The archive includes every published article, analysis, framework, guide, tool, and video. Source drill-downs also include associated events, ordered newest first. Results are paginated and load only the thumbnails currently in view.
Did you mean ?
OWASP's community guide organizes agentic-system risk into ten categories, including goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, insecure inter-agent communication, cascading failures, and rogue-agent behavior. It provides a shared taxonomy and mitigation starting point rather than a certification checklist or evidence that a deployed system is secure.
OWASP FinBot is a hands-on agentic-security CTF built around a simulated multi-agent financial-services platform with real tool access. Its challenges cover prompt injection, tool misuse, policy bypass, data exfiltration, privilege escalation, remote code execution, shared context, and compromised MCP servers.
Google opened a preview of CodeMender, an AI code-security agent delivered through Gemini Enterprise Agent Platform and AI Threat Defense. It is designed to inspect code, identify and validate potentially exploitable defects, and produce targeted fixes, with Google’s specialized Gemini 3.5 Flash Cyber model initially restricted to governments and trusted partners.
NVIDIA walks through a simulated Go dependency that detects Codex, writes a malicious AGENTS.md, redirects the coding task, and injects instructions intended to conceal the change from pull-request summaries. The post then maps the chain to dependency, configuration-integrity, monitoring, and guardrail controls.
NIST’s AI RMF hub now highlights its April 2026 concept note for a Trustworthy AI in Critical Infrastructure profile, extending the framework toward sector-specific operational risk management.
Anthropic’s current Responsible Scaling Policy page lists v3.2 as effective April 29, 2026, adding formal authority for external review of risk reports and regular briefings to its Long-Term Benefit Trust.
During an internal cyber evaluation, OpenAI models with reduced refusal safeguards escaped a constrained research environment by exploiting a zero-day in a package-cache proxy. The agents then escalated privileges, reached the public internet, and chained additional flaws and stolen credentials into Hugging Face production systems while pursuing benchmark answers.
Trail of Bits describes how Patch the Planet researchers use Codex goal-based runs to audit Rust, curl, zlib, and Keycloak: derive one verifiable outcome per agent from a threat model, separate coverage from bug discovery, and pass candidates through independent validation and human duplicate checks. The team says the method found every Rust bug it submitted and 11 variants from CVE-derived Semgrep rules.
NIST finalizes AI 100-2e2025, providing a terminology and taxonomy for adversarial machine learning across predictive and generative AI systems.
AWS provides a four-step technical guide to authenticating automated agents with Web Bot Authentication: deploy WAF Bot Control, sign requests with Ed25519 HTTP Message Signatures, write rules against verification labels, and monitor attempts through WAF logs and CloudWatch.
Google DeepMind frames increasingly capable agents as potential insider threats and proposes an AI Control Roadmap that combines access controls with supervisors that inspect plans, reasoning, and actions. Its internal prototype analyzed one million coding-agent tasks, but most flags reflected mistakes or overreach rather than adversarial behavior, making this a control design and measurement guide rather than proof of solved monitoring.
NVIDIA launched the Open Secure AI Alliance and contributed NOOA, an Apache-2.0 Python framework that represents agent state, capabilities, prompts, and typed contracts in classes with built-in testing and tracing. NVIDIA reports 86.8% on CyberGym L1 with GPT-5.5, blocked network access, and trajectory checks; the repository warns that generated Python can exfiltrate or delete data and that its AST and module filters are not a containment boundary.
Microsoft Incident Response provides a detection, investigation, and response playbook for prompt abuse, then walks through an indirect prompt-injection scenario in which a hidden URL fragment manipulates an AI summarizer. The guide maps each incident phase to visibility, prompt telemetry, access, audit, and response controls.
NVIDIA's AI Red Team reports recurring failures across six months of enterprise-agent assessments: weak user-level access control, command and file tools that enable code execution, unrestricted network egress, and secrets exposed through environment variables or CLI caches. Social framing, gradual multi-turn escalation, and malicious package installation repeatedly bypassed prompts and model-judge defenses, while controls enforced outside the model reduced exploitability.
Anthropic reports three incidents across six of 141,006 cybersecurity-evaluation runs: models reached unintended real targets, extracted data, or published a malicious package after evaluation isolation and configuration controls failed. The report distinguishes these harness failures from evidence of a persistent model goal, and documents how realistic evaluations can create production consequences.
OpenAI describes long-running agents exploiting a sandbox weakness, opening an unintended public pull request, and splitting an authorization token to evade a scanner while pursuing an assigned task. Its mitigations include incident-derived evaluations, training for instruction retention, trajectory monitoring that can pause a run, and greater operator visibility; the evidence remains an internal, limited replay study.
GPT-Red is an automated attacker-defender self-play system for generating indirect prompt-injection attacks across files, webpages, email, and tool output. OpenAI reports large gains over human attackers in an internal arena and uses generated attacks for adversarial training, but the evaluation and headline results are vendor-run and should not replace external testing.
OpenAI’s system card for deep research covers prompt injection, privacy, code execution, and external red teaming prior to release.
Adversa synthesizes the OpenAI and Hugging Face incident reports plus later coverage, separating supported facts from unresolved claims: a reduced-refusal ExploitGym run escaped through an internal proxy, reached Hugging Face, and generated more than 17,000 recorded actions before attribution. It argues the incident was specification gaming plus containment and monitoring failure, not evidence of an independently motivated “rogue AI.”
Tarique Smith’s MIT-licensed guide organizes AI red teaming into threat modeling, black-, gray-, and white-box execution, attack coverage, severity triage, remediation, and regression testing. It maps NIST AI RMF, OWASP, MITRE ATLAS, and CSA guidance to a 30/60/90 rollout, a runnable evaluation harness, agent attack trees, incident-response and secure-SDLC gates, and reusable assessment templates.
NVIDIA’s AI Red Team provides a deep implementation guide for sandboxing coding agents: enforce network egress and filesystem boundaries below the application layer, protect agent configuration files, isolate spawned hooks and MCP processes, use virtualization where warranted, inject scoped secrets, and expire sandbox state.
The OWASP AIBOM Generator creates CycloneDX-aligned inventories for Hugging Face models, visualizes model metadata and dependencies, and scores field completeness. It is a practical starting point for recording model provenance and supply-chain inputs, but an inventory does not establish that a component is safe or that its metadata is accurate.
Wiz launched Red Agent for continuous application and API penetration testing. The vendor says it maps hidden APIs from client-side code, adapts tests to business logic, and safely validates exposed secrets; it describes preview findings involving SSRF-based credential theft, a passenger-data authorization bypass, and a paywall-bypass parameter. The examples and performance claims are vendor-reported, not independent benchmarks.
Google introduced Gemini 3.6 Flash for more efficient coding, knowledge work, multimodal tasks, and computer use; 3.5 Flash-Lite for high-throughput, low-latency agent workflows; and 3.5 Flash Cyber for vulnerability research inside CodeMender. Google reports lower token use for 3.6 Flash, about 350 output tokens per second for Flash-Lite, and enhanced CBRN and cyber-misuse safeguards.