Agent-Tooling

Google Gemini API Adds Hooks, Budget Controls, and 3.6 Flash Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 Google DeepMind Blog Jul 29, 2026

Google has updated its Managed Agents in the Gemini API with Gemini 3.6 Flash as the new default model, environment hooks that allow interception of tool calls, budget controls, scheduled triggers, and free tier access. The introduction of environment hooks — which can block, lint, or audit tool calls inside the agent sandbox — creates a new interception layer that, if misconfigured or bypassed, could allow malicious tool calls to slip through undetected. Defenders deploying these agents must treat hooks as a critical trust boundary and scrutinise scheduled triggers and budget controls as potential abuse vectors for persistent, low-cost autonomous operations.

FableCut Ships AI-Drivable Browser Video Editor via MCP and REST

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.2 HN AI Security Jul 10, 2026

FableCut is a zero-dependency, browser-based non-linear video editor that exposes its entire timeline as a JSON document and accepts live control from AI agents via MCP (Model Context Protocol) and REST APIs, enabling tools like Claude Code or Claude Desktop to autonomously edit video. This agent-accessible media pipeline introduces meaningful new attack surface: any AI agent granted MCP/REST access can read, overwrite, or poison the JSON timeline, and a compromised or prompt-injected agent could silently alter exported video content. Defenders managing AI agent workflows that touch media pipelines should treat this as an unsandboxed tool-use endpoint requiring strict authZ, input validation, and output integrity checks.

OfficeCLI Brings Microsoft Office Automation to AI Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 HN AI Security Jul 07, 2026

OfficeCLI is an open-source, single-binary tool that enables AI agents to programmatically read, write, and automate Microsoft Word, Excel, and PowerPoint files without requiring a local Office installation. This dramatically expands the file-system attack surface for agentic AI systems, enabling prompt injection via document content, automated exfiltration of sensitive Office files, and weaponisation of documents as a persistent injection vector. Defenders operating AI agent pipelines that touch file systems must now treat any Office document as a potential adversarial input channel.

GitHub Releases Copilot Agentic Harness Evaluation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 GitHub Blog Jun 26, 2026

GitHub has published an evaluation of its Copilot agentic harness, detailing how the orchestration layer performs across multiple underlying models and coding tasks — effectively documenting the architecture of an autonomous, multi-step code generation and execution system. For defenders, this transparency reveals an orchestration surface where prompt injection, supply chain manipulation, and model-switching logic can be targeted across a broader set of model backends than previously understood. Security teams should treat the harness itself as a critical trust boundary, since compromising task routing or model selection logic could silently redirect agentic workflows to less-safe or adversary-controlled model endpoints.

AWS Launches Bedrock AgentCore for Autonomous Payments

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 AWS Machine Learning Blog Jun 23, 2026

AWS has launched Amazon Bedrock AgentCore Payments, a managed infrastructure layer that enables AI agents to autonomously transact with external model providers and services using the x402 payment protocol, without human intervention. This capability introduces a new class of financial attack surface where compromised or manipulated agents can autonomously spend real funds, exfiltrate value, or be redirected to malicious service endpoints. Defenders must now treat agent payment credentials and spending budgets as first-class financial controls, on par with cloud IAM policies.