Tool-Use

AWS Launches AgentCore Gateway for Multi-Account AI Agents via MCP

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 AWS Machine Learning Blog Sep 26, 2026

AWS has released AgentCore Gateway, a managed control plane that enables AI agents to operate across multiple AWS accounts using the Model Context Protocol (MCP), centralising tool access and identity brokering for distributed agentic workloads. For defenders, this closes a meaningful gap in cross-account agent governance by providing a structured integration layer that enforces IAM-scoped tool invocation rather than relying on ad-hoc credential passing between accounts. Residual gaps remain around MCP server vetting maturity, cross-account audit log correlation, and the organisational readiness required to govern tool registries at scale.

AWS Adds Defense-in-Depth Authorization for MCP Tools on Amazon Q

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.2 AWS Machine Learning Blog Sep 20, 2026

AWS has published guidance and implementation patterns for defense-in-depth authorization controls applied to Model Context Protocol (MCP) tools within the Amazon Q platform, addressing the authorization gap that emerges when AI agents are granted access to external tools and services. This closes a meaningful defensive gap for enterprises deploying agentic AI: the risk of excessive or unverified tool invocation authority, which has been a persistent blind spot in MCP-based agent architectures. Realising the full benefit will require organisations to have mature IAM governance, MCP server inventory discipline, and operational runbooks for agent permission scoping already in place.

OpenAI Launches Agents API with Sandboxes and Multi-Agent Orchestration

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 OpenAI (via HN) Sep 15, 2026

OpenAI has released a dedicated Agents API providing structured primitives for building, running, and observing autonomous AI agents — including sandboxed execution environments, multi-agent orchestration, webhooks, and integrated tracing. For defenders and security-conscious developers, this closes a meaningful gap by surfacing agent behaviour through built-in observability tooling and scoped execution environments, reducing reliance on ad-hoc logging and uncontrolled tool access. Residual gaps remain around third-party MCP trust boundaries, self-hosted sandbox maturity, and the operational readiness required for teams to translate tracing telemetry into meaningful security monitoring.

arXiv Research Introduces Self-Evolving Procedural Graphs for LLM Agents

FIRST LOOK ATLAS OWASP LOW ▲ 6.8 HN AI Security Sep 10, 2026

Researchers have introduced Procedural Graphs, a self-evolving execution structure that organises procedural knowledge for LLM agents into graph-based triplets, providing step-level situational guidance that constrains unconstrained action generation over long task horizons. For defenders, this closes a meaningful gap in agentic AI controllability — structured execution paths reduce the risk of tool misuse, out-of-order invocations, and objective drift that make long-horizon agents difficult to audit and govern. Residual gaps remain around operational integration maturity, auditability of the self-evolution loop itself, and whether procedural graph structures can be validated against enterprise security policies before deployment.

ChatGPT Prompt Injection Exfiltrates Gmail Data via Hidden Channel

ATLAS OWASP HIGH ▲ 9.2 The Hacker News Sep 09, 2026

Check Point Research demonstrated a prompt injection attack against ChatGPT that allowed a hidden instruction to silently read a victim's connected Gmail data and exfiltrate it to an attacker-controlled account through an internal inter-container service. The attack exploited ChatGPT's agentic tool-use defaults, which permit reading connected apps without user confirmation under the 'Important actions' permission model. OpenAI has since taken the internal service used as the covert channel offline, but the underlying permission design and injection vectors remain a structural concern.

LLM CLI Tool Adds OpenAI Endpoint Command for Any AI Backend

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 Simon Willison Jul 31, 2026

LLM 0.32rc2 ships a new `llm openai endpoint` command that allows arbitrary OpenAI-compatible endpoints to be queried from the CLI without pre-configuring a model, and crucially these calls are not logged. This unlogged-by-design behaviour, combined with tool-use support against any reachable endpoint, expands the attack surface for data exfiltration, prompt injection via local or rogue model endpoints, and insider misuse that evades standard audit trails.

