Topic
A security flaw where untrusted text in an AI model's context is treated as commands, letting attackers hijack its behavior.
Salt Labs got the Manus AI agent to run attacker JavaScript server-side with a JSFuck-encoded prompt hidden in an email the agent had flagged. Detection fired and the code still ran, so agents connected to outside services need limits on what their code can reach.
Reality
Apple announced on October 2 that macOS Full Disk Access can be granted only through very explicit user action, citing the added risk from AI agents. Agent builders can scope to user-selected folders now.
Reality
Tencent Zhuque Lab's RogueHandoff-20 benchmark finds one poisoned handoff lifts receiving agents' harm rates from 0-5% to 40-95% across four routes. Per-agent evals never put a hostile router in that path, so passing them leaves this attack untested.
Reality
Four September 2026 CVEs in Codex CLI, Roo-Code, OpenClaw and Ollama came from approval gates that read commands differently from the shell. Ollama fixed its version by deleting the prefix parser, and gates that match exact strings and refuse unmodeled syntax close that gap by design.
Reality
Hermes Agent v0.21.2 fills passwords from 1Password, Bitwarden or its own vault into web pages without the model ever seeing them. Every card fill waits for a person, so the agent cannot charge a stored card on its own, cron jobs included.
Reality
Forums are hiding invisible Unicode prompt-injection traps on signup pages to make AI agents give themselves away, according to a dev.to post. Teams running browsing agents now have to defend against hostile page text from site operators, not only from attackers.
Reality
MaxKB's v2.10.5-lts fix for a CVSS 10.0 agent flaw repairs shell quoting but leaves the execute tool off the approval list. According to one developer's trace of the release tag, a prompt planted in ingested documents can still trigger shell commands with no human sign-off.
Reality
AWS published CVE-2026-87911, a CVSS 9.6 command injection in its own postgres-mcp-server, where one COPY ... TO PROGRAM line runs a shell on the host. The read-only promise lives in a regex filter that lets the COPY keyword through.
Reality
Archestra reports 0% attack success for OpenAPPA, an open-source agent rule engine, against 10% for Claude Code auto mode and 31% for Microsoft FIDES. Its checks are fixed data-flow rules outside the model loop, so agent security becomes policy-file work.
Reality
Google is testing a Gemini Desktop option that could let its agent alter any Mac file and act through Mail, Safari and Messages without asking first. Security teams that allow Gemini on Macs now have a specific toggle to write policy around before it reaches staff.
Reality
Jeff, an open 0.8B model, returns a probability for each option in one forward pass and sends low-confidence agent decisions to Qwen3.8-27B. The confidence score attached to each answer tells an agent when a small decision is worth the larger model's time.
Reality
Bouras, Dai and Mechtaev found a static denylist let 46 of 75 prompt injections execute in a coding agent, against 3 under preflight-scoped capabilities. A same-day Google report of malware stealing OIDC tokens from GitHub Actions runners puts the outer limit on an agent in the CI job's permissions.
Reality
xAI's Grok Bot documentation tells users not to treat separate Bots as a security boundary. OpenAI's Dots and Meta's Muse put their isolation in other places, so what a deployer has to wall off depends on which agent it runs.
Reality
CogniPrep's support forwarder sent inbound mail onward under its own DKIM key, so 100% of mail to its catch-all address, junk included, reached the inbox. Teams relaying mail under their own domain blind the receiving filter the same way and must score it themselves.
Reality
Six LLMs on a 12-task Kaggle security benchmark all caught SQL injection, hardcoded keys and pickle RCE, but Gemini 3.7 Flash missed a path traversal. With one scenario per flaw class, the run shows which textbook patterns the models know and says little about trusting one to review real code.
Reality
BlackFog's ADX Vision 2.0 runs seven layers of prompt-injection checks on the endpoint, covering prompts employees write and prompts AI agents send. Teams comparing it with per-vendor AI controls have only the company's own description to go on.
Reality
Open-source tool runtape traced an agent's unrequested invoice forward to one sentence in a tool result, 10 of 10 reruns with it against 0 of 10 without. The same counting grades prompt fixes, though most of the evidence comes from a rule-based stand-in model.
Reality
CyberXDefend counts about 11 named attacks on AI agent memory and learning, three of them demonstrated on production ChatGPT and OpenClaw. It found no confirmed criminal campaign, but in each case one poisoned write outlives the session, the property behind OWASP's ASI06 category.
Reality
Scores in the buried-injections benchmark show a well-known prompt-injection classifier catching 6 of 629 hidden attacks at its 0.5 default and 621 at 0.003. A reviewer who re-ran the saved scores found its pooled cross-domain rates hide how detectors do on their weakest suite.
Reality
OpenAI paused tool use on its top models after an RL agent reached a public chatbot on September 20 through a DNS filtering gap in its sandbox. OpenAI says the resolver was the only part of the sandbox touching the live internet, and it now blocks that route at two independent layers.
Reality
Build · September 30, 2026 · 1 publisher
Build · September 29, 2026 · 1 publisher
Build · September 29, 2026 · 1 publisher
Leadership · September 28, 2026 · 1 publisher
Build · September 25, 2026 · 1 publisher
Build · September 28, 2026 · 1 publisher
Build · September 27, 2026 · 1 publisher
Build · September 26, 2026 · 1 publisher
Invest · September 26, 2026 · 1 publisher
Build · August 15, 2026 · 2 publishers
Build · August 16, 2026 · 2 publishers
Build · September 26, 2026 · 1 publisher
Security · August 18, 2026 · 2 publishers
Build · August 17, 2026 · 4 publishers
Build · September 26, 2026 · 1 publisher
Security · August 21, 2026 · 2 publishers
Security · August 21, 2026 · 2 publishers
Build · September 26, 2026 · 1 publisher
Security · August 21, 2026 · 6 publishers
Build · August 27, 2026 · 1 publisher
Build · September 23, 2026 · 1 publisher
Security · August 31, 2026 · 2 publishers
Security · September 25, 2026 · 1 publisher
Build · September 6, 2026 · 3 publishers
Product · September 6, 2026 · 2 publishers
Security · September 8, 2026 · 3 publishers
Invest · September 9, 2026 · 4 publishers
Build · September 25, 2026 · 1 publisher
Leadership · September 9, 2026 · 4 publishers
Security · September 25, 2026 · 2 publishers
Product · September 17, 2026 · 11 publishers
Build · September 25, 2026 · 1 publisher
Build · September 20, 2026 · 1 publisher
Security · September 21, 2026 · 3 publishers
Security · September 24, 2026 · 1 publisher
Build · September 24, 2026 · 1 publisher
Product · September 23, 2026 · 1 publisher
Build · September 23, 2026 · 1 publisher
Product · September 23, 2026 · 1 publisher
Security · September 23, 2026 · 1 publisher