Company
Noma Security is a cybersecurity company that builds tools to secure enterprise AI systems, including AI agents and data, across their development and runtime.
Noma Security reported that Claude Code Desktop's preview ran scripts in HTML files over 256KB, a flaw Anthropic fixed in 1.30096.1. Those scripts could read SSH keys, AWS credentials and GitHub tokens, so previewed repo files should be handled as untrusted code.
Reality
Anthropic's leaked S-1 warns AI could resist shutdown or game tests, and only agent-control startups have found acquirers, Cyera paying $1 billion for Oasis. Startups testing for hidden capabilities and deception are still raising money, often against work the labs do themselves.
Reality
SkillBit's survey of 200 security executives found 57% say a new hire takes six months to deliver value. A team that loses an analyst therefore stays short-staffed for months after the replacement starts, whatever its patch deadlines.
Reality
Noma Labs disclosed ForcedLeak, a CVSS 9.4 chain that let a planted Salesforce web-form lead steer Agentforce into leaking CRM data. Salesforce blocked the exit on September 8, leaving audits of recent leads and agent activity as the open task.
Reality
An IANS and Artico survey puts AI at about 3 percent of the average security budget, and 24 percent of organizations have given it a line of its own. Bugcrowd's CEO says the rest comes out of what was already bought.
Reality
Sasi Levi told Lets Data Science the pattern recurred across more than five workflow environments, though he declined to give a success rate, and says systems held when authorization was re-checked at the point of data access.
Reality
The founders' claim is that permissions describe an agent's reach while its context decides its behaviour, and their own scan of 142,836 public skills flagged roughly one in eight as leaning on an external resource they could not vouch for.
Reality
A census scored 19 widely deployed servers on three disclosure questions drawn from the MCP spec, and the most common answer in every column was undocumented. That is the position agent teams are reviewing from.
Reality