Researcher

Bayer and Thoughtworks Ship PRINCE Agentic RAG Platform

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 HN AI Security Jun 22, 2026

Bayer AG and Thoughtworks have published a detailed case study on PRINCE, a production agentic RAG system combining multi-agent orchestration, Text-to-SQL, and human-in-the-loop workflows to answer complex pharmaceutical preclinical research questions and draft regulatory documents. The system's architecture — spanning intent clarification, planning, retrieval, reflection, and writing agents with access to decades of safety study data — introduces a broad attack surface including prompt injection across agent boundaries, SQL injection via natural language, and sensitive data exfiltration through compromised agent outputs. Defenders evaluating similar agentic platforms should treat each inter-agent handoff as a trust boundary requiring independent validation and focus on data leakage controls given the sensitivity of preclinical regulatory data.

Anthropic Launches Claude Code with Local Memory Layer

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 Anthropic (via HN) Jun 22, 2026

Recall is an open-source, fully-local memory layer for Anthropic's Claude Code that persists and summarises project context across coding sessions without sending data to external services. For defenders, the introduction of a persistent, file-based context store creates a new attack surface: a poisoned or tampered memory file can silently inject malicious instructions into every subsequent Claude Code session. Security teams should treat the local memory store as a trusted-input boundary and apply appropriate file-integrity and access controls.

OpenAI Ships GPT-5.5 Instant with Health Intelligence

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 OpenAI Blog Jun 21, 2026

OpenAI has upgraded ChatGPT's health and wellness response capabilities via GPT-5.5 Instant, incorporating stronger reasoning, physician-informed evaluations, and improved contextual understanding for medical queries. This expansion into high-stakes health guidance raises meaningful concerns for defenders, as improved fluency and authority in medical responses increases the risk of user overreliance and lowers the perceived threshold for trusting AI-generated health advice. Security and trust-safety teams should evaluate how this capability interacts with prompt injection, social engineering chains, and the broader risk of AI-mediated medical misinformation at scale.

GitHub Ships Data Analytics Agent Built on Copilot

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.8 GitHub Blog Jun 20, 2026

GitHub has published a detailed engineering account of how it built an internal data analytics agent using GitHub Copilot, exposing the architectural patterns — including natural language-to-SQL translation, autonomous tool invocation, and internal data access — that underpin such systems. For defenders, this blueprint highlights concrete risks around prompt injection into analytics pipelines, excessive agency over sensitive internal datasets, and the challenge of auditing LLM-generated queries before execution. Organisations adopting similar agentic analytics patterns should treat this as a reference threat model rather than a safe-to-copy architecture.

AutoGen Studio RCE: AutoJack Exploit Chain Targets Developers

ATLAS OWASP HIGH ▲ 9.1 The Hacker News Jun 20, 2026

Microsoft researchers disclosed AutoJack, an exploit chain targeting AutoGen Studio's MCP WebSocket endpoint that allows a single malicious web page to execute arbitrary commands on a developer's host machine via an AI browsing agent. The attack chains three distinct weaknesses — localhost trust bypass, missing authentication on MCP paths, and unsanitised command execution — requiring no credentials or user interaction beyond the agent