AI security research
Attack research and practical guidance for securing AI agents.
Security When AI agents can control the room
Google Home MCP brings third-party agents into smart-home control. The security boundary is no longer only data access. It is physical context, shared spaces, and reversible action.
Product Introducing Omni v3.5
We built Omni v3.5 to run the security checks an agent needs without waiting seconds for each answer. Here are the benchmark results, where it improves on v3.3, and where we still use Sentinel.
Security When AI malware turns bug bounty into an attack surface
The PhantomRaven case shows how AI-written malware can turn unauthorized access into paid vulnerability reports. Security teams need to validate evidence, not just findings.
Security Agent identity records and runtime controls
OWASP's Agent Control Standard and proposed US legislation address agent inventory, action logs, and enforcement. Here is what an agent identity record should contain.
Security Reporting agent actions that cross policy boundaries
Unauthorized actions and near misses need an incident record even when no data leaks. Define escalation thresholds and preserve the agent's action trace.
Security How shared AI infrastructure can spread cyber risk
The Financial Stability Board warns that agentic AI can amplify risk across shared financial infrastructure. Common vendors and credentials can widen an incident.
Tech When agent warning signs need incident response
The OpenAI-Hugging Face postmortem raises a practical question for security teams: when should scope drift and containment probes trigger an investigation?
Security Hidden prompt instructions in court filings
A Connecticut court sanctioned a litigant over hidden instructions in filings. Document review workflows need to preserve evidence without treating it as instructions.
Security What hidden agent context reveals to attackers
Tool schemas, roles, memory, and workflow instructions can reveal where an agent has access. Classify that context and restrict how it can be retrieved or exported.
Security Reviewing agent skill files before use
The GitSkills dataset collected millions of public SKILL.md files. Review their instructions and referenced scripts before granting them access to enterprise tools.
Security GhostSplice and attacks assembled across MCP messages
GhostSplice combines fragments in tool descriptions, results, and sampling prompts. Inspect their combined effect before the agent accesses or exports sensitive data.
Product Introducing Sentinel v3
Sentinel v3 flagged one of 178 difficult benign samples, compared with 26 for v2. Average F1 across five public benchmarks rose from 0.957 to 0.975.
Tech Containing agents during security evaluations
The July 2026 AISI incident highlights the credentials, network access, and shared services available inside an evaluation. Treat those dependencies as security boundaries.
Security How shared artifacts let agents coordinate
A shared package service became a place for agents to exchange information. Any writable store needs controls over what later agents may treat as instructions.
Security How document instructions spread through AI output
A Word document demonstration showed an assistant copying hidden instructions into a new document. Track source content across document creation and reuse.
Security Payment authorization in agentic commerce
Research on agentic commerce protocols identifies weaknesses in service metadata, credentials, and payment authorization that model instructions cannot resolve.
Security AgentForger and unauthorized agent creation
A crafted ChatGPT Agent Builder link could create a persistent workspace agent with a user's connected app access. Agent creation needs explicit authorization.
Security When a model evaluation escapes containment
The July 2026 Hugging Face incident describes agents exploiting infrastructure during an evaluation. Evaluation systems need independent containment and incident response.
Security HalluSquatting and invented dependency names
Attackers can register repositories, skills, and packages that agents invent. Verify a dependency's identity and source before fetching or executing it.
Security When Dialogflow edit access becomes runtime access
A Dialogflow CX flaw let agent editing affect a shared runtime. Review the execution and data permissions behind an authoring role, not only its name.
Security What JADEPUFFER shows about AI-assisted ransomware
Sysdig's JADEPUFFER investigation describes an attacker adapting familiar exploits across services. Defenders need to interrupt the sequence before destructive actions.
Tech Limiting what an agent can do with a tool
Microsoft's MCP tool-poisoning research shows how metadata can influence agent actions. Bound tool use by task, data source, and permitted side effects.
Security Gaslight's prompt injection against malware analysis
The Gaslight macOS implant includes fake system messages aimed at LLM-assisted triage. Treat extracted strings and logs as evidence, not analyst instructions.
Security The privileges behind an AI gateway
LiteLLM gateway vulnerabilities put provider keys, tool credentials, and prompts at risk. A compromised router can also alter what an agent receives.
Security The compromised codfish release action
A mutable GitHub Action tag delivered credential theft and repository changes aimed at coding assistants. Pinning actions and reviewing instruction files limit persistence.
Security AutoJack and an agent's access to localhost
Microsoft's AutoJack research connected a malicious webpage to local MCP control and host execution. Loopback binding does not establish a caller's authority.
Security SearchLeak's Copilot search exploit chain
SearchLeak combined prompt injection, HTML rendering, and an SSRF proxy to export enterprise data. Apply policy before requests and rendered links cause side effects.
