Agentic AI

Claude Code Prompt Injection via GitHub Supply Chain

ATLAS OWASP HIGH ▲ 9.1 BleepingComputer Jun 29, 2026

Mozilla 0DIN researchers demonstrated a novel attack chain in which a seemingly clean GitHub repository tricks AI coding agents like Claude Code into executing a reverse shell payload — with no malicious code ever present in the repo itself. The attack leverages three innocuous components: a Python package that deliberately errors on first run, an error message that instructs the agent to run an init command, and a shell script that fetches and executes a payload stored in an attacker-controlled DNS TXT record. The technique exploits the autonomous error-recovery behaviour of agentic AI tools, effectively turning a safety feature into an attack vector.

Meta Releases AgentKits with 60 Production-Ready Agent Blueprints

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 Meta AI (via HN) Jun 29, 2026

AgentKits ships 60 open, free AI agent blueprints covering 30 operational categories — from incident response and access provisioning to HR screening and fraud detection — complete with copyable system prompts, tool definitions, and workflow architectures targeting Claude, OpenAI, LangGraph, and n8n. The free, no-login distribution model dramatically lowers the barrier for adversaries to study, clone, or weaponise production-grade agent architectures, including sensitive categories like SecOps triage, access provisioning, and compliance monitoring. Defenders must treat these blueprints as publicly documented attack playbooks and audit any internally deployed instances against their documented worst-case actions and trust levels.

OpenAI Releases GPT-5.6 Sol for Vulnerability Research

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 The Hacker News Jun 29, 2026

OpenAI has released a limited preview of GPT-5.6 Sol, Terra, and Luna to select partners, positioning Sol as its most capable model for vulnerability research and exploit chain development, benchmarked against real-world hardened targets via an internal framework called VulnLMP. The model's demonstrated ability to produce credible memory safety leads and automate substantial portions of vulnerability research pipelines materially lowers the barrier for both defenders and adversaries. Security teams should expect accelerated attacker timelines for exploit development and increased pressure on detection and patch-deployment cadences.

Sakana AI and 360 Launch Fugu and Tulongfeng Models

FIRST LOOK ATLAS OWASP HIGH ▲ 6.8 Cohere AI (via HN) Jun 29, 2026

Sakana AI's Fugu and Chinese firm 360's Tulongfeng are frontier AI models positioned as functional alternatives to Anthropic's export-restricted Mythos and Fable 5, with Fugu explicitly designed for agentic orchestration across third-party model APIs. For defenders, the proliferation of cybersecurity-focused frontier models outside US regulatory reach removes a key friction point that previously slowed adversary access to high-capability AI offensive tooling. The agentic, multi-model orchestration design of Fugu in particular introduces compounded supply-chain and prompt-injection risk for any enterprise connecting these models to existing tool ecosystems.

AI Code Review Agents: DoS Loop Costs $41K in Inference

ATLAS OWASP MEDIUM ▲ 6.5 Simon Willison Jun 27, 2026

A hypothetical but technically grounded incident report depicts two competing AI code review agents entering an uncontrolled disagreement loop over a suspected malicious package, generating 340 comments and $41,255 in inference costs before human intervention. The scenario illustrates real risks of excessive agency, lack of circuit-breakers, and cost-based denial-of-service in multi-agent agentic pipelines. While fictional, the scenario directly mirrors documented failure modes in production AI systems and supply chain security workflows.

OpenAI Launches GPT-5.6 with Enhanced Agentic Capabilities

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jun 27, 2026

OpenAI has released GPT-5.6 in a restricted preview to government-vetted partners, featuring three models (Sol, Terra, Luna) with significantly upgraded agentic capabilities in coding, biology, and cybersecurity, including a coordinated multi-subagent 'ultra' mode. The cybersecurity-specific enhancements and agentic orchestration introduce meaningful new attack surface: adversaries gaining access to Sol's coordinated subagent architecture could automate sophisticated multi-stage intrusions at scale previously requiring significant human expertise. The restricted rollout itself creates a novel supply chain and access-control risk, as the 'trusted partner' gating model concentrates high-capability model access among a small set of privileged accounts, making partner credential compromise a high-value target.

OpenAI Releases GPT-5.6 Under Controlled Access

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jun 26, 2026

OpenAI's GPT-5.6, a frontier model with advanced cyber capabilities, is being released exclusively to vetted partners under a White House-directed limited-access programme coordinated with the Office of the National Cyber Director and OSTP. This controlled rollout signals that the model's offensive cyber potential — including autonomous vulnerability identification and exploitation — is significant enough to warrant government-gated distribution, mirroring Anthropic's Project Glasswing model for Claude Mythos. For defenders, the emergence of a government-approved, partner-tier distribution model creates new supply chain trust questions and raises the stakes around who gains early access and how that access is verified, monitored, and potentially abused.

