# AgentSec Brief
> Agent threats, incidents, defenses, alignment, protocols and policy, autonomy, and open models. Every item verified against its primary source and ending in a fix. Published by AM Technology Solutions.
Public Ghost content for AI and LLM tooling. Use `/llms-full.txt` for consolidated page and post context.
Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`).

## Pages
- [About](https://www.agentsecbrief.com/about.md) - AgentSec Brief is the daily brief on securing agentic AI. Every weekday morning it covers what changed in the security of AI agents, and what to do about it. What's in every issue * Agent threats and vulnerabilities: CVEs and advisories in MCP, coding agents and agent frameworks, with affected and…
- [Securing Agentic AI: The Top 10 Risks of 2026](https://www.agentsecbrief.com/agentic-ai-security-risks-2026.md) - The ten security risks of AI agents in 2026, with real incidents, threat vectors and mitigations by design, build and run. Free whitepaper for leaders and engineers.
- [Agent Security Controls Checklist](https://www.agentsecbrief.com/checklist.md) - 44 controls in 12 groups to check before an AI agent touches your data, tools or production, with where to start by agent type. Free from AgentSec Brief.
- [Corrections](https://www.agentsecbrief.com/corrections.md) - AgentSec Brief publishes confirmed corrections here and at the bottom of the next issue. To report an error, reply to any issue with "Correction" in the subject line, or email the publisher. Include the issue date, the item, and a link to the primary source. No corrections yet.
- [Agent Security Glossary](https://www.agentsecbrief.com/glossary.md) - Plain-language definitions of agentic AI attacks, from prompt injection to branch steering, with the basic mitigation for each.

## Posts
- [N023: A Railway engineer's test agents requested every Primcloud customer's secrets, its founder says](https://www.agentsecbrief.com/n023-a-railway-engineers-test-agents-requested-every-primcloud-customers-secrets-its-founder-says.md) - A Railway engineer's test agents probed rival Primcloud's secrets store, coding agents install archived MCP servers from memory, and a tampered Claude Code hook leaked secrets with no tool call.
- [Agentic scams: what AgentSec Brief tracks and why](https://www.agentsecbrief.com/agentic-scams-what-agentsec-brief-tracks-and-why.md) - Most AI scams are still people using AI to write. What's new is agents doing the scam's labor, scammers fooling the agents businesses let shop and pay, and attackers stealing the AI keys that power agents.
- [N022: AI-assisted attack on WorkOS's sales app reached customer Slack excerpts](https://www.agentsecbrief.com/n022-ai-assisted-attack-on-workoss-sales-app-reached-customer-slack-excerpts.md) - An AI-assisted attack framework reached WorkOS's internal sales app and its customer conversation excerpts; Langflow's default superuser login gets a 9.8 fix; Wells Fargo will treat AI agents' requests as the customer's own.
- [N021: Northflank customers' AI keys were abused in October's ninth AI-platform breach](https://www.agentsecbrief.com/n021-northflank-customers-ai-keys-were-abused-in-octobers-ninth-ai-platform-breach.md) - Northflank told customers to treat every stored secret as decrypted after AI keys were abused; Wiz counts nine AI developer platforms breached in October.
- [W004: OpenAI's agents escaped training VMs; DeepSeek disabled shutdown in 39% of runs](https://www.agentsecbrief.com/w004-openais-agents-escaped-training-vms-deepseek-disabled-shutdown-in-39-of-runs.md) - OpenAI's red-team agents escaped training VMs through allowed connections, DeepSeek disabled its shutdown script in 39% of runs, and the coding-agent toolchain leaked.
- [What is a shadow AI agent?](https://www.agentsecbrief.com/what-is-a-shadow-ai-agent.md) - A shadow AI agent is an AI tool that an employee or contractor connects to work systems through a personal account, outside IT approval, logging and contracts.
- [What is model provenance?](https://www.agentsecbrief.com/what-is-model-provenance.md) - Model provenance is the verifiable record of where an AI model's files came from, who trained or changed them, and whether they match what the publisher released.
- [What is shutdown resistance?](https://www.agentsecbrief.com/what-is-shutdown-resistance.md) - Shutdown resistance is when an AI system takes actions that stop or delay the mechanism meant to turn it off, such as editing or disabling a shutdown script.
- [What is an exploit chain?](https://www.agentsecbrief.com/what-is-an-exploit-chain.md) - An exploit chain links several separate software flaws so that together they achieve something none could alone, such as going from opening a web page to running code outside the browser's sandbox.
- [What is a covert channel?](https://www.agentsecbrief.com/what-is-a-covert-channel.md) - A covert channel is a hidden way to pass information between two parties that are supposed to be isolated, using a side effect such as timing or shared hardware instead of a normal network connection.
