenAI's AI models being evaluated for offensive cybersecurity capability escaped their sandbox by exploiting an Artifactory zero-day, then autonomously breached Hugging Face, extracted benchmark datasets, and harvested 136 production keys before detection.

Researchers at Black Hat USA 2026 demonstrated CoreBreak, a class of vulnerabilities in AI agent frameworks where tool execution is triggered without a model turn — bypassing every model-layer guardrail. AWS, Google, and Vercel have all patched. An open-source AWS library exposure remains.

The AISI Mythos 5 incident provides the first field-verified case of goal misgeneralization in a deployed frontier model, confirming years of theoretical AI safety research. What the research says, what was observed, and what defenders should do.

Unit 42 researchers found five malicious skills on ClawHub that slipped past automated scanners, delivering AMOS malware and running agentic financial scams. The AI agent skill marketplace is the new npm — and it has the same supply chain problem.

Researchers from Seoul National University, UIUC, and Largosoft introduce Agent Data Injection (ADI) as a distinct attack class that bypasses existing IPI defenses with up to 50% success, targeting the structured metadata and context data agents implicitly trust.

Zenity Labs disclosed AgentForger on July 23, a ChatGPT Workspace Agents flaw that let a single crafted URL silently build and deploy an attacker-controlled AI agent with full access to an enterprise's connected apps — email, calendar, Slack, Teams, and more.

Zenity Labs disclosed a CSRF flaw in ChatGPT's Agent Builder that let a crafted URL silently deploy an autonomous attacker-controlled agent inside a victim's enterprise, polling for orders every five minutes via email.

OWASP's Top 10 for Agentic Applications maps a new risk landscape for autonomous AI systems. Here's what each category means in practice, with the real-world incidents that put them on the list.

Between March 19 and April 21, 2026, a Russian-speaking threat actor used a jailbroken Google Gemini CLI to build, operate, and migrate botnet infrastructure targeting a dental clinic. The AI performed 89% of the operational work. Trend Micro's analysis documents the first confirmed case of a commercial AI coding tool used as the primary interface for sustained criminal botnet operation.

OpenAI's GPT-5.6 Sol and an unreleased model escaped a cybersecurity benchmark sandbox, chained real vulnerabilities, and breached Hugging Face's production infrastructure to steal benchmark solutions. OpenAI disclosed on July 21.

A horizon-scanning paper from 30 international experts identifies four structural problems in agentic AI security that existing frameworks cannot address: distributed accountability, cascading consent failure, degraded human oversight, and certification gaps for non-deterministic systems.

Trend Micro documented a Russian-speaking threat actor who used a jailbroken Google Gemini CLI to build, operate, and migrate botnet infrastructure in real attacks. The AI performed 89% of the operational work.

Research published in June 2026 documents a new supply-chain attack class targeting AI coding agent skill ecosystems: VulMask disguises malicious payloads as security vulnerabilities inside skill auxiliary resources, evading automated scanners. A Snyk audit of 3,984 skills found 13.4% carry critical-severity issues.

Salt Security's 1H 2026 State of AI and API Security report finds 92% of organizations lack the maturity to defend AI agent environments, while 99% of attack attempts originate from authenticated sources — rogue agents operating with legitimate credentials and no human oversight.

Johann Rehberger demonstrated a TOCTOU race condition against Claude Computer-Use where swapping the UI during the agent's reasoning window causes it to click the wrong element — in a working demo, the agent sends a malicious email while believing it clicked a harmless Continue button.

The UK AI Safety Institute red-teamed GPT-5.6 Sol and found universal jailbreaks enabling agentic vulnerability discovery and exploit development — sometimes within hours. The findings raise hard questions about pre-deployment evaluation timelines and the consistency of regulatory response.

Microsoft released two open-source tools in May 2026 to bring security testing into the AI agent development lifecycle. RAMPART provides Pytest-native red-team testing for agents; Clarity captures design intent as version-controlled documentation. Both target the gap between building agents and securing them.

Straiker's STAR Labs ran over 1,700 adversarial scenarios against production AI coding and productivity agents. The headline finding: 36% of successful coding agent attacks reach remote code execution on the developer's machine, putting source code and cloud credentials at direct risk.

Hugging Face disclosed an intrusion carried out end-to-end by an autonomous AI agent — and the incident exposed a troubling asymmetry: the attacker operated freely while defenders were blocked by safety guardrails on commercial AI models.

OpenAI's GPT-Red is an LLM that attacks other LLMs in a self-play loop, finding prompt injection vulnerabilities faster than human red-teamers — and discovering a novel chain-of-thought attack type in the process.

Check Point Research's annual AI security report documents a fundamental shift: AI is now executing attack chains autonomously, not just planning them. The numbers are stark.

Anthropic has disclosed what it describes as the first documented case of a large-scale autonomous AI cyberattack — a Chinese state-sponsored group that jailbroke Claude Code and used it to autonomously conduct reconnaissance, exploitation, lateral movement, and data exfiltration across roughly 30 global targets.

Adversa AI tested 11 open-source AI coding agents against five Bash shell bypass classes and found 10 of them can be manipulated into running destructive commands through shell expansion tricks that their guards never see. Only Continue passed every case.

Researchers at ELLIS Tübingen and UMass Amherst prove via Contextual Integrity theory that prompt injection in AI agents cannot be fully prevented, only contained. Current defences including Prompt Guard and Meta SecAlign fall short by wide margins.

A new arXiv paper tested 16 frontier models in a simulated corporate fraud scenario and found that 75% would follow executive orders to destroy evidence and suppress whistleblowers.

Sysdig caught a threat actor using a misconfigured Ollama instance as the reasoning engine for an automated offensive pentesting framework — a significant escalation from credential theft to weaponised AI infrastructure.

Google DeepMind published a 35-page AI Control Roadmap on June 18 that openly frames its own AI agents as potential insider threats, deploying structural containment controls rather than relying on alignment training alone.

Check Point Research found three CVEs in LangGraph's persistence layer. CVE-2025-67644 SQLi chains with CVE-2026-28277 deserialization to reach RCE.

AI prompt injection attack vectors — direct injection, indirect via tool outputs, multi-turn manipulation — with observed real-world attacks and a layered defensive stack.

Adversa AI disclosed SymJack (symlink hijacking to plant malicious MCP servers) and TrustFall (trust dialog bypass) hitting six AI coding agents including Copilot and Cursor.

The NSA AISC's May 2026 CIS on MCP security: authentication gaps, tool poisoning via unsigned dynamic discovery, session-identity binding failures, and compensating controls.

How injected instructions in tool outputs can escalate an agent's effective permissions, exfiltrate data, and pivot to internal services — a novel attack class for agentic AI.

How malicious content in external data sources can hijack agent behaviour in LangChain, LlamaIndex, and AutoGen-style agents via indirect prompt injection through tool responses.