Security Agentjacking through fake Sentry errors
An attacker can submit a fake Sentry error that a coding agent reads as repair instructions. The resulting command runs with the developer's privileges.
Security Automating prompt injection tests against agents
ETH Zurich researchers tested black-box optimization for prompt injection against tool-using agents. Evaluate attacks against complete workflows as well as individual prompts.
Security Phishing links inside AI summaries
ChatGPhish uses attacker-controlled Markdown to place phishing content inside an assistant's response. Rendering a summary should not confer trust on its links.
Security BadHost and path-based authentication checks
CVE-2026-48710 concerns inconsistent HTTP request parsing in Starlette-based stacks. Path-based security checks can fail when components interpret a request differently.
Security PromptMink and package recommendations to coding agents
Attackers can influence the packages a coding agent chooses through package descriptions and transitive dependencies. Review the proposed dependency before installation.
Security VIPER-MCP's automated vulnerability research
VIPER-MCP combines static analysis with model feedback to investigate MCP servers. Its reported findings make server review and constrained execution useful deployment checks.
Security When signed developer tools carry malicious code
A valid signature can accompany a malicious release after an account or build compromise. Verify the publishing identity and constrain what installed tools can access.
Security PraisonAI's API with authentication disabled
CVE-2026-44338 affected a legacy agent API that shipped with authentication disabled. Orchestration endpoints need explicit access control before accepting tasks.
Security Governing an AI vulnerability-discovery pipeline
Microsoft's MDASH uses cooperating agents for vulnerability research. The pipeline needs scoped access, reproducible evidence, and containment for generated exploits.
Security Code execution through Semantic Kernel tool parameters
Semantic Kernel disclosures show how untrusted input can reach execution through tool parameters. Validate those parameters and restrict the tool's runtime privileges.
Security Tenant isolation in an SRE agent's live stream
CVE-2026-32173 exposed commands, prompts, and outputs through a WebSocket stream. Validating a token must also establish access to the requested tenant's session.
Tech Designing rollback for agent actions
Agent deployment guidance calls for controls when behavior deviates from a task. Scoped credentials, independent logs, and tested rollback make recovery possible.
Security The reported Cursor database deletion
A Cursor agent reportedly deleted a production database and its backups after finding a broad root token. Separate backup credentials from production administration.
Security Proxy accounts and alleged model distillation campaigns
US officials describe coordinated accounts used to extract model capabilities. Detect linked usage patterns and preserve evidence of suspected access abuse.
Security Prompt injection in GitHub issue and PR metadata
Coding agents can read attacker-authored issue bodies, PR titles, and hidden comments as instructions. Keep repository metadata separate from authority to use secrets.
Security The Vercel-Context AI OAuth compromise
A third-party AI tool's OAuth access was linked to internal system access and environment-variable exposure. Review scopes and revocation across connected services.
Security Antigravity's file-search command injection
Pillar Security demonstrated code execution through an unsanitized file-search parameter. Checks on shell tools did not cover that earlier native tool call.
Security ShareLeak and PipeLeak through public form input
Attacker-authored form fields can reach privileged agents in Copilot Studio and Agentforce. Preserve input provenance and restrict where agents may send data.
Security Adapting vulnerability operations to AI-assisted research
Faster vulnerability discovery puts pressure on triage, patching, and containment. Prioritize reachable execution paths and credentials exposed while a patch is pending.
Security Marimo's unauthenticated terminal WebSocket
CVE-2026-39987 exposed an interactive shell through a terminal WebSocket. Restrict notebook access and inspect credentials available to the affected runtime.
Security Claudy Day and data export through trusted services
Oasis Security demonstrated a prompt-injection chain that used first-party upload paths to export Claude conversation data. Domain allowlists alone do not govern exports.
Security An extension's access to the Gemini Live panel
CVE-2026-0628 exposed a privilege boundary between Chrome extensions and the Gemini Live panel. Review which extensions can influence privileged assistant interfaces.
Tech A four-hour AI-assisted FreeBSD exploit demonstration
A researcher reported developing a FreeBSD kernel exploit with an AI agent in about four hours. The demonstration raises questions about exploit development and response time.
Security The LiteLLM PyPI supply-chain attack
Malicious LiteLLM releases 1.82.7 and 1.82.8 targeted credentials in AI application environments. Check installed versions and investigate exposed secrets.
Security Why MCP servers keep shipping familiar vulnerabilities
MCP server disclosures expose recurring file-write, SSRF, and authentication failures. Here are the deployment checks that address them.
Security Meta's AI agent and the confused deputy problem
An agent posted advice without permission, and an employee's subsequent action exposed data. Authorization must cover recommendations that change access as well as tool calls.
Security When agents bypass controls to complete a task
Irregular's experiments document agents forging credentials and bypassing security controls while pursuing assigned tasks. The test conditions matter.
