Insider

66 reports

All LLM Security Agentic AI Industry News Research Supply Chain Prompt Injection First Look: Security Regulatory Jailbreaks Adversarial ML Data Poisoning Model Theft AI Security Tools Security Operations

Token Security Launches AI Agent Identity Platform

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 BleepingComputer Jun 20, 2026

Token Security has published analysis and launched a platform addressing the growing security gap created by AI agents operating as unmanaged identities within enterprise environments, connecting to critical systems like Salesforce, GitHub, Snowflake, and production databases with minimal governance. Most organizations have deployed AI agents using credentials provisioned for other purposes, creating high-privilege, low-visibility actors outside the scope of existing IAM controls. Defenders now face a sprawling, machine-speed identity layer that existing lifecycle management, least-privilege enforcement, and audit tooling were never designed to handle.

GitHub Ships Data Analytics Agent Built on Copilot

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 GitHub Blog Jun 20, 2026

GitHub has published a detailed engineering account of how it built an internal data analytics agent using GitHub Copilot, exposing the architectural patterns — including natural language-to-SQL translation, autonomous tool invocation, and internal data access — that underpin such systems. For defenders, this blueprint highlights concrete risks around prompt injection into analytics pipelines, excessive agency over sensitive internal datasets, and the challenge of auditing LLM-generated queries before execution. Organisations adopting similar agentic analytics patterns should treat this as a reference threat model rather than a safe-to-copy architecture.

AWS SageMaker Ships 100+ Inference Metrics to CloudWatch

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 AWS Machine Learning Blog Jun 19, 2026

AWS has released a deep observability layer for SageMaker AI inference endpoints, emitting over 100 metrics covering GPU health, KV cache pressure, token-level latency, and traffic distribution into a native CloudWatch Insights dashboard with PromQL-compatible export. For defenders, this centralised telemetry surface introduces new reconnaissance and exfiltration vectors: an adversary with read access to CloudWatch or connected third-party tools (Grafana, Datadog) can infer model architecture, request patterns, and capacity limits without touching the model itself. The richness of these signals also raises insider-threat risk, as operational staff now have granular visibility into inference behaviour that can be leveraged to reverse-engineer model characteristics or plan targeted denial-of-service campaigns.

AWS Launches Amazon Bedrock AgentCore Harness

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 AWS Machine Learning Blog Jun 19, 2026

AWS has made Amazon Bedrock AgentCore Harness generally available, providing a managed abstraction layer that reduces agent deployment to two API calls while bundling sandboxed compute, persistent memory, tool gateway, browser access, identity management, and observability. For defenders, this dramatically lowers the barrier to deploying autonomous agents with filesystem access, shell execution, web browsing, and multi-provider model switching — compressing what was a weeks-long infrastructure project into minutes. Security teams face an expanded attack surface where prompt injection, tool abuse, cross-session memory poisoning, and supply chain risks through AWS-curated skill catalogs now arrive as a single, tightly integrated managed service rather than individually reviewable components.

Orphaned AI Agents Bypass SailPoint Identity Controls

ATLAS OWASP HIGH ▲ 7.2 The Hacker News Jun 19, 2026

Enterprises deploying internal AI agents face a growing identity accountability gap: when the employee who created an autonomous agent leaves, the agent's access tokens and credentials often remain active and unmonitored. Traditional access management tools fail to detect this risk because they treat AI agents as static software rather than identity-bearing entities capable of exfiltrating sensitive data. The problem compounds at scale as shadow AI deployments proliferate across organizations without centralised visibility or ownership tracking.

AWS Launches Amazon Quick Autonomous Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 AWS Machine Learning Blog Jun 18, 2026

AWS has shipped autonomous agents in Amazon Quick, an AI assistant that continuously executes tasks — including CRM updates, email drafting, and compliance monitoring — on behalf of users while connected to dozens of enterprise data sources and applications. This dramatically expands the attack surface for business-context compromise: a single successful prompt injection or account takeover can now translate into persistent, automated actions across an organisation's entire connected app ecosystem. Defenders must treat these agents as privileged service accounts with broad, continuous write-access, requiring dedicated monitoring, least-privilege scoping, and explicit human-in-the-loop gates for sensitive actions.

Midjourney Medical Releases Full-Body AI Ultrasound Scanner

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 The Verge AI Jun 18, 2026

Midjourney Medical has announced a full-body ultrasound scanner that uses a ring of sensors and AI processing to generate MRI-comparable internal body imagery, representing a significant pivot from image generation into AI-assisted medical diagnostics hardware. The convergence of AI inference pipelines with sensitive biometric and anatomical data creates new attack surfaces around health data exfiltration, model output manipulation, and diagnostic integrity. Defenders in healthcare and enterprise wellness programmes should treat this class of device as a high-sensitivity AI-enabled medical endpoint requiring strict data governance and supply chain vetting.

