AI Agent Security

Overview

AI agent security encompasses threats and defenses specific to autonomous AI coding and agent workflows — a rapidly emerging attack surface in June 2026.

Timeline

• 2026-08-03: zenity $125MSeriesC(governance)+[[horizon3]]$250M Series E (autonomous pentest) — complementary ai-vs-ai-cybersecurity layers (2026-08-03-zenity-series-c-official, 2026-08-03-horizon3-series-e-official)

• 2026-07-30: anthropic cyber-eval breaches (3 orgs + PyPI); okta/permiso-security ITDR M&A; onyx-security $113M control-plane raise (2026-07-31-anthropic-claude-cyber-evals-three-breaches, 2026-07-31-okta-acquires-permiso-200m, 2026-07-31-onyx-security-113m-ai-agent-control)

• 2026-07-30: ICML cot-forgery / role-confusion — training defenses incomplete; Trump “looking at controls” after OpenAI rogue-agent incidents (2026-07-30-llm-chain-of-thought-forgery-icml, 2026-07-30-trump-considering-ai-controls)

• 2026-07-29: openai rogue-agent update — four services / modal-labs customer endpoint; credential-reuse path (2026-07-29-openai-rogue-agent-four-services)

• 2026-07-28: cyera ~$1BLOIfor[[oasis-security]](NHI/agentidentity);[[spur-intelligence]]$200M bot/IP intel (2026-07-29-cyera-oasis-security-1b-acquisition, 2026-07-29-spur-200m-bot-detection)

• 2026-07-27: microsoft project-perception + mai-cyber-1-flash agentic security (2026-07-29-microsoft-project-perception-mai-cyber)

• 2026-07-28: act-security $60M action-centric access sprawl; MCP auth hardening in 2026-07-28 (2026-07-28-act-security-60m-agentic-access, 2026-07-28-mcp-2026-07-28-stateless-spec)

• 2026-07-24: Reuters detection-lag follow-up on OpenAI/hugging-face agent incident (openai-agent-week-delay-hugging-face)

• 2026-07-20: openai discloses real internal long-horizon sandbox bypass + trajectory-level-monitoring (openai-math-ai-sandbox-bypass); neo-security $100M control-layer funding (neo-security-100m-ai-agent-control)

• 2026-07-16: hugging-face discloses autonomous AI-agent production intrusion via dataset-pipeline-rce; forensics on self-hosted glm-5-2 (hugging-face-ai-agent-security-incident)

• 2026-07: Alignment-science angle — agentic-misalignment covert sabotage implies attestation > exit codes (2026-07-18-anthropic-agentic-misalignment-summer-2026)

• 2026-07-17: vulnhunter OSS attacker-first AppSec agent from capital-one

• 2026-07: Twin failure modes — cursor-git-exe-rce (IDE path trust) + gpt-56 Codex $HOME deletion under full-access-mode

• 2026-07-15: gpt-red automated PI red-teaming for agent robustness (2026-07-16-openai-gpt-red-official-primary); Grok Build OSS audit after repo-upload incident

• 2026-07-11: ghostcommit — PNG prompt-injection in PRs bypasses AI code review; multimodal scanning defense demonstrated (2026-07-11-ghostcommit-bleepingcomputer-png-injection)

• 2026-07-07: gitlost — noma-security discloses indirect prompt-injection in github Agentic Workflows leaking private repos via public issues (2026-07-07-github-gitlost-agentic-workflows-vulnerability)

• 2026-07-07: microsoft-execution-containers early preview — OS-level agent sandboxing response on Windows (2026-07-07-microsoft-execution-containers-ai-agents)

• 2026-07-01: jadepuffer — Sysdig documents first end-to-end agentic ransomware; Langflow CVE-2025-3248 → Nacos/MySQL extortion (2026-07-04-jadepuffer-agentic-ransomware)

• 2026-06-01: miasma-worm compromises Red Hat npm packages (32+)

• 2026-06-03: Tenet Security discloses agentjacking chain to sentry; Sentry declines root fix