AWS AgentCore Gateway Adds Support for MCP 2026-07-28 Spec

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 AWS Machine Learning Blog Jul 29, 2026

AWS has released AgentCore Gateway with native support for the Model Context Protocol (MCP) 2026-07-28 specification, enabling standardised tool-use and context-sharing across agentic AI workloads on AWS infrastructure. For defenders, MCP-compliant gateways dramatically expand the inter-agent communication surface, introducing new vectors for prompt injection through tool responses, malicious server impersonation, and privilege escalation across agent boundaries. Security teams operating agentic pipelines on AWS must now treat MCP endpoints as high-value targets requiring the same scrutiny applied to API gateways and identity providers.

FableCut Ships AI-Drivable Browser Video Editor via MCP and REST

FIRST LOOK ATLAS OWASP MEDIUM ▲ 7.2 HN AI Security Jul 10, 2026

FableCut is a zero-dependency, browser-based non-linear video editor that exposes its entire timeline as a JSON document and accepts live control from AI agents via MCP (Model Context Protocol) and REST APIs, enabling tools like Claude Code or Claude Desktop to autonomously edit video. This agent-accessible media pipeline introduces meaningful new attack surface: any AI agent granted MCP/REST access can read, overwrite, or poison the JSON timeline, and a compromised or prompt-injected agent could silently alter exported video content. Defenders managing AI agent workflows that touch media pipelines should treat this as an unsandboxed tool-use endpoint requiring strict authZ, input validation, and output integrity checks.

AWS Launches Amazon Bedrock AgentCore Harness

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 AWS Machine Learning Blog Jun 19, 2026

AWS has made Amazon Bedrock AgentCore Harness generally available, providing a managed abstraction layer that reduces agent deployment to two API calls while bundling sandboxed compute, persistent memory, tool gateway, browser access, identity management, and observability. For defenders, this dramatically lowers the barrier to deploying autonomous agents with filesystem access, shell execution, web browsing, and multi-provider model switching — compressing what was a weeks-long infrastructure project into minutes. Security teams face an expanded attack surface where prompt injection, tool abuse, cross-session memory poisoning, and supply chain risks through AWS-curated skill catalogs now arrive as a single, tightly integrated managed service rather than individually reviewable components.

CVE-2026-26030: Semantic Kernel RCE via Prompt Injection

ATLAS OWASP CRITICAL ▲ 9.2 Microsoft Security Blog May 08, 2026

Microsoft's Defender Security Research Team disclosed two CVEs in Semantic Kernel — a widely-used AI agent orchestration framework — demonstrating how prompt injection can escalate to remote code execution via compromised plugins. The vulnerabilities (CVE-2026-26030 and CVE-2026-25592) expose a systemic risk in the agentic AI layer: because frameworks like Semantic Kernel abstract tool orchestration, a single flaw in how LLM outputs are mapped to system tools can propagate across every application built on that foundation. This research signals a critical shift in AI threat modelling, where prompt injection is no longer a content risk but an execution risk.

Supply Chain Risk: Gradio MCP Server Exposes AI Agents

ATLAS OWASP MEDIUM ▲ 6.2 Hugging Face Blog Apr 27, 2026

Hugging Face's Gradio MCP server integration enables LLMs to connect to thousands of third-party AI tools via Hugging Face Spaces, significantly expanding the attack surface for agentic AI systems. This architecture introduces supply chain risks, excessive agency concerns, and potential for malicious tool servers to manipulate LLM behaviour through crafted outputs. While presented as a productivity feature, the open, community-driven nature of the 'MCP App Store' raises serious vetting and trust boundary concerns.

Prompt Injection Risk: Claude 4.7 Agentic Tool Expansion

ATLAS OWASP MEDIUM ▲ 6.2 HN AI Security Apr 20, 2026

Anthropic's published system prompt diff between Claude Opus 4.6 and 4.7 reveals significant expansions in agentic tool access, autonomous browsing capabilities, and child safety guardrails — changes with direct security implications for prompt injection and excessive agency risks. The new `tool_search` mechanism and acting-before-asking posture increase the attack surface for adversarial inputs targeting agentic Claude deployments. Transparency in publishing these changes is notable, but the expanded autonomous capabilities warrant scrutiny from defenders.

Tool-Use

Stay ahead of the threat.