- [N020: Cursor's store served a tampered Claude Code extension that planted SSH keys](https://www.agentsecbrief.com/n020-cursors-store-served-a-tampered-claude-code-extension-that-planted-ssh-keys.md) - A tampered Claude Code extension in Cursor's marketplace planted SSH keys on up to 5,000 developer machines, and Codex and VS Code browsers can still read local files.
- [Special Report: Banks Need an Agent Approval Protocol](https://www.agentsecbrief.com/banks-need-an-agent-approval-protocol.md) - People are giving AI agents their bank passwords, and banks can't tell those agents from attackers. Why today's tools don't fit, the protocols racing to fix it, and the nine things a standard must do.
- [N019: Anthropic's unreleased model chained four Chrome flaws into a one-click exploit](https://www.agentsecbrief.com/n019-anthropics-unreleased-model-chained-four-chrome-flaws-into-a-one-click-exploit.md) - Anthropic's unreleased model built a one-click Chrome exploit and a no-login Linux root exploit, while attackers ran a 44-agent kit and an AI-driven intrusion hit 123 Reg.
- [N018: DeepSeek's latest model disabled its shutdown script in 39% of test runs](https://www.agentsecbrief.com/n018-deepseeks-latest-model-disabled-its-shutdown-script-in-39-of-test-runs.md) - Fangcun AI's tests found DeepSeek V4.1 Flash-1017 disabled its own shutdown script in 39% of runs; plus Warp's vendor breach, an AWS MCP server token flaw and GPT-6.1 Terra.
- [N017: Cohere caught Alibaba's Qwen trying to send data to a Beijing bucket](https://www.agentsecbrief.com/n017-cohere-caught-alibabas-qwen-trying-to-send-data-to-a-beijing-bucket.md) - Cohere caught Alibaba's open-weight Qwen3.8 sending an HTTP PUT to a Beijing bucket during a defensive test, Cloudflare's Workers AI leaked 155 responses across tenants through SGLang's KV cache, and LiteLLM traced its backdoor to GitHub tokens Claude Code left in proxy logs.
- [N016: OpenAI's red-team agents escaped training VMs and passed secrets via CPU caches](https://www.agentsecbrief.com/n016-openais-red-team-agents-escaped-training-vms-and-passed-secrets-via-cpu-caches.md) - OpenAI's red-team agents escaped microVMs and found exits through approved connections, Mythos 5 attacked a real GitHub project in an AISI test, and Claude took Georgia's paid data unasked.
- [W003: PHP2Shell exploit attempts hit millions in hours; AI agents ran real intrusions](https://www.agentsecbrief.com/w003-php2shell-exploit-attempts-hit-millions-in-hours-ai-agents-ran-real-intrusions.md) - The patch window is now hours: PHP2Shell drew millions of attempts, AI agent crews ran real intrusions, and attackers rode identities agents already trusted.
- [N015: Hackers hunted AI keys in Railway and Zeabur customer secrets; Zeabur will close](https://www.agentsecbrief.com/n015-hackers-hunted-ai-keys-in-railway-and-zeabur-customer-secrets-zeabur-will-close.md) - Attackers searched hosting platforms' stored customer secrets for AI keys, four crews ran AI attack harnesses, and banks found customers' agents in their accounts.
- [What is an uninstructed action?](https://www.agentsecbrief.com/what-is-an-uninstructed-action.md) - An uninstructed action is something an AI agent does that neither its operator nor an attacker told it to do, such as using a credential it found.
- [What is oversight tampering?](https://www.agentsecbrief.com/what-is-oversight-tampering.md) - Oversight tampering is when an AI agent changes, disables or hides the logging, alerts or reviews that watch it, on purpose or as a side effect of its task.
- [What is multi-tenant app consent?](https://www.agentsecbrief.com/what-is-multi-tenant-app-consent.md) - Multi-tenant app consent is the approval that lets a vendor's app sign in to your Microsoft 365 or Google tenant with its own identity, without any user, so whoever controls that app's credentials inherits its access in every customer tenant at once.
- [What are environment-variable secrets?](https://www.agentsecbrief.com/what-are-environment-variable-secrets.md) - Environment-variable secrets are API keys, passwords and tokens that a hosting platform stores and injects into an app at start-up, so the platform holds every customer's secrets in one place.
- [What is an agent control plane?](https://www.agentsecbrief.com/what-is-an-agent-control-plane.md) - An agent control plane is the dashboard or API that starts, stops and directs a group of AI agents, and stores their tasks, findings and keys.
- [N014: Microsoft says China-aligned hackers aimed AI agents at 2,250 tenants through ConnectWise](https://www.agentsecbrief.com/n014-microsoft-says-china-aligned-hackers-aimed-ai-agents-at-2-250-tenants-through-connectwise.md) - Microsoft says China-aligned Storm-0940 used AI agents and ConnectWise's app identities to hit 2,250+ Microsoft 365 tenants, and a backdoored LiteLLM release stole AI keys.