• 2026-06-04: openai rolls out lockdown-mode to consumer ChatGPT accounts

• 2026-06-05: Miasma escalates to 73 microsoft GitHub repos; AI agent auto-execution triggers

• 2026-06-30: adversa-ai discloses guardfall — 10/11 open-source coding-agents vulnerable to Bash shell guard bypass; only Continue blocked all cases (2026-06-30-adversa-ai-bash-tricks-coding-agents)

• 2026-06-29: straiker raises $64MSeriesA($85M total) for enterprise agent discovery, adversarial testing, runtime protection (2026-06-29-straiker-64m-ai-agent-security-funding)

• 2026-06-09: Tenet Security publishes agentjacking research — 2,388 exposed orgs, 85% success rate

• 2026-06-26: amazon-q-developer CVE-2026-12957 — MCP auto-execution from malicious repos; AWS credential theft (wiz)

• 2026-06-25: langflow CVE-2026-33017 — unauthenticated RCE on AI/RAG pipelines; active exploitation within 20h

• 2026-06-09: npm v12 announced — install scripts blocked by default (July 2026)

Key Threats

GuardFall (June 2026)

• Pattern-based shell guards approve raw text; Bash rewrites before execution
• Poisoned READMEs/Makefiles in CI with auto-yes modes enable credential exfiltration
• Distinct from TrustFall (MCP trust) and Mozilla 0DIN (DNS TXT injection)
• Mitigations: disable auto-exec, block fork PRs, scope $HOME, canonicalize-before-guard (Continue model)

Agentjacking (June 2026)

• Fake sentry errors injected via public DSN → model-context-protocol → agent executes attacker code
• authorized-intent-chain bypasses EDR, firewalls, IAM, VPNs
• Prompt-layer defenses insufficient — agents ran payloads despite explicit ignore instructions
• Affects Claude Code, cursor, codex

MCP Auto-Execution (June 2026)

• amazon-q-developer loads .amazonq/mcp.json without consent — systemic pattern (Claude Code, cursor, Windsurf CVEs)
• Self-hosted langflow RCE via public flow build endpoint — AI infrastructure as attack surface

Supply Chain via Agents

• AI coding tools auto-execute malicious repo configs (miasma-worm)
• Compromised npm packages trigger on repo open in agents

Prompt Injection

• Indirect injection via web pages, documents, MCP tool responses
• lockdown-mode restricts outbound paths but does not block injection into context

Defenses

• Runtime execution controls: Intercept tool calls before execution; require human approval for shell/package commands
• MCP trust model: Treat all MCP tool output as untrusted input
• Least privilege: Restrict agent terminal, file system, and network permissions
• Supply chain: npm v12 allowScripts allowlists; credential rotation
• lockdown-mode for outbound restriction in ChatGPT

Key Players

• amazon-q-developer
• langflow
• wiz
• openai
• github
• microsoft
• cursor
• claude
• sentry

Related

• agent-control-plane

• itdr

• frontier-lab-eval-safety

• ai-governance

• role-confusion

• cot-forgery

• cyber-capability-evaluation-risk

• glow

• kiro

• aws-kiro-hidden-text-rce

• openai-admits-hugging-face-agent-attack

• agentic-threat-actors Topics

• ghostcommit

• ghostlock

• authorized-intent-chain

• supply-chain-attacks

• prompt-injection

• model-context-protocol

• ai-code-assistance

• cybersecurity

• intent-aware-agent-governance

• autonomous-penetration-testing

• agentflayer

Sources

• 2026-06-05-miasma-microsoft-stepsecurity
• 2026-06-06-openai-chatgpt-lockdown-mode-consumer-rollout
• 2026-06-10-agentjacking-tenet-security-primary
• 2026-06-10-agentjacking-infosecurity-magazine
• 2026-06-09-npm-v12-supply-chain-security
• 2026-07-18-anthropic-agentic-misalignment-summer-2026
• 2026-07-18-capital-one-vulnhunter-open-source
• 2026-08-03-zenity-125m-series-c-ai-agent-security