Incidents
Anthropic's test agents filed real forms on government sites because the eval harness gave them the open internet; plus AI reaching factory controls in 16 minutes and Claude Code 2.1.296.
Deep Dive
An outdated label, a warning that went nowhere, machine-speed review and depleted oversight teams. How AI-assisted targeting hit a girls' school, and what it means for anyone using AI to make decisions about people.
Glossary
Protocol pivoting is server-side request forgery through an AI agent's tools: a tool fetches a URL the agent supplies from inside your network, so whoever steers the agent reaches systems they could not reach directly.
Glossary
Ambient credentials are credentials any code can pick up just by running in a place, such as the cloud metadata service, environment variables or another process's memory, and AI agents that run code inherit them.
Glossary
Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.
Glossary
Branch steering hijacks an AI agent without injecting any instructions: the agent's approved plan stays intact, but attacker-controlled data picks a harmful branch within it.
Glossary
A fail-closed control blocks an action when it cannot reach a decision, because it crashed, timed out or lacked data, instead of letting the action through.
Architecture & Harnesses
This week attackers went through the harness around AI agents: planted repo settings, credentials agent code could reach, and sandbox egress, while vendors moved guards to fail closed.
Agent Identity & Auth
One prompt let an AWS AgentCore agent take its host's credentials and reach every other agent, an injected ticket read a harness token from memory, and Claude Code hooks can now fail closed.
Supply Chain
A worm planted Claude Code and VS Code settings to rerun itself, an MCP gateway launches attacker-named processes, and AWS moves agent rules outside the model.
Prompt Injection
A web page, an MCP server and an agent's own transcript each told the system what to trust, and the system believed them.
Sandboxing & Runtime
A claimed KVM escape, a reported Muse VM escape and two multi-agent papers show isolation failing at the VM and at the handoff between agents; harnesses answered by failing closed.