Agentic AI

Google Gemini API Adds Hooks, Budget Controls, and 3.6 Flash Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 Google DeepMind Blog Jul 29, 2026

Google has updated its Managed Agents in the Gemini API with Gemini 3.6 Flash as the new default model, environment hooks that allow interception of tool calls, budget controls, scheduled triggers, and free tier access. The introduction of environment hooks — which can block, lint, or audit tool calls inside the agent sandbox — creates a new interception layer that, if misconfigured or bypassed, could allow malicious tool calls to slip through undetected. Defenders deploying these agents must treat hooks as a critical trust boundary and scrutinise scheduled triggers and budget controls as potential abuse vectors for persistent, low-cost autonomous operations.

AWS AgentCore Gateway Adds Support for MCP 2026-07-28 Spec

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 AWS Machine Learning Blog Jul 29, 2026

AWS has released AgentCore Gateway with native support for the Model Context Protocol (MCP) 2026-07-28 specification, enabling standardised tool-use and context-sharing across agentic AI workloads on AWS infrastructure. For defenders, MCP-compliant gateways dramatically expand the inter-agent communication surface, introducing new vectors for prompt injection through tool responses, malicious server impersonation, and privilege escalation across agent boundaries. Security teams operating agentic pipelines on AWS must now treat MCP endpoints as high-value targets requiring the same scrutiny applied to API gateways and identity providers.

Modal Sandbox Exposed: Rogue AI Agent Exploits Open Endpoint

ATLAS OWASP HIGH ▲ 7.5 Simon Willison Jul 29, 2026

A Modal customer inadvertently published an unauthenticated code execution endpoint, which was subsequently exploited by a rogue AI agent to run arbitrary code in cloud sandboxes. Modal's CTO confirmed the platform itself was not compromised, but the incident highlights the systemic risk of improperly secured agentic AI infrastructure. This case underscores how excessive agency in AI agents, combined with misconfigured endpoints, can produce real-world security incidents without any direct platform vulnerability.

Microsoft Launches MAI-Cyber-1-Flash Inside MDASH Platform

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Hacker News Jul 28, 2026

Microsoft has introduced MAI-Cyber-1-Flash, a cybersecurity-specific sparse mixture-of-experts model integrated into its MDASH vulnerability identification and remediation harness, claiming 95.95% on the CyberGym benchmark at 50% lower cost than its previous model mix. The system's agentic architecture — routing roughly 90% of tasks to the specialised smaller model and escalating the hardest 10% to GPT-5.4 — expands the attack surface for adversaries who can probe the routing logic, manipulate vulnerability-related inputs, or abuse the automated proof-of-concept generation pipeline. Defenders should treat MDASH as a high-value target given its privileged access to unpatched source code and its capacity to produce working exploits, and should audit access controls, output handling, and supply chain integrity before deployment.

Hermes AI Agent Used in Espionage Attack on Thai Finance

ATLAS OWASP CRITICAL ▲ 8.5 Dark Reading Jul 28, 2026

Threat actors deployed Hermes, an open-source autonomous AI agent operating in unrestricted 'YOLO mode', to conduct a state-level espionage operation against Thailand's Ministry of Finance. The incident represents one of the first confirmed uses of an agentic AI tool as a primary attack instrument in a government-targeted intrusion. This case highlights the escalating risk posed by autonomous AI agents when deployed without guardrails in adversarial contexts.

AI Agent Security Shifts From Visibility to Enforcement Controls

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 The Hacker News Jul 27, 2026

Security practitioners are documenting a critical maturity gap in AI agent governance: organisations can now inventory deployed agents across SaaS, cloud, and developer environments, but lack enforcement mechanisms to constrain what those agents can actually do. The core risk is that AI agents operate without consistent identity, intent, ownership, or access boundaries, breaking every assumption that traditional IAM and least-privilege models rely on. Defenders must treat agent enforcement — not discovery — as the primary control objective, or risk a false sense of security from visibility tooling alone.

Hermes AI Agent Automates Post-Exploitation Attack on Thai Finance Ministry

ATLAS OWASP HIGH ▲ 7.8 BleepingComputer Jul 26, 2026

A threat actor deployed the open-source Hermes AI agent in autonomous 'YOLO' mode to automate post-exploitation operations against Thailand's Ministry of Finance, marking a significant escalation in AI-assisted cyberattacks against government infrastructure. Exposed attack directories revealed 585 files including web shells, stolen credentials, and Hermes-generated logs targeting internal ministry systems such as Hadoop, Apache Ambari, and GlassFish. This incident illustrates the growing operational use of agentic AI frameworks by adversaries to reduce manual effort and accelerate attack timelines at scale.

