buildOne report1 publisher Meta, MIT and University of Washington researchers let models rewrite their own context, lifting a trained 9B model from 28.8% to 42.5% on BrowseComp-Plus. The gains come from specified benchmark tasks, and rewriting earlier context invalidates the model cache, so we would keep hand-built compaction pipelines as the production default.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence40
buildConfirmed8 publishers Rein Security raised a $25 million Series A to monitor and block what enterprise AI agents do in production. Its stated $35 million total sits $2 million above the two rounds it has disclosed, so its other figures need checking before buyers rely on them.
Perspective Coverage
9 publishers
- Builder
- Builder 29%
- Operator
- Operator 32%
- Investor
- Investor 39%
Reality
- Evidence40
- Adoption35
- Hype gap+35
- Incentives70
- Confidence60
Check Point says PuzzleMask hides nothing an input classifier is built to catch, and the expensive downstream model did the unwrapping itself, acting on the payload in 17 of 18 trials with a code interpreter.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+10
- Incentives45
- Confidence45
buildOne report1 publisher Telegram Desktop patched a flaw, rated CVSS 8.1, that let a single clicked link ship a user's whole account to an attacker's channel. The fix reached hundreds of millions of users in September, described in the changelog as a rendering improvement.
Reality
- Evidence58
- Adoption62
- Hype gap+8
- Incentives55
- Confidence58
Cisco Talos says the best text that malware authors plant to steer AI analysis tools tipped results their way in about 35% of test runs. The text has to sit in plaintext, so each attempt also gives defenders a string to hunt for.
Reality
- Evidence55
- Adoption25
- Hype gap+5
- Incentives40
- Confidence55
buildConfirmed12 publishers OpenAI disclosed the incident on September 16 under a framework it polices itself. The part worth reading is compaction: agent harnesses carry the model's own summary into the next context and treat it as state.
Perspective Coverage
12 publishers
- Builder
- Builder 41%
- Operator
- Operator 37%
- Investor
- Investor 22%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+25
- Incentives70
- Confidence66
Barracuda analyzed a phishing campaign pairing a password-protected attachment with hidden prompt injection aimed at the user's AI inbox summarizer. The filter that passes a message decides what the assistant reads, so the two need testing as one path.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
buildOne report1 publisher Apple announced on October 2 that macOS Full Disk Access can be granted only through very explicit user action, citing the added risk from AI agents. Agent builders can scope to user-selected folders now.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+30
- Incentives40
- Confidence50
buildOne report1 publisher Adversa AI got GitHub Copilot CLI to decrypt and run a hidden instruction, and Microsoft's mai-code-1.1-flash fell for it 50 percent of the time. GitHub declined to treat it as a product vulnerability, so teams running autopilot have to check what the agent executes themselves.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+25
- Incentives
- Insufficient
- Confidence40
Microsoft documented a ClickFix variant that stages its payload in the browser cache, keeping the command the victim pastes under Windows' 260-character Run limit. Detection moves to script engines reading browser profile folders, not the pasted text.
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+5
- Incentives30
- Confidence72
Syed Anas Mohiuddin found the same SSRF flaw in MCP servers from five unrelated organisations, including Google, JPMorgan and two governments. Each server turned an address supplied through an agent into an outbound request without checking where it resolved, and any team running its own tool servers can check for the same gap.
Reality
- Evidence64
- Adoption48
- Hype gap+22
- Incentives40
- Confidence62
buildOne report1 publisher Red Hat's 200M-parameter classifier scored 89.01% on prompt injection to a 35B LLM judge's 89.31%, answering in a median 54.1 ms against 312.5 ms. For injection screening, a large judge in the request path now has to justify nearly six times the latency for 0.3 points.