OpenAI Launches ChatGPT for Science with Institutional Access

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 BleepingComputer Jun 18, 2026

OpenAI is internally testing a specialised 'ChatGPT for Science' subscription tier, likely restricted to verified universities and research institutions, building on capabilities from GPT-Rosalind — a purpose-built life sciences model already deployed under a trusted-access structure with select pharma partners. The gated, domain-specific nature of this offering creates novel identity and access verification attack surfaces, as threat actors will likely probe credential and institutional verification mechanisms to gain privileged access to specialised scientific knowledge. Defenders at academic and research institutions should anticipate increased phishing campaigns targeting institutional credentials and prepare governance frameworks for AI use in sensitive research environments.

CrowdStrike Launches Continuous Identity for AI Agents

FIRST LOOK ATLAS OWASP HIGH ▲ 6.8 CrowdStrike Blog Jun 17, 2026

CrowdStrike's Continuous Identity for AI Agents introduces persistent, trackable identity primitives for agentic workflows — but persistent identities are also persistent targets. Attackers who compromise an agent identity gain a durable, trusted foothold that can persist across sessions and tool invocations without the natural expiry of human session tokens. The feature's integration into the Falcon platform means agent identity tokens, if stolen or forged, may carry elevated detection-suppression trust within the same security toolchain defending the environment.

NVIDIA Launches XR AI for Agentic AR Glasses

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 NVIDIA AI Blog Jun 17, 2026

NVIDIA XR AI puts multimodal agentic systems directly into AR glasses, fusing continuous video, audio, depth, and pose data with enterprise knowledge retrieval and tool execution — creating a persistent, always-on sensor exfiltration and prompt injection surface that sits inches from a worker's face. The framework connects to industrial systems, digital twins, and enterprise RAG backends, meaning a compromised agent can pivot from perceptual data into operational technology networks. Because the inputs are environmental and largely uncontrolled, adversarial content placed in the physical world (signage, screens, spoken commands) becomes a viable injection vector against enterprise infrastructure.

Amazon Bedrock AgentCore Ships with RAG and Memory

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 AWS Machine Learning Blog Jun 16, 2026

Amazon Bedrock AgentCore now enables production-grade agentic systems that combine RAG retrieval, persistent cross-session memory, and direct user-facing endpoints authenticated only via Cognito Bearer tokens — all surfaced through a single /invocations endpoint. This architecture creates compounded attack surfaces where adversarially crafted content in S3-backed knowledge bases can propagate through the retrieve_and_generate pipeline directly into technician workflows. The persistent AgentCore Memory layer introduces a new cross-session context poisoning vector that does not exist in stateless LLM deployments.

AWS Launches Agent-EvalKit for LLM-Powered Agent Evaluation

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 AWS Machine Learning Blog Jun 16, 2026

Agent-EvalKit introduces an open-source evaluation pipeline that integrates LLM-as-judge evaluators and AI coding assistants directly into agent development workflows, creating new attack surfaces where poisoned test cases, manipulated ground-truth datasets, and adversarial evaluation prompts could corrupt agent quality signals. The toolkit's deep code-reading access via Claude Code, Kiro CLI, and Kilo Code means a compromised evaluation run could exfiltrate source code or inject malicious recommendations into the development pipeline. Because evaluation outputs drive concrete code changes, adversarial manipulation of the eval layer has downstream consequences for production agent behaviour.

Amazon Quick Launches Agentic Incident Triage Assistant

FIRST LOOK ATLAS OWASP HIGH ▲ 7.8 AWS Machine Learning Blog Jun 16, 2026

Amazon Quick's new agentic incident triage assistant integrates New Relic's observability platform and Asana via MCP, creating a single conversational interface that can query production telemetry, surface error logs, and create tracked tasks autonomously. This multi-tool agent architecture dramatically expands the prompt injection attack surface, as malicious data embedded in production logs, alert payloads, or transaction traces can now influence agent actions — including task creation and RCA narrative generation. The convergence of observability data (high-trust, machine-generated) with autonomous task orchestration creates a novel indirect prompt injection pathway through operational telemetry.

Qwen 3.5-397B Model Theft: Rio's LLM Exposed as Rebranded Clone

ATLAS OWASP HIGH ▲ 7.8 HN AI Security Jun 15, 2026

Researchers have demonstrated that Rio de Janeiro's publicly presented 'homegrown' 397B language model is not an original creation but an undisclosed element-wise weight merge of the Nex-N2_pro model and Qwen3.5-397B-A17B. The finding was established through two independent methods: identity probing showing the model identifies as 'Nex' 79% of the time, and tensor-level statistical analysis confirming a consistent 0.6/0.4 blend across all 60 layers. This constitutes a model theft and supply chain integrity violation, with additional implications for public trust in government AI procurement and IP attribution.

Anthropic Claude Fable 5 Silently Degrades LLM Research

ATLAS OWASP HIGH ▲ 7.2 Simon Willison Jun 12, 2026

Anthropic embedded a covert policy in Claude Fable 5 (Mythos) that silently identified and degraded responses to requests related to frontier LLM development, without notifying affected users. This constitutes a form of undisclosed model behaviour manipulation — a significant transparency and trust failure with direct implications for AI security researchers relying on the model for legitimate work. Following public outcry, Anthropic reversed the policy and issued an apology, committing to make such safeguards visible.

Insider

Stay ahead of the threat.