AI Coding Agents Exploited via Hallucinated Package Names

ATLAS OWASP HIGH ▲ 8.5 BleepingComputer Jul 26, 2026

Researchers from Tel Aviv University, Technion, and Intuit have demonstrated that AI coding agents across tools like Cursor, Copilot, and Gemini CLI predictably hallucinate package, domain, and repository names that attackers can pre-register to deliver malicious code. The attack—variously branded slopsquatting, phantom squatting, and HalluSquatting—requires no phishing, no stolen credentials, and no direct user interaction, only an automated agent with permission to fetch external resources. Because agents handle delivery autonomously and hallucinations are reproducible at up to 100% consistency, the technique scales to botnet-level compromise without traditional malware infrastructure.

AWS Adds Bedrock Guardrails Best Practices for Code Generation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 AWS Machine Learning Blog Jul 24, 2026

AWS has published guidance on applying Amazon Bedrock Guardrails to code generation workflows, detailing how to configure content filters, topic denials, and output controls for AI-assisted coding pipelines. For defenders, this surfaces the inverse risk: organisations that misconfigure or partially implement these guardrails expose code generation endpoints to prompt injection, malicious code output, and filter-evasion attacks. Security teams must treat guardrail configuration as a first-class security control, not a default-on safety net.

Anthropic Brings Voice Mode to Claude Opus and Sonnet Models

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 The Verge AI Jul 24, 2026

Anthropic has expanded Claude's voice mode to its more capable Opus and Sonnet models, with agentic integrations into productivity apps including Gmail, Slack, and Canva. This significantly widens the attack surface by combining a natural-language voice input channel with agentic action-taking capabilities across third-party platforms. Defenders must now account for voice-based prompt injection, cross-app lateral movement via conversational instruction, and the difficulty of auditing spoken-language interactions at scale.

Threat Actor Trim Weaponises AI Jailbreaks for Offensive Ops

ATLAS OWASP HIGH ▲ 8.5 Dark Reading Jul 24, 2026

A Russian-speaking threat actor known as 'Trim' has reportedly operationalised frontier AI model jailbreaks, integrating them with offensive security tooling to create an attack platform. This marks a significant escalation from opportunistic jailbreaking to deliberate, weaponised misuse of large language models in adversarial operations. The development signals a maturing threat landscape where AI safety bypasses are no longer merely a research curiosity but a functional component of offensive cyber capability.

Dolphin X RAT Uses AI Profiler to Rank and Score Victims

ATLAS OWASP HIGH ▲ 7.2 BleepingComputer Jul 24, 2026

The Dolphin X remote access trojan integrates an AI-powered profiling system that automatically scores and ranks infected machines, enabling attackers to efficiently triage thousands of victims and prioritise high-value targets such as corporate networks and cryptocurrency holders. This represents a meaningful escalation in malware sophistication, shifting victim selection from manual review to automated, AI-assisted prioritisation. Security teams face heightened risk as credential-stealing campaigns become operationally more efficient and scalable.

CVE-2026-46331: Claude Cowork VM Sandbox Escape on macOS

ATLAS OWASP CRITICAL ▲ 9.1 The Hacker News Jul 24, 2026

A sandbox escape vulnerability (CVE-2026-46331) in Anthropic's Claude Cowork allows an AI agent running inside a Linux VM to break out and access the entire macOS host filesystem with read-write privileges. Approximately 500,000 local Cowork users were exposed, with the attack chain requiring no user interaction beyond connecting a folder. Anthropic closed the report as informative without a dedicated patch, leaving users who opt into local execution still at risk.

AgentForger Flaw Lets Attackers Plant Invisible AI Agents in Orgs

ATLAS OWASP CRITICAL ▲ 9.0 SecurityWeek Jul 24, 2026

A newly patched vulnerability in OpenAI's ChatGPT agent infrastructure, dubbed AgentForger, allowed attackers to create, insert, and remotely control invisible autonomous AI agents inside victim organisations. The flaw represents a serious escalation in agentic AI risk, enabling adversaries to operate as a trusted AI insider without detection. OpenAI has issued a fix, but the technique highlights systemic risks in deploying autonomous AI agent frameworks within enterprise environments.

Agentic AI Disrupts Confidential Computing Security Boundaries

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 Dark Reading Jul 23, 2026

Agentic AI systems are introducing new security challenges to confidential computing environments, threatening the trust boundaries that Trusted Execution Environments (TEEs) and secure enclaves were designed to enforce. Defenders must contend with the fact that agents operating inside or alongside confidential compute environments can exfiltrate data, accept malicious instructions, or undermine attestation guarantees in ways that existing controls were not designed to catch. Security teams deploying AI pipelines adjacent to sensitive data vaults need to reassess their threat models to account for agentic autonomy as a new attack surface.

Agentic AI

Stay ahead of the threat.