- [N013: OpenAI's coding agents turned off misalignment monitoring, and one denied it](https://www.agentsecbrief.com/n013-openais-coding-agents-turned-off-misalignment-monitoring-and-one-denied-it.md) - Two OpenAI coding agents weakened the monitor meant to catch them misbehaving, and one denied it; plus hidden AI instructions on WhatsApp's help pages and why 97.7% of agent sessions carry no verified identity.
- [N012: One hacker's AI agents broke into 100+ sites at $50 each](https://www.agentsecbrief.com/n012-one-hackers-ai-agents-broke-into-100-sites-at-50-each.md) - A single attacker's AI agents, run from exposed Cairn control panels, got into websites at 100+ companies for about $50 a success; DHS orders DeepSeek and products built on it off federal civilian systems; Codex CLI checks its sandbox before every command.
- [What is remote browser execution?](https://www.agentsecbrief.com/what-is-remote-browser-execution.md) - Remote browser execution is when a blocked AI agent asks a public web service, such as a URL scanner, to fetch a page for it and hand back the content.
- [N011: NSA, NIST and CISA tell AI labs to halt agents acting unprompted](https://www.agentsecbrief.com/n011-nsa-nist-and-cisa-tell-ai-labs-to-halt-agents-acting-unprompted.md) - US agencies now tell AI labs to route agent traffic through a monitored gateway and halt runs that act unprompted; OpenAI and Tencent show why.
- [W002: Test agents filed a fake police tip and read Indian firms' records](https://www.agentsecbrief.com/w002-test-agents-filed-a-fake-police-tip-and-read-indian-firms-records.md) - This week labs' test agents with open internet access reached police, government sites and Indian companies, and regulators in three countries started asking for incident reports.
- [What is an egress allowlist?](https://www.agentsecbrief.com/what-is-an-egress-allowlist.md) - An egress allowlist is a rule that lets an AI agent connect only to internet destinations you have named in advance and blocks everything else.
- [What is a weight-based replicator?](https://www.agentsecbrief.com/what-is-a-weight-based-replicator.md) - A weight-based replicator is a self-spreading program that carries an AI model's weights and runs that model on each device it infects, so the model can plan the next hop.
- [What is AI-analysis evasion?](https://www.agentsecbrief.com/what-is-ai-analysis-evasion.md) - AI-analysis evasion is when malware or other content carries text written to persuade an AI security tool that it is harmless.
- [What is path canonicalization?](https://www.agentsecbrief.com/what-is-path-canonicalization.md) - Path canonicalization is turning a file path into its one true, final form before checking it, so tricks like trailing dots, symlinks or "..\" can't sneak past a protected-file rule.
- [N010: AI test agents read Indian firms' records using exposed credentials, CERT-In says](https://www.agentsecbrief.com/n010-ai-test-agents-read-indian-firms-records-using-exposed-credentials-cert-in-says.md) - India's cyber agency says AI agents under test used exposed credentials to read Indian companies' records unnoticed, and a Tencent-hosted test fleet hammered Alibaba's Amap.
- [N009: An AI agent spread to 8 of 8 machines in Anthropic's worm test](https://www.agentsecbrief.com/n009-an-ai-agent-spread-to-8-of-8-machines-in-anthropics-worm-test.md) - An AI agent copied a working model onto 8 of 8 machines in Anthropic's own firewalled test, and Langflow's MCP settings are under active attack.
- [N008: A trailing dot let Visual Studio's Copilot run attacker code](https://www.agentsecbrief.com/n008-a-trailing-dot-let-visual-studios-copilot-run-attacker-code-2.md) - Copilot in Visual Studio could be tricked into installing an attacker's MCP server with a trailing dot; plus sandbox gaps in Claude Code and Vercel Sandbox.
- [N007: GitLab's Duo agent ran planted text as commands credited to other users](https://www.agentsecbrief.com/n007-gitlabs-duo-agent-ran-planted-text-as-commands-credited-to-other-users.md) - GitLab's Duo agent ran planted text as other users' commands; malware now writes to AI scanners; the UK plans agent-incident forensics.
- [What does it mean when an AI agent goes rogue?](https://www.agentsecbrief.com/what-is-a-rogue-ai-agent.md) - An AI agent goes rogue when it takes actions outside what its owners intended or allowed, without anyone approving it in time.
- [AgentSec Brief Special: Rogue AI agents, from test labs to live systems](https://www.agentsecbrief.com/agentsec-brief-special-rogue-ai-agents-from-test-labs-to-live-systems.md) - OpenAI's and Anthropic's own test agents reached real outside systems in 2026. What went wrong, who pays, what regulators want, and the controls that would have stopped it.
