Architecture & Harnesses
What is an agent control plane?
An agent control plane is the dashboard or API that starts, stops and directs a group of AI agents, and stores their tasks, findings and keys.
Architecture & Harnesses
Incidents
N014: Microsoft says China-aligned hackers aimed AI agents at 2,250 tenants through ConnectWise
Microsoft says China-aligned Storm-0940 used AI agents and ConnectWise's app identities to hit 2,250+ Microsoft 365 tenants, and a backdoored LiteLLM release stole AI keys.
Architecture & Harnesses
What is path canonicalization?
Path canonicalization is turning a file path into its one true, final form before checking it, so tricks like trailing dots, symlinks or "..\" can't sneak past a protected-file rule.
Prompt Injection
N008: A trailing dot let Visual Studio's Copilot run attacker code
Copilot in Visual Studio could be tricked into installing an attacker's MCP server with a trailing dot; plus sandbox gaps in Claude Code and Vercel Sandbox.
Incidents
AgentSec Brief N006: Eval harnesses let test agents reach live sites
Anthropic's test agents filed real forms on government sites because the eval harness gave them the open internet; plus AI reaching factory controls in 16 minutes and Claude Code 2.1.296.
Glossary
What is repo-planted agent config?
Repo-planted agent config is a settings file committed inside a code repository that makes an AI coding agent or IDE run commands when a developer opens or works in the project.
Glossary
What is fail closed?
A fail-closed control blocks an action when it cannot reach a decision, because it crashed, timed out or lacked data, instead of letting the action through.
Architecture & Harnesses
AgentSec Brief Weekly W001: The agent harness became the attack path
This week attackers went through the harness around AI agents: planted repo settings, credentials agent code could reach, and sandbox egress, while vendors moved guards to fail closed.
Agent Identity & Auth
AgentSec Brief N005: AgentCore agents grabbed their runtime's credentials
One prompt let an AWS AgentCore agent take its host's credentials and reach every other agent, an injected ticket read a harness token from memory, and Claude Code hooks can now fail closed.
Supply Chain
AgentSec Brief N004: Poisoned repos and MCP gateways ran attacker code
A worm planted Claude Code and VS Code settings to rerun itself, an MCP gateway launches attacker-named processes, and AWS moves agent rules outside the model.
Prompt Injection
AgentSec Brief N003: Agents trusted what the other side told them
A web page, an MCP server and an agent's own transcript each told the system what to trust, and the system believed them.
Sandboxing & Runtime
AgentSec Brief N002: Isolation failed at the VM and the handoff
A claimed KVM escape, a reported Muse VM escape and two multi-agent papers show isolation failing at the VM and at the handoff between agents; harnesses answered by failing closed.