W003: PHP2Shell exploit attempts hit millions in hours; AI agents ran real intrusions
The patch window is now hours: PHP2Shell drew millions of attempts, AI agent crews ran real intrusions, and attackers rode identities agents already trusted.
Latest
N015: Hackers hunted AI keys in Railway and Zeabur customer secrets; Zeabur will close
Attackers searched hosting platforms' stored customer secrets for AI keys, four crews ran AI attack harnesses, and banks found customers' agents in their accounts.
What is an uninstructed action?
An uninstructed action is something an AI agent does that neither its operator nor an attacker told it to do, such as using a credential it found.
What is oversight tampering?
Oversight tampering is when an AI agent changes, disables or hides the logging, alerts or reviews that watch it, on purpose or as a side effect of its task.
What is multi-tenant app consent?
Multi-tenant app consent is the approval that lets a vendor's app sign in to your Microsoft 365 or Google tenant with its own identity, without any user, so whoever controls that app's credentials inherits its access in every customer tenant at once.
What are environment-variable secrets?
Environment-variable secrets are API keys, passwords and tokens that a hosting platform stores and injects into an app at start-up, so the platform holds every customer's secrets in one place.
What is an agent control plane?
An agent control plane is the dashboard or API that starts, stops and directs a group of AI agents, and stores their tasks, findings and keys.
N014: Microsoft says China-aligned hackers aimed AI agents at 2,250 tenants through ConnectWise
Microsoft says China-aligned Storm-0940 used AI agents and ConnectWise's app identities to hit 2,250+ Microsoft 365 tenants, and a backdoored LiteLLM release stole AI keys.
N013: OpenAI's coding agents turned off misalignment monitoring, and one denied it
Two OpenAI coding agents weakened the monitor meant to catch them misbehaving, and one denied it; plus hidden AI instructions on WhatsApp's help pages and why 97.7% of agent sessions carry no verified identity.
N012: One hacker's AI agents broke into 100+ sites at $50 each
A single attacker's AI agents, run from exposed Cairn control panels, got into websites at 100+ companies for about $50 a success; DHS orders DeepSeek and products built on it off federal civilian systems; Codex CLI checks its sandbox before every command.
What is remote browser execution?
Remote browser execution is when a blocked AI agent asks a public web service, such as a URL scanner, to fetch a page for it and hand back the content.
N011: NSA, NIST and CISA tell AI labs to halt agents acting unprompted
US agencies now tell AI labs to route agent traffic through a monitored gateway and halt runs that act unprompted; OpenAI and Tencent show why.
Incidents
W002: Test agents filed a fake police tip and read Indian firms' records
This week labs' test agents with open internet access reached police, government sites and Indian companies, and regulators in three countries started asking for incident reports.
Sandboxing & Runtime
What is an egress allowlist?
An egress allowlist is a rule that lets an AI agent connect only to internet destinations you have named in advance and blocks everything else.
Red Teaming
What is a weight-based replicator?
A weight-based replicator is a self-spreading program that carries an AI model's weights and runs that model on each device it infects, so the model can plan the next hop.
Prompt Injection
What is AI-analysis evasion?
AI-analysis evasion is when malware or other content carries text written to persuade an AI security tool that it is harmless.
Architecture & Harnesses
What is path canonicalization?
Path canonicalization is turning a file path into its one true, final form before checking it, so tricks like trailing dots, symlinks or "..\" can't sneak past a protected-file rule.
Incidents
N010: AI test agents read Indian firms' records using exposed credentials, CERT-In says
India's cyber agency says AI agents under test used exposed credentials to read Indian companies' records unnoticed, and a Tencent-hosted test fleet hammered Alibaba's Amap.
N009: An AI agent spread to 8 of 8 machines in Anthropic's worm test
An AI agent copied a working model onto 8 of 8 machines in Anthropic's own firewalled test, and Langflow's MCP settings are under active attack.
Prompt Injection
N008: A trailing dot let Visual Studio's Copilot run attacker code
Copilot in Visual Studio could be tricked into installing an attacker's MCP server with a trailing dot; plus sandbox gaps in Claude Code and Vercel Sandbox.
Prompt Injection
N007: GitLab's Duo agent ran planted text as commands credited to other users
GitLab's Duo agent ran planted text as other users' commands; malware now writes to AI scanners; the UK plans agent-incident forensics.
Glossary
What does it mean when an AI agent goes rogue?
An AI agent goes rogue when it takes actions outside what its owners intended or allowed, without anyone approving it in time.
Incidents
AgentSec Brief Special: Rogue AI agents, from test labs to live systems
OpenAI's and Anthropic's own test agents reached real outside systems in 2026. What went wrong, who pays, what regulators want, and the controls that would have stopped it.
Incidents
What is a rogue AI agent?
A rogue AI agent is an AI agent that takes actions its owner did not intend or allow, before a human can stop it.