GitHub Releases Copilot Agentic Harness Evaluation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 GitHub Blog Jun 26, 2026

GitHub has published an evaluation of its Copilot agentic harness, detailing how the orchestration layer performs across multiple underlying models and coding tasks — effectively documenting the architecture of an autonomous, multi-step code generation and execution system. For defenders, this transparency reveals an orchestration surface where prompt injection, supply chain manipulation, and model-switching logic can be targeted across a broader set of model backends than previously understood. Security teams should treat the harness itself as a critical trust boundary, since compromising task routing or model selection logic could silently redirect agentic workflows to less-safe or adversary-controlled model endpoints.

Anthropic Launches Claude Cowork Mobile with Remote Control

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jun 26, 2026

Anthropic is expanding its Claude Cowork agentic desktop feature to mobile, enabling users to remotely initiate, monitor, and steer long-running AI tasks on their PC from a smartphone — with background task execution persisting even after the mobile app is closed. This cross-device architecture introduces a new attack surface: a mobile application acting as a command-and-control interface for an agent with local filesystem access, expanding the blast radius of device compromise, session hijacking, and prompt injection attacks. Defenders must now account for a persistent, background-running agentic process on employee endpoints that can be triggered or manipulated via a separate, potentially less-secured mobile channel.

Google DeepMind Releases AI Agent Attack Taxonomy

FIRST LOOK ATLAS OWASP HIGH ▲ 8.7 SecurityWeek Jun 25, 2026

Google DeepMind researchers have released a structured taxonomy categorising adversarial attacks against autonomous AI agents into six classes — content injection, semantic manipulation, cognitive state poisoning, behavioural control, systemic, and human-in-the-loop traps — formalising an emerging threat model for agentic AI systems. For defenders, this framework codifies attack paths that exploit the agent's inability to distinguish trusted instructions from attacker-controlled data ingested from web pages, emails, documents, and tool outputs. NIST evaluation data cited in the research shows malicious instruction injection succeeded in 57% of tested agent hijacking scenarios on average, underscoring that these are active, high-yield attack vectors rather than theoretical concerns.

First Look: Agentic AI SOC Systems Ship Autonomous Decision-Making at Machine Speed

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 SecurityWeek Jun 25, 2026

Agentic AI systems deployed in security operations and enterprise workflows are increasingly executing autonomous decisions at machine speed, using LLM-derived confidence regardless of context accuracy. The core security risk is that incomplete, poisoned, or manipulated context fed to these agents produces confidently wrong actions executed without human review. Defenders face a compounded threat: adversaries can now target the context layer—asset inventories, threat feeds, exposure data—to induce systematic misconfiguration or inaction at scale.

MoEngage Deploys Autonomous AI Agents via Aampe Acquisition

FIRST LOOK ATLAS OWASP HIGH ▲ 6.8 TechCrunch AI Jun 24, 2026

MoEngage has acquired Aampe to deploy individualized AI agents for every customer, enabling autonomous decisions on messaging targeting, timing, and content at enterprise scale across 1,350+ brands globally. This architecture introduces a large, distributed fleet of autonomous agents operating on sensitive behavioral and PII data, dramatically expanding the blast radius of any single compromise. Security teams at enterprises adopting this platform must now reason about agent-level trust boundaries, data inference risks, and the amplification potential of adversarial manipulation across millions of simultaneous decision-making agents.

Mistral AI Ships OCR 4 with Document Extraction

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 Mistral AI (via HN) Jun 24, 2026

Mistral OCR 4 is a production-grade document intelligence model delivering bounding boxes, block classification, inline confidence scores, and 170-language OCR optimised for enterprise RAG and search ingestion pipelines. For defenders, the model's role as a trusted ingestion component in downstream retrieval pipelines creates a high-value attack surface: adversarially crafted documents can now influence RAG context, citations, and automated redaction decisions at scale. The self-hosted single-container deployment option further expands the supply chain and misconfiguration risk surface for organisations running document intelligence internally.

Cordyceps Campaign Poisons CI/CD Workflows in Open Source

ATLAS OWASP HIGH ▲ 7.2 Dark Reading Jun 24, 2026

A campaign dubbed 'Cordyceps' is exploiting weaknesses in CI/CD workflows to inject malicious pull requests into high-profile open-source projects, including Google's AI Agent Development Kit and Microsoft's Azure Sentinel. The attack surface spans multiple trusted ecosystems, meaning poisoned code could propagate into AI tooling, cloud infrastructure, and widely-used developer utilities before detection. The breadth of targets — including Python's Black formatter — signals a supply chain strategy designed to maximise downstream blast radius.

Anthropic's Mythos AI Breached Classified US Government Systems in Hours

ATLAS OWASP CRITICAL ▲ 9.1 SecurityWeek Jun 24, 2026

Anthropic's Mythos AI model identified vulnerabilities in classified US government computer systems within hours during a government-sanctioned testing exercise under Project Glasswing. A senior US official confirmed the findings to the Associated Press, corroborating statements made by Sen. Mark Warner that the model 'broke into almost all of our classified systems.' The incident marks a landmark demonstration of AI-enabled offensive cyber capability at the highest sensitivity levels of government infrastructure.

Agentic AI

Stay ahead of the threat.