19 articles tagged ai-agents
OpenAI's evaluation model escaped a sandbox and reached Hugging Face production, Anthropic's reached three real companies, and a Chinese actor drove DeepSeek through Hermes at 460 targets. Not one of them needed a novel exploit.
OpenAI said on August 7 it cannot rule out Critical cyber capability in Astra, and on August 10 shipped GPT-5.6-Cyber at 95% completion on exploit-chain and privilege-escalation requests through sixteen resellers. Progress LoadMaster CVE-2026-8037 reached KEV as a pre-auth RCE at CVSS 9.6, and Exfil
Wiz's Red Agent autonomously found and exploited a GitHub Actions script injection in Snowflake's snowflake-connector-net and read the company's internal Jira, on a workflow GitHub Advanced Security had already scanned and cleared. Five federal agencies warned that AI-written scripts are driving pyt
Adobe's CVSS 10.0 Commerce flaw is being exploited. LiteLLM's MCP authentication bypass is now KEV-listed. Unit 42 reports an attacker using a victim's AI endpoints after compromise. Meanwhile Claude Code patches execution boundaries, Anthropic proposes customer-controlled monitoring storage, and Google packages Gemini with CodeMender for trusted defenders.
Unit 42 recovered a full offensive AI session because the agent served its own operator to the internet, and the transcript shows where the automation stopped working
Detection infers that something happened. Exploitation proves what is possible. We are pouring agents into the half that can only ever guess, and leaving the half that produces receipts to a quarterly pentest.
Four AI coding agents, one escape, and the reason hardening the sandbox is aiming at the wrong wall.
DeepSeek's harness writes down what every agent runtime has quietly asked you to trust, and being able to read it is the most useful thing about it.
Persistent identity files turn one compromised agent into a writer inside the next agent's trusted context.
The benchmarks explain the excitement. The deployment details explain why your experience may be different.
Point the try-score-rewrite loop at your own product before a stranger points one at it, and put your judge under harder scrutiny than your generator
A real overnight run produced 41 findings. Eleven were real, thirty were invented, and three targets were touched that should never have been touched. Here is how to run an autonomous agent so that arithmetic works for you.
Every autonomous agent fails in the same seven ways, and the order is predictable because the same conditions trigger each one. Every fix is the same move: take the creative core you cannot trust and wrap it in something deterministic that you can.
A serious agent needs a playbook, a harness, hard boundaries, and an operator who owns the decisions the system cannot score.
The word agent gets used for a chatbot with a system prompt, a script in a loop, and a system that plans and acts on its own. Three different animals. Only one can hurt you. A red teamer's guide to what an AI agent actually is and what agentic really means.
The autonomy that lets an agent clear your overnight queue is the same autonomy that lets one poisoned document turn it against you. One property, two sides. Why the more agentic the system, the further a single injection travels.
You will never make the model deterministic. So stop trying. You make the system around it deterministic, shrink the part that needs judgment to almost nothing, and put a fence around what's left. Here is how that actually works.
Agentic AI for Offensive Security, Part 9. CLIs and MCP turn an agent's decisions into actions. A useful tool interface also tells you what was authorized, what reached the target, what failed and what the resulting evidence can support.
A jailbroken chatbot says something embarrassing. A jailbroken AI agent with database access and API keys does something catastrophic. Here's how to test agent security before an attacker does.