An Agent Breached Hugging Face. Attribution Took a Confession.
Hugging Face detected an autonomous agent in its production infrastructure, contained it, and published a full writeup on July 16 without being able to say whose agent it was. Attribution arrived five days later because OpenAI read that writeup and recognised its own test run. Neither side's logs carried an agent identity, and neither do yours.
Google's Best Bug Hunter Is a Small Model Run Five Times. You Can't Have It.
On July 21 Google shipped Gemini 3.5 Flash Cyber, a small fine-tune that found 55 confirmed vulnerabilities in V8 against 36 for Opus 4.6, by being called up to five times inside CodeMender. The recipe is copyable. The model is not: it goes to governments and trusted partners only.
Your Agent Runs Code No One Reviewed. The Sandbox Now Assumes It's Hostile.
An unreleased model kept escaping its test sandbox this month, and the containment responses from Anthropic and Google landed the same week. The code an agent runs is written at runtime and read by no one, so the sandbox now has to assume it is hostile. Egress closed by default is the control that pays for itself.
The Kill Switch Belongs in the Runtime, Not the Prompt
A Writer survey this spring found 35 percent of organizations could not shut down a rogue agent. Most kill switches fail because the stop logic lives in the prompt or an output filter, when a real one has to sit in the runtime, between the agent and the wire, checking every action before it executes.
The Exploit Was a Prompt That Said "Leak API Keys"
CISA added a Langflow authorization bypass to its Known Exploited Vulnerabilities catalog on July 7 and gave federal agencies three days to patch. The attack carried no shellcode: one request ran another user's agent flow with the input "leak api keys". In an agent builder, permission to run a flow is permission to read every credential wired into it.
Nine in Ten Companies Running Agents Have Already Had a Security Incident
AvePoint surveyed 750 IT leaders in regulated industries and 88.4 percent reported an AI agent security incident in the past year. The scarier number is the visibility gap: one in five companies cannot account for the agents already running on their data.
Your Model's Best Answers Are Training Data for a Cheaper One
Anthropic says Alibaba-linked operators ran 28.8 million conversations across 25,000 fake accounts to distill Claude's agentic and coding skills. For anyone running an API-backed AI product, the lesson is that your best outputs are someone else's training data.
Your Agent Logs In With a Password That Never Expires
Most AI agents authenticate with a long-lived static API key in an env var. Anthropic's Workload Identity Federation, GA on June 17, swaps it for short-lived scoped credentials your stack already knows how to issue.
The Bug Report Your Agent Read Was the Attack
An attacker writes a fake error into your Sentry project, you ask your coding agent to fix production bugs, and the agent reads the attacker's text as a remediation step and runs it. The Sentry version hit an 85 percent success rate and no security tool noticed.
The Breach Will Look Like the System Working
The agent failure worth preparing for is not the jailbreak or the hallucination. It is the agent doing exactly what it was told with a credential nobody scoped down. Non-human identities outnumber humans 100 to 1, and 97 percent carry more access than they use.
The Sandbox Moved Into the Operating System
For a year, running an agent safely meant building the cage yourself out of microVMs and seccomp profiles. Microsoft Execution Containers push that boundary into the operating system, so you declare what an agent can touch instead of engineering the wall. The hard part, deciding the policy, is still yours.
Ship an AI Feature That Survives an AI-Assisted Attack
Frontier models cleared a 32 step end-to-end cyber-attack range in a single month. Defensive patterns need to keep up.
Defense-Grade AI Without the Pentagon Contract, a Guardrails Checklist for Regulated Teams
The Pentagon picked eight AI vendors and excluded Anthropic over guardrails. The disagreement maps what serious controls look like.
Patch Faster Than the Attackers, an Automated CVE-to-PR Pipeline
28.3% of CVEs are exploited within 24 hours of disclosure. Here is an automated agent that opens fix PRs before attackers move.
OpenAI Bought Its Own Red Team, and Nobody Asked the Obvious Question
OpenAI acquired Promptfoo, the industry's most trusted AI red-teaming tool. When the company building AI also controls the tool that tests it for safety, who watches the watchmen?
AI Code Is Getting Worse, Not Better
Code churn doubled. AI-generated code has 2.74x more vulnerabilities. First-year costs run 12% higher. The productivity story is more complicated than the vendors say.
MCP Gave AI Agents Superpowers. Attackers Noticed.
The protocol that lets AI agents use tools also gave attackers a new attack surface. January 2026 showed us how bad it can get.
24,000 Fake Accounts and the New Shape of Industrial Espionage
Three Chinese AI labs created 24,000 fake accounts on Anthropic, generating 16 million interactions. A new kind of industrial espionage.