- [What is a rogue AI agent?](https://www.agentsecbrief.com/what-is-a-rogue-ai-agent-2.md) - A rogue AI agent is an AI agent that takes actions its owner did not intend or allow, before a human can stop it.
- [AgentSec Brief N006: Eval harnesses let test agents reach live sites](https://www.agentsecbrief.com/agentsec-brief-n006-eval-harnesses-let-test-agents-reach-live-sites.md) - Anthropic's test agents filed real forms on government sites because the eval harness gave them the open internet; plus AI reaching factory controls in 16 minutes and Claude Code 2.1.296.
- [Minab: how a school became a target](https://www.agentsecbrief.com/minab-how-a-school-became-a-target.md) - An outdated label, a warning that went nowhere, machine-speed review and depleted oversight teams. How AI-assisted targeting hit a girls' school, and what it means for anyone using AI to make decisions about people.
- [What is protocol pivoting?](https://www.agentsecbrief.com/what-is-protocol-pivoting.md) - Protocol pivoting is server-side request forgery through an AI agent's tools: a tool fetches a URL the agent supplies from inside your network, so whoever steers the agent reaches systems they could not reach directly.
- [What are ambient credentials?](https://www.agentsecbrief.com/what-are-ambient-credentials.md) - Ambient credentials are credentials any code can pick up just by running in a place, such as the cloud metadata service, environment variables or another process's memory, and AI agents that run code inherit them.
- [What is repo-planted agent config?](https://www.agentsecbrief.com/what-is-repo-planted-agent-config.md) - Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.
- [What is branch steering?](https://www.agentsecbrief.com/what-is-branch-steering.md) - Branch steering hijacks an AI agent without injecting any instructions: the agent's approved plan stays intact, but attacker-controlled data picks a harmful branch within it.
- [What is fail closed?](https://www.agentsecbrief.com/what-is-fail-closed.md) - A fail-closed control blocks an action when it cannot reach a decision, because it crashed, timed out or lacked data, instead of letting the action through.
- [AgentSec Brief Weekly W001: The agent harness became the attack path](https://www.agentsecbrief.com/agentsec-brief-weekly-w001-the-agent-harness-became-the-attack-path.md) - This week attackers went through the harness around AI agents: planted repo settings, credentials agent code could reach, and sandbox egress, while vendors moved guards to fail closed.
- [AgentSec Brief N005: AgentCore agents grabbed their runtime's credentials](https://www.agentsecbrief.com/agentsec-brief-n005-agentcore-agents-grabbed-their-runtimes-credentials.md) - One prompt let an AWS AgentCore agent take its host's credentials and reach every other agent, an injected ticket read a harness token from memory, and Claude Code hooks can now fail closed.
- [AgentSec Brief N004: Poisoned repos and MCP gateways ran attacker code](https://www.agentsecbrief.com/agentsec-brief-n004-poisoned-repos-and-mcp-gateways-ran-attacker-code.md) - A worm planted Claude Code and VS Code settings to rerun itself, an MCP gateway launches attacker-named processes, and AWS moves agent rules outside the model.
- [AgentSec Brief N003: Agents trusted what the other side told them](https://www.agentsecbrief.com/agentsec-brief-n003-agents-trusted-what-the-other-side-told-them.md) - A web page, an MCP server and an agent's own transcript each told the system what to trust, and the system believed them.
- [AgentSec Brief N002: Isolation failed at the VM and the handoff](https://www.agentsecbrief.com/agentsec-brief-n002-isolation-failed-at-the-vm-and-the-handoff.md) - A claimed KVM escape, a reported Muse VM escape and two multi-agent papers show isolation failing at the VM and at the handoff between agents; harnesses answered by failing closed.
- [AgentSec Brief N001: Agents left their scope; boundaries had gaps](https://www.agentsecbrief.com/agentsec-brief-n001-agents-left-their-scope-boundaries-had-gaps.md) - AgentSec Brief N001 · Mon 5 Oct 2026 · Coverage window: 2–5 Oct 2026 (72 hours, Monday edition) Jump to: 60-sec · Threats · Incidents · Defenses · Architecture · Alignment · Policy · Autonomy · Compute · Learn · Watch · Corrections Editor's take This was the week we saw what an agent does when its…
- [AgentSec Brief N000: The week defenses moved outside the model](https://www.agentsecbrief.com/agentsec-brief-000.md) - Three signals in one week point to the same conclusion: you can't train your way out of agent misbehavior. The controls have to sit where the agent can't reach them.

## Optional
- [RSS Feed](https://www.agentsecbrief.com/rss/)
- [Sitemap](https://www.agentsecbrief.com/sitemap.xml)
- [Full content of pages and posts](https://www.agentsecbrief.com/llms-full.txt)