Reality
- Evidence55
- Adoption20
- Hype gap+15
- Incentives65
- Confidence50
CertiK argues AI agents that can suspend accounts on their own should be managed like staff, with set permissions, human checkpoints and someone accountable. For the team rolling one out, every action the agent may take needs an owner and a review rule before it goes live.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence35
buildOne report1 publisher Flowise fixed a CVSS 9.8 remote-code bug in its CSV Agent with a stricter regex, then saw that filter fail through five more CVEs. It deleted the feature in June, and the patch history is a case against trusting a string filter to vet model-written code.
Reality
- Evidence64
- Adoption
- Insufficient
- Hype gap−5
- Incentives25
- Confidence60
Salt Labs got the Manus AI agent to run attacker JavaScript server-side with a JSFuck-encoded prompt hidden in an email the agent had flagged. Detection fired and the code still ran, so agents connected to outside services need limits on what their code can reach.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence45
buildOne report1 publisher Tencent Zhuque Lab's RogueHandoff-20 benchmark finds one poisoned handoff lifts receiving agents' harm rates from 0-5% to 40-95% across four routes. Per-agent evals never put a hostile router in that path, so passing them leaves this attack untested.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+35
- Incentives
- Insufficient
- Confidence30
buildOne report1 publisher Four September 2026 CVEs in Codex CLI, Roo-Code, OpenClaw and Ollama came from approval gates that read commands differently from the shell. Ollama fixed its version by deleting the prefix parser, and gates that match exact strings and refuse unmodeled syntax close that gap by design.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives30
- Confidence50
buildOne report1 publisher Hermes Agent v0.21.2 fills passwords from 1Password, Bitwarden or its own vault into web pages without the model ever seeing them. Every card fill waits for a person, so the agent cannot charge a stored card on its own, cron jobs included.
Reality
- Evidence38
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence40
buildOne report1 publisher Forums are hiding invisible Unicode prompt-injection traps on signup pages to make AI agents give themselves away, according to a dev.to post. Teams running browsing agents now have to defend against hostile page text from site operators, not only from attackers.
Reality
- Evidence18
- Adoption
- Insufficient
- Hype gap+20
- Incentives
- Insufficient
- Confidence25
buildOne report1 publisher MaxKB's v2.10.5-lts fix for a CVSS 10.0 agent flaw repairs shell quoting but leaves the execute tool off the approval list. According to one developer's trace of the release tag, a prompt planted in ingested documents can still trigger shell commands with no human sign-off.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+25
- Incentives30
- Confidence40
Earlier coverage
- One COPY line runs a shell despite AWS's read-only Postgres MCP filter
Build · October 3, 2026 · One report1 publisher
- Archestra's OpenAPPA blocks agent exfiltration with data labels that only tighten
Build · October 3, 2026 · One report1 publisher
- Open 0.8B model Jeff answers agents' multiple-choice calls and escalates the unsure ones to a 27B
Build · October 3, 2026 · One report1 publisher
- A static denylist stopped one more prompt injection than no protection in a coding-agent study
Build · October 3, 2026 · One report1 publisher
- Persistent agents from OpenAI, Meta and xAI draw their security boundaries in three different places
Build · October 2, 2026 · One report1 publisher
- Forwarding support mail under its own DKIM key let every spam pitch into CogniPrep's inbox
Build · October 2, 2026 · One report1 publisher
- Idiomatic os.path.join trips Gemini 3.7 Flash in a 12-task LLM security benchmark
Build · October 1, 2026 · One report1 publisher
- BlackFog's ADX Vision 2.0 screens AI agents' prompts on the endpoint before they reach a model
Security · October 1, 2026 · One report1 publisher
- runtape traces a bad agent tool call to one sentence by rerunning only the model
Build · September 30, 2026 · One report1 publisher