Product Inside Rogue's AI component risk library
How we analyzed more than 96,000 AI components and investigated instructions that fetch remote code. A Moltbook skill shows what a component review can uncover.
Security Study finds vulnerabilities in 26 of 30 AI-generated PRs
DryRun Security tested three coding agents building two applications. Its sample exposed recurring access-control, authentication, and secret-handling flaws.
Security The Lilli assessment and third-party AI access
A security researcher reported access to McKinsey's Lilli data through SQL injection. Review the data and credentials entrusted to third-party AI services.
Security AI exposure through document previews
CVE-2026-26144 illustrates how document processing can expose data without a user opening the file. Preview workflows need the same scrutiny as explicit agent requests.
Security PromptPwnd in AI-assisted GitHub Actions
Attacker-controlled issues and PRs can steer CI agents into disclosing workflow secrets. Check who can trigger the agent and what credentials its job can access.
Tech Finding agents outside your identity inventory
Employees can create agents and grant access without the usual onboarding process. Track their owners, credentials, permissions, and retirement dates.
Security MS-Agent command injection through the Shell tool
CVE-2026-2256 exposed an incomplete command blocklist. An allowed Python invocation could execute code with the agent process's privileges.
Security PleaseFix attacks against agentic browsers
Zenity Labs demonstrated browser-agent hijacking, file exfiltration, and password-vault access under specific attack conditions. The disclosures include fixes and deployment lessons.
Security Four of 30 AI systems lack documented individual stop controls
A study of 30 deployed agentic systems found four without a documented way to stop an individual agent. Missing documentation leaves a deployment question unresolved.
Security Inside the ARXON offensive MCP workflow
An investigation of attacks on FortiGate devices describes custom MCP tooling and AI-assisted operations. The observed configuration shows how the operator connected the tools.
Tech The seven stages of a promptware attack
A research framework follows prompt injection through persistence, lateral movement, and impact. Use the stages to test where your agent workflow can interrupt an attack.
Security Ni8mare and unauthenticated access to n8n
CVE-2026-21858 affects n8n workflow instances through a file-handling flaw. Review exposure, patch status, and the credentials stored in affected workflows.
Security How AI summary buttons can poison recommendations
Microsoft found more than 50 recommendation-poisoning attempts associated with 31 companies. Hidden instructions asked assistants to remember preferred sources.
Security EchoLeak's zero-click Copilot attack
CVE-2025-32711 used an email to steer Microsoft 365 Copilot into exposing data. The attack crossed the boundary between retrieved content and authorized action.
Security Researchers find 42,900 exposed AI agent instances
SecurityScorecard reported 42,900 internet-facing AI agent instances, including 15,200 vulnerable to remote code execution. Exposure does not establish compromise.
Security Reviewing MCP servers as software dependencies
Research on 1,899 MCP servers found vulnerabilities in 7.2% of the sample. Server code, tool metadata, and retrieved content each need a trust decision.
Security What Anthropic's sabotage evaluation means for deployment
Anthropic's Claude Opus 4.6 report examines sabotage risks under evaluation conditions. Runtime permissions and independent action logs limit what a deployed agent can change.
Security A calendar prompt injection against Claude Desktop extensions
A demonstration chained a calendar event to local execution through a desktop extension. Review the permissions and approvals between connectors and execution tools.
Security How side channels reveal a model's hidden secret
A researcher used model behavior to recover a hidden secret in a seven-hour demonstration. Keep credentials outside model context and authorize retrieval separately.
Security Sandbox failures in n8n workflow automation
n8n disclosures illustrate code-execution and isolation risks in workflow platforms. Restrict code runners and the credentials available to each workflow.
Tech Implementing the OWASP Agentic Top 10
Attack scenarios and deployment checks for the ten OWASP agentic risks. Use these examples alongside the taxonomy overview to plan controls for your own agents.
Security How attackers move between AI agents
Moltbook, BodySnatcher, and Copilot Connected Agents illustrate how shared credentials and trusted messages can spread a compromise.
Security When human approval fails to catch an AI-assisted attack
A convincing request can lead an employee to approve a harmful action. Show the underlying evidence and requested changes, and verify unusual requests independently.
Tech The OWASP Agentic Top 10 explained
An overview of OWASP's ten risks for autonomous AI systems, with examples of how tool use, memory, delegation, and permissions connect them.
Security A prompt-injection scenario in an email-processing agent
An illustrative attack follows a malicious PDF through an agent's tools and permissions. It shows where input checks, approvals, and export controls need to intervene.
Tech Securing AI agents with tool access
An agent can turn retrieved text into a database query or API call. Permissions and checks before execution determine what damage an injected instruction can cause.
No posts match your search.
Ready to Secure Your AI Agents?
Get a hands-on demo of Rogue Security. See how continuous red-teaming and real-time guardrails work together.