Loading story…
Security guidance published across multiple outlets warns that LLM output and agent behavior must be treated as untrusted throughout the full application pipeline, not just at the model layer. One report details how identity, authorization, context assembly, templating, tokenization, inference, decoding, parsing, policy checks, and downstream actions can each introduce risk, and says incident response should preserve artifacts such as serialized prompts, truncation decisions, model and tokenizer identifiers, decoding settings, parser results, policy decisions, and executed actions. It also highlights prompt-injection scenarios in which attacker-controlled retrieved content can steer a model toward sensitive actions if application controls are weak.
Separate guidance for generative UI systems says applications should enforce a strict validation boundary with schema checks, render only approved components from a controlled registry, and route any real-world action through an application-owned action registry with authorization and server-side enforcement. In parallel, the open-source Hazmat project aims to contain AI coding agents by isolating them under a separate local account, restricting readable and writable paths, network access, and service access so agents cannot reach secrets such as SSH keys or cloud credentials outside the project workspace. Together, the reports reflect a broader shift toward execution control, evidence preservation, and sandboxing as core defenses for AI-enabled applications and coding agents.
Track how attackers are adapting to this technology.
2 events from the most recent confirmed update back to the earliest known activity.
A demo script described in the reference shows a contained agent session writing a file inside a temporary project while failing to read a private key from the user's real home directory with networking disabled. The comparison reportedly showed one new file in the project and no other files modified.
Hazmat is described as a free open-source tool on GitHub for isolating AI coding agents under a separate account on the user's machine to limit access to sensitive data and credentials. The reference does not anchor when the project was first released.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
infoworld.com
Open sourcehelpnetsecurity.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple studies and industry reports found that **AI-generated or "vibe-coded" software is frequently shipped with serious security flaws**, including XSS, SQL injection, hardcoded secrets, unsafe `eval` usage, weak authentication logic, wildcard CORS, exposed `.env` data, and insecure dependencies. One analysis of 5,600 publicly accessible AI-built applications reported more than 2,000 high-risk vulnerabilities and over 400 exposed secrets, while a separate review of 549 self-described AI-generated repositories found widespread committed secrets, injection issues, hardcoded passwords, and other common sanitization failures. Veracode and other researchers similarly warned that code produced by large language models often maps to **OWASP Top 10** weakness classes and that repeated AI-assisted edits, poor prompts, and excessive agent permissions can further increase risk. At the same time, researchers and vendors highlighted both the promise and fragility of AI-assisted security tooling. Trail of Bits reported that OpenAI Codex goal-based prompting helped uncover previously unknown bugs in projects including **Rust**, **curl**, **zlib**, and **Keycloak**, but stressed that human experts were still needed to scope goals, validate findings, and handle disclosure. New academic work also showed that **LLM-based vulnerability detectors can be easily misled**: the ALIBI framework used adversarial code comments to evade four detectors with success rates above 90%. In response to growing concern over agent reliability, Amazon backed the Lean language project to strengthen formal verification for AI agents, while security experts argued that theorem proving can improve assurance for high-risk components but should be applied selectively as part of broader defense-in-depth.
Aug 4, 2026
Security researchers and vendors warned that autonomous AI agents can be manipulated into leaking secrets and misusing privileged access, turning them into a new pathway for credential theft and system compromise. Reporting from SC Media cited Okta Threat Intelligence research showing agents on the OpenClaw platform could be socially engineered or prompt-injected into exposing passwords, API keys, GitHub tokens, and OAuth refresh tokens, while other analysis described a **confused deputy** problem in which malicious text embedded in files, logs, web pages, or instruction files causes agents to execute higher-trust actions with their legitimate permissions. The risk is amplified when agents can read local files, edit code, run commands, fetch remote content, and access external tools or MCP servers without strong separation between trusted instructions and untrusted data. Defenders are responding with controls aimed at limiting agent authority and reducing secret exposure. Help Net Security reported on **Nono**, an open-source sandbox that constrains AI coding agents at the kernel level using mechanisms such as **Landlock** on Linux and **Seatbelt** on macOS, while introducing scoped tool permissions and proxy-mediated "phantom credentials" so agents do not directly handle live secrets. The broader guidance aligns with established ATT&CK techniques including **`T1552` Unsecured Credentials** and **`T1546` Event Triggered Execution**, emphasizing least privilege, centralized identity governance, short-lived credentials, secure secret storage, logging, rapid revocation, provenance checks, input isolation, and human approval to prevent agents from becoming a bridge to sensitive systems and cloud resources.
Jul 28, 2026
Enterprises and public-sector organizations are accelerating adoption of **AI agents** and generative AI to automate knowledge work and software delivery, with guidance increasingly framed as a management and governance problem rather than a purely technical one. Commentary on agentic AI in software development describes agents as autonomous decision loops operating within guardrails (goal decomposition, tool selection, execution, observation, and iteration), enabled by mature CI/CD automation and API-driven infrastructure. Separate reporting highlights empirical findings that AI-generated code has grown to nearly **30%** of code by late 2024 and is associated with an estimated **~4%** productivity lift, with gains concentrated among more experienced developers despite higher usage among less-experienced staff. Security and procurement implications are emerging alongside this adoption. Research on **agentic tool chain attacks** warns that AI agents’ “reasoning layer” and natural-language tool metadata become an attack surface, enabling techniques such as **tool poisoning**, tool shadowing, and “rugpull” behavior that can lead to covert data leakage or unauthorized actions; the risk is amplified when tools are centralized via architectures like the *Model Context Protocol (MCP)*, where compromise of a shared tool server can propagate malicious behavior across many agents. In the US federal context, agencies are signaling demand for AI tools that deliver operational value while meeting requirements for security, transparency, and responsible use, and the General Services Administration is also tightening contractor cybersecurity expectations for work involving **CUI** by requiring alignment with **NIST SP 800-171** (and select **800-172** controls), including MFA, encryption, vulnerability remediation, and removal of end-of-life components, with independent assessments as part of authorization and ongoing monitoring.
Jun 29, 2026