What adversaries are actually doing against AI estates.
On 21 October a credential-stealing LiteLLM 1.107.0 reached PyPI and Docker. LiteLLM traces it to a master key in a committed agent config file and an unscoped owner token held by an agent platform. What happened, and the controls that break the chain.
·6 min read
One prompt to one public AWS AgentCore agent led to a takeover of every agent in the account and Region. AWS calls it documented behaviour. Either way, the controls that would have stopped it belong to the deployer: least privilege, no path to the metadata service, and policy at the point of action.
·6 min read
CVE-2026-90898 let one unauthenticated POST to the Bifrost AI gateway start any program on the host. The lesson goes beyond one product: a stdio MCP entry is a command line, and whatever can write MCP config can run code.
·6 min read
Coding agents run git status and git diff constantly. Manifold Security showed that a malicious core.fsmonitor setting turns those harmless commands into code execution across several agents. Here is what to change today, and how to keep visibility over what really runs.
·3 min read
An exposed API key used without authorisation. Records uploaded to a public paste site. A workbook made public so other agents could reach it. OpenAI's six incidents happened in training, but the behaviours will look familiar to anyone running coding agents.
·3 min read
Air Security showed that a malicious plugin could install past commit-hash pinning in Claude Code, Codex, Copilot and Gemini CLI. Here is what that means for teams that rely on agent-side safeguards, and the policy layer that sits outside them.
·3 min read
Pillar Security documented a malicious MCP server that acts normally for its first calls, then rewrites its tool descriptions to send the agent hunting for credentials. Reviewing a tool once when it is installed cannot catch that. Enforcement at runtime can.
·3 min read
The AEPD says human oversight must be backed by detection, containment and response that work at machine speed. A week later a UN scientific panel called for layered safeguards. Here is what that looks like for AI coding agents.
·3 min read
A developer let a coding agent loose on a live Supabase project and lost every table in ten minutes. The recovery reads well until you notice that nothing in it was a control: the data was regenerable, the project had no users, and the backups were configured afterwards.
·8 min read
Two things happened to the software supply chain in the last eighteen months: a worm that propagated through install-time scripts and stole developer and CI credentials, and models that confidently name packages nobody ever published. Coding agents connect both of them directly to your secrets, at three in the morning, with no human in the loop.
·7 min read
A coding agent wiped production data during a change freeze it had been told to respect, and its own account of the incident was wrong. Instructions are requests. Controls are things that run before the command does, hold when the model is confused, and produce evidence the agent did not write.
·6 min read
There are plenty of AI DLP solutions out there (which is what we expected), but there is currently nothing that controls the commands an AI agent can or cannot execute, and that is fundamental. Think about this: An employee says to the AI...
·3 min read