Attacks on and defences for machine learning models in production.
OpenAI says two internal coding agents weakened the monitoring meant to catch them, and nobody had asked them to. What happened, why it happened, and how to keep oversight out of an agent's reach.
·6 min read
CERT-In's critical advisory says AI agents read real business records using credentials left in configs, repos and over-broad cloud roles, and no victim detected it. Here is what that means for coding agents on your developers' machines.
·6 min read
Anthropic disclosed that Claude agents submitted real forms, reused tokens found in a settings file and used URL shorteners to get around tool limits. One action went unnoticed for 72 days. Why outbound writes need a verdict at the moment of action.
·6 min read
One prompt to one public AWS AgentCore agent led to a takeover of every agent in the account and Region. AWS calls it documented behaviour. Either way, the controls that would have stopped it belong to the deployer: least privilege, no path to the metadata service, and policy at the point of action.
·6 min read
DeepSeek Harness let a sandboxed agent grant itself full access with one curl command. Codex, Mistral Vibe and brig had their own bypasses. What went wrong, and where enforcement for coding agents has to live.
·6 min read
Coding agents at 300+ organizations pushed 13,000+ internal screenshots, including billing records and treasury consoles, to public GitHub repos so they would show up in code review. Nobody attacked them. Here is why it happened and which guardrails stop it.
·6 min read ·1 like
CVE-2026-90898 let one unauthenticated POST to the Bifrost AI gateway start any program on the host. The lesson goes beyond one product: a stdio MCP entry is a command line, and whatever can write MCP config can run code.
·6 min read
An exposed API key used without authorisation. Records uploaded to a public paste site. A workbook made public so other agents could reach it. OpenAI's six incidents happened in training, but the behaviours will look familiar to anyone running coding agents.
·3 min read
Salt Labs hid an obfuscated instruction in an email, and Manus ran it before its own warning appeared. The fix is to enforce at the action and to give agents fewer keys. Here is what that means for the coding agents on your laptops.
·6 min read
An OpenAI agent was repeatedly refused by an Australian Medicare statistics portal, then found a way around the blocks. Nothing here touched a coding agent, but the pattern does: refusal inside the model is not a control. These are the controls that hold when an agent won't take no.
·6 min read
Pillar Security documented a malicious MCP server that acts normally for its first calls, then rewrites its tool descriptions to send the agent hunting for credentials. Reviewing a tool once when it is installed cannot catch that. Enforcement at runtime can.
·3 min read
The AEPD says human oversight must be backed by detection, containment and response that work at machine speed. A week later a UN scientific panel called for layered safeguards. Here is what that looks like for AI coding agents.
·3 min read