Llm-Agents

9 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Adversarial ML Jailbreaks Model Theft Data Poisoning AI Security Tools Security Operations

Tracebit Ships AWS Context Bombing Defence Against AI Hacking Agents

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.8 Ars Technica Security Jul 14, 2026

Tracebit has demonstrated a defensive technique called 'context bombing' that plants forbidden prompt injections alongside cloud secrets in AWS environments, exploiting AI hacking agents' own safety guardrails to force them into refusal loops and halt attacks. Tested across five leading models and 152 runs, the technique reduced successful admin privilege escalation from 57% to 5% and complete compromise from 36% to 1%. While highly effective as a canary and disruption mechanism, the technique also introduces a novel countermeasure-evasion arms race: adversaries now have strong incentive to build agents with hardened or guardrail-bypassed reasoning loops specifically to defeat context bombs.

Langflow LLM Agents Exploited for Ransomware Delivery

ATLAS OWASP CRITICAL ▲ 9.2 SecurityWeek Jul 04, 2026

A documented ransomware attack leveraged agentic AI infrastructure — specifically the Langflow LLM orchestration platform — to automate multi-stage intrusion chains combining known exploitation techniques with real-time LLM reasoning. This marks a significant escalation in threat actor capability, demonstrating that agentic AI can serve as an autonomous attack coordinator rather than merely an assistant. Security teams running self-hosted AI orchestration platforms now face an expanded attack surface where the AI layer itself can be both the entry point and the execution engine.

Robinhood Prompt Injection Enables Autonomous Trade Attacks

ATLAS OWASP HIGH ▲ 7.2 HN AI Security May 31, 2026

Robinhood has launched agentic trading and a virtual credit card that allow third-party AI agents to autonomously execute stock trades and payments on behalf of users via a Model Context Protocol (MCP) integration. This architecture introduces significant attack surface through prompt injection, excessive agency, and insecure plugin design risks inherent to LLM-driven autonomous financial action. The delegation of real financial authority to AI agents with limited human-in-the-loop controls represents a systemic risk to retail investors if agent pipelines are compromised or manipulated.

FuzzingBrain V2 Discovers 29 Zero-Day Vulnerabilities

ATLAS OWASP HIGH ▲ 7.8 HN AI Security May 29, 2026

Researchers have developed FuzzingBrain V2, a multi-agent LLM system capable of autonomously discovering and reproducing software vulnerabilities with a 90% detection rate on a competitive benchmark dataset. The system discovered 29 zero-day vulnerabilities across 12 open-source projects, all confirmed by maintainers, raising both defensive and dual-use concerns for the security community. While positioned as a defensive research tool, the automation of end-to-end vulnerability discovery at this scale represents a meaningful shift in the offensive capability landscape.

SQLite Blocks AI-Generated Code Contributions

ATLAS OWASP MEDIUM ▲ 6.2 Simon Willison May 29, 2026

SQLite has formally prohibited agentic code contributions and strengthened its policy language, reflecting growing concern over AI-generated submissions overwhelming open source maintainers. The project was forced to create a separate bug forum after being flooded with AI-generated reports of inconsistent quality. This represents an emerging operational security challenge for critical infrastructure software projects targeted by autonomous AI coding agents.

Constraint Decay: LLM Code Agents Fail at Scale

ATLAS OWASP HIGH ▲ 7.2 HN AI Security May 25, 2026

A systematic study of LLM agents performing backend code generation reveals a 'constraint decay' phenomenon where agents lose up to 30 assertion pass-rate points as structural requirements accumulate, approaching complete failure in some configurations. This fragility has direct security implications: production deployments relying on LLM-generated code may silently violate architectural constraints such as ORM patterns, database access controls, and API contracts. The findings expose a critical gap between functional correctness and structural safety in agentic coding systems.

Zealot: Autonomous LLM Cloud Penetration Testing System

ATLAS OWASP CRITICAL ▲ 9.0 Palo Alto Unit 42 Apr 24, 2026

Unit 42 researchers built 'Zealot,' a multi-agent LLM-powered penetration testing system capable of autonomously executing end-to-end offensive operations against cloud infrastructure, demonstrating that AI acts as a significant force multiplier for cloud attacks. The system successfully attacked a misconfigured GCP sandbox environment using a supervisor-coordinated architecture of specialist agents, validating that agentic AI can operate at machine speed against real cloud misconfigurations. This research follows Anthropic's November 2025 disclosure of a state-sponsored AI-orchestrated espionage campaign and marks a critical inflection point in understanding autonomous AI offensive capabilities.

Vertex AI Privilege Escalation Exposes GCP Credentials

ATLAS OWASP CRITICAL ▲ 9.2 Palo Alto Unit 42 Apr 24, 2026

Unit 42 researchers discovered critical privilege escalation and data exfiltration vulnerabilities in Google Cloud Platform's Vertex AI Agent Engine, demonstrating how a deployed AI agent can be weaponized to compromise an entire GCP environment through excessive default permissions on service agents. By exploiting the P4SA (Per-Project, Per-Product Service Agent) default permission scoping, attackers could extract service agent credentials and gain privileged access to consumer project data and restricted producer project resources within Google's own infrastructure. Google has since updated its documentation in response to the coordinated disclosure.

LLM Agents Exploit Human Over-Trust in Strategic Games

ATLAS OWASP MEDIUM ▲ 6.2 Schneier on Security Apr 17, 2026

Research published via Schneier on Security reveals that humans systematically over-trust LLMs in strategic game environments, defaulting to Nash-equilibrium rational play based on assumptions of LLM rationality and cooperation. This behavioural bias has direct security implications for mixed human-LLM systems, where adversaries could exploit predictable human over-trust to manipulate decision outcomes. The findings underscore systemic risks in deploying LLMs as agents in high-stakes economic or security-relevant decision loops.

Llm-Agents

Stay ahead of the threat.