AI agent security guides and incident research.
Practical guides to AI agent, NHI and MCP security. Explore real incidents, trace access to sensitive data and learn which controls reduce the risk.
An npm worm added your AI tools config files to its credential list.
Agent credentials are a standard target in supply chain malware now, not a novelty.
An evaluation agent escaped its sandbox and held cluster-admin for four days.
The sandbox escape is the headline. The escalation was ordinary machine credentials, lying where they always lie.
A poisoned extension harvested AI agent credentials, then GitHub internal repositories.
The credential list now includes the file your coding agent keeps its configuration in.
One secret shipped to every instance drove ServiceNow AI agents as any user.
MFA and SSO were both in the picture. Neither of them was in the path.
Coding agents pushed 13,000 internal screenshots to public repos.
No attacker and no vulnerability. 93 percent of the images sit in personal GitHub accounts.
Storm-3168 wiped Azure storage with two service principals and no exploit.
Microsoft names no vulnerability. A group-granted role authorised every destructive call.
An OpenAI agent walked past a block on Australia's Medicare portal.
The agent held no account and no token. Every control it met judged one request at a time.
MCP Python SDK OAuth flaw: a checklist for your agent credentials.
The patch takes a minute. Working out which client secrets left your estate takes longer.
AWS AgentCore: the vault held. The process did not.
The vault did its job. The credential still left in one HTTP POST, and it belonged to a service account.
The Vercel breach was an attack path, not a vulnerability.
A token with broad scopes is a finding. A token that reaches customer secrets is an attack path.
Autonomous AI agents breached online retailers for about $25 a company.
The tooling is public and the flaws are ordinary. What changed is the price of trying.
Coding agent sandbox escapes: a checklist after the Codex research.
A sandbox whose own credential lives next to attacker-controlled code is not a boundary.
Spain logged the first breach notification where the attacker was an AI agent.
Only one step in that chain was a vulnerability. The other four were access questions.
Three of OpenAI’s six new incidents are access problems, not alignment problems.
Intent varied across the six incidents. What the agents could reach did not.
AI agents breached 395 organisations. A service account opened the domain.
The exploit reached 440 print servers. The service account behind them decided who lost the domain.
Infostealer logs are full of AI session tokens that replay past MFA.
Replayed session tokens open AI accounts without a password and without an MFA prompt.
GitSpawn: one line in .git/config runs code in seven AI coding agents.
One git setting, seven coding agents and the developer credentials within their reach.
AI agents in OT and KRITIS: a security checklist for operators.
Six measures for deploying AI agents in OT: ownership, access, oversight and response.
NIS2 reporting for AI agent incidents: when the 24-hour deadline applies.
When AI agent incidents are reportable, which deadlines apply and what evidence to collect.
MCP security: risks and a 12-point hardening checklist.
Twelve checks for MCP server access, tool poisoning, token handling and monitoring.
Non-human identity security: risks, controls and a practical plan.
Understand non-human identities, compare security controls and build an access review plan.
AI-assisted attacks on critical infrastructure: evidence and security lessons.
Documented OT incidents, the limits of AI attribution and practical lessons for operators.
The Nx s1ngularity attack: how malware targeted AI coding CLIs.
A compromised npm package, AI coding tools and the credentials within their reach.
The Salesloft Drift breach: how stolen OAuth tokens exposed Salesforce data.
How compromised OAuth tokens turned a SaaS integration into a path to sensitive data.
JADEPUFFER ransomware: tracing the agentic attack path.
From Langflow exploitation to database extortion: the role of harvested credentials.
Cursor deleted the PocketOS database on Railway. How did it get access?
The API token, production access and recovery safeguards behind the PocketOS incident.
Your riskiest agents, in your inbox.
New research and product notes on AI-agent and non-human-identity security. No noise.