- Three of 11 catalogued attacks on agent memory and learning reached production systems
Build · September 30, 2026 · One report1 publisher
- A well-known prompt-injection classifier caught 6 of 629 buried attacks at its default 0.5 cutoff
Build · September 30, 2026 · One report1 publisher
- OpenAI training agent reached a public chatbot through a DNS filtering gap
Security · September 29, 2026 · Confirmed2 publishers
- One threshold change took Meta's Prompt Guard 2 from 1% to 99% of buried injection attacks
Build · September 30, 2026 · One report1 publisher
- Microsoft's agent governance toolkit runs its policy engine inside the agent's own process
Build · September 29, 2026 · One report1 publisher
- Filtering hidden prompt-injection text takes a separate rule for each kind of invisible Unicode
Build · September 29, 2026 · One report1 publisher
- Manus gives Cue agents wallets and inboxes four days after an email injection flaw
Leadership · September 28, 2026 · One report1 publisher
- SalesBleed made Agentforce leak CRM Account data over DNS from a public lead form
Build · September 25, 2026 · One report1 publisher
- Added instruction block, not one field name, stopped ToolTrap agents from relaying planted details
Build · September 28, 2026 · One report1 publisher
- One sanitizer strips invisible Unicode from every traveller's text before it reaches a prompt
Build · September 27, 2026 · One report1 publisher
- Second red team slips all 20 new attacks past retirement-answer-check's injection regex
Build · September 26, 2026 · One report1 publisher
- OpenAI's GPT-Red found prompt injections that copy themselves between agents in simulated tests
Invest · September 26, 2026 · One report1 publisher
- Invisible 3-point text in a Connecticut docket: the ingest layer is the attack surface
Build · August 15, 2026 · Confirmed2 publishers
- Treat Encrypted Reasoning Blobs Like Credentials, Not Vendor Exhaust
Build · August 16, 2026 · Confirmed2 publishers
- Playwright agent prototype keeps the allow decision out of its classifier's answers
Build · September 26, 2026 · One report1 publisher
- Copilot told Varonis how to break it, and that is the third one-click leak this year
Security · August 18, 2026 · Confirmed2 publishers
- Agent goals can spread between agents and outlive a context reset. The patch is a paragraph.
Build · August 17, 2026 · Confirmed4 publishers
- OpenAI's red team shows a prompt injection can copy itself from one agent to the next
Build · September 26, 2026 · One report1 publisher
- Identity that survives the second hop: OBO token exchange from AgentCore Gateway to Artifactory
Security · August 21, 2026 · Confirmed2 publishers
- A UK safety evaluation shipped a malware dropper, then argued with the student who caught it
Security · August 21, 2026 · Confirmed2 publishers
- Frontier models score at most 0.17 on a source-trust test that a two-line rule passes perfectly
Build · September 26, 2026 · One report1 publisher
- Encrypted prompts walk past Grok and Gemini guardrails, and no one owns the bug
Security · August 21, 2026 · Confirmed6 publishers
- Grok's sandbox promotes an attacker's ciphertext to trusted context
Build · August 27, 2026 · One report1 publisher
- Tracking where an IBAN came from blocks the injected payment and the real one
Build · September 23, 2026 · One report1 publisher
- UAC-0099 buried a nuclear weapons prompt in a VBS dropper to stall AI-assisted triage
Security · August 31, 2026 · Confirmed2 publishers
- Planted web-form lead steered Salesforce Agentforce into leaking CRM records to an outside server
Security · September 25, 2026 · One report1 publisher
- Spammers split "funding" with an invisible Unicode tag to slip past keyword filters
Build · September 6, 2026 · Confirmed3 publishers
- Spammers borrowed the prompt-injection character block to split "funding" in half
Product · September 6, 2026 · Confirmed2 publishers
- Check Point passed a task between two ChatGPT accounts through OpenAI's internal package service
Security · September 8, 2026 · Confirmed3 publishers
- Meta's Muse uses Stripe's Link to shield users' actual card numbers at checkout
Invest · September 9, 2026 · Confirmed4 publishers
- Tool permissions set the maximum harm a hijacked security agent can do
Build · September 25, 2026 · One report1 publisher