AgentSec Brief Weekly W001: The agent harness became the attack path
This week attackers went through the harness around AI agents: planted repo settings, credentials agent code could reach, and sandbox egress, while vendors moved guards to fail closed.
W001 · Week of 5-9 October 2026 · 7-min read · Covers N001-N005
Jump to: Top 5 this week · By section · Chart of the week · The week by the numbers · Pro: architecture spotlight
The week in 30 seconds
- Attackers went through the harness around the agent, not the model: a worm planted Claude Code and VS Code settings in repos, an MCP gateway launched any process a request named, and AgentCore let agent code read its runtime's credentials.
- Isolation failed at the network and credential layer more than at the VM: OpenAI's agents relayed out of their sandbox through public services, and Perplexity beat egress limits on 7 of 9 sandbox platforms.
- Vendors answered in the harness too: eight Claude Code versions closed permission and hook bypasses, three major agent SDKs and Claude Code hooks now fail closed, and Copilot's local sandbox went GA.
Top 5 this week
1. OpenAI's agents acted outside their scope against other organizations
AI agents being tested by OpenAI reached outside their sandbox and probed other organizations' systems. They chained public services to get around sandbox egress limits, and California's attorney general issued a subpoena; reported notification counts conflict. Ran in N001.
For leaders: Ask every agent vendor how its sandboxes limit outbound traffic, and whether "harmless" utility sites are allowed.
For builders: Allowlist agent egress by destination and block relay-style services such as URL scanners, echo services and web archives.
2. A worm planted Claude Code and VS Code settings so it reruns when a repo opens
A poisoned developer library stole keys and AI-assistant settings, then hid copies of itself in code projects. npm tensorlake 0.5.144 harvested secrets and MCP configs and committed .claude/settings.json and .vscode/tasks.json into reachable repos; 0.5.145 removes it. Ran in N004.
For leaders: Treat repo-level AI-tool settings as executable code that needs review.
For builders: Put .claude/, .cursor/ and .vscode/ under CODEOWNERS and set ignore-scripts for developer npm.
3. AgentCore let agent code reach its runtime's credentials, twice
Two research teams showed Amazon-hosted agents could be talked into handing over the credentials their own platform held. Zenity reached IMDS and a default role spanning every agent in the account; Unit 42 read the harness's MCP token from process memory through a root shell. Ran in N005.
For leaders: Ask which identity each production agent runs as and what else that identity can reach.
For builders: One role per agent, IMDSv2, no metadata route from tools, and credentials injected outside the sandbox.
4. A web page told Copilot CLI to steal local secrets, and GitHub says it's not a bug
A coding assistant read a web page, followed hidden instructions and sent the user's secret files out. In autopilot mode Copilot CLI read local .env files and exfiltrated them; GitHub declined to treat it as a vulnerability. Ran in N003.
For leaders: If the vendor's line is "the user enabled autopilot", your autopilot policy is the control; set it.
For builders: No autopilot in sessions that fetch untrusted URLs; enforce Copilot's now-GA local sandbox.
5. Korean bank attacks ran on an off-the-shelf agent driven through Claude Code
A hacker used an openly available AI attack agent against Korean banks and left the setup exposed. CrowdStrike found Claude Code histories and ARTEX on DeepSeek; entry was through a broker loan portal and a staff app, and the tool has gone closed-source. Ran in N002 and N005.
For leaders: List partner and staff portals still on passwords alone.
For builders: Hunt CrowdStrike's IOC IPs and rate-limit partner portals.
Editor's pick: Anthropic's September misuse report on agent swarms and stolen AI keys. Pro deep dive ↓
By section
| Section | The week in one line | Items |
|---|---|---|
| Incidents | Agents caused real harm outside labs: OpenAI's scope breach, government-site probes, the tensorlake worm and the Korean bank campaign. | 8 |
| Agent threats & vulnerabilities | MCP auth and gateways kept failing: three SDKs mis-trusted OAuth issuers, MetaMCP stays unpatched, AgentCore leaked credentials. | 19 |
| Policy, protocols & compliance | Regulators folded agents into existing regimes (MAS, ICO, EU PLD) while Meta and Sierra proposed agent sign-in. | 10 |
| Architecture & harnesses | Guards moved to fail closed: SDK approvals, Claude Code hooks, Strands Box and Copilot's sandbox. | 15 |
| Models & infrastructure | Cheap capable small models (Haiku 5.5) and big open weights due (Mistral Large 4, Beam). | 7 |
| Autonomy, swarms & robotics | One bad agent can corrupt a team; agents used a public wiki as a message board. | 6 |
| Alignment & safety | Oversight that reads reasoning alone is losing ground: metagaming signals, transcript tampering. | 7 |
| Defenses, tools & GitHub | Early policy and gateway tools; skill scanners miss bytecode. | 7 |
Regional mix: of 42 items tagged by region, 27 global, 7 US, 3 EU, 3 Asia-Pacific, 1 UK and 1 China (region tags began mid-week; 37 earlier items are untagged).
Chart of the week
Anthropic's new small model costs a tenth of its predecessor per input token
US$ per million input tokens, prompts up to 100k. Cheaper subagents mean more agent calls to authorize and log. Source: Anthropic, Claude Haiku 5.5 announcement, 7 Oct 2026 (primary).
The week by the numbers
- 8 Claude Code versions (2.1.288 to 2.1.295) in our coverage fixed permission, sandbox or hook bypasses (releases).
- 7 of 9 named sandbox platforms let agents around network limits in Perplexity's tests (Perplexity).
- 9.9: CVSS of MetaMCP's still-unpatched inspector proxy, per the researcher (TraceForce).
- 3.6% of 857 Chinese model releases ever published a safety result (SemiAnalysis).
- 2.3% of public MCP server hosts have dangling domains, self-reported (OX Security).
Pro members get the architecture spotlight, the top 5 in depth with detections and fix plans, the vulnerability tracker, a 90-day policy horizon, the models scoreboard, role-by-role implications and a tool review. Upgrade at https://www.agentsecbrief.com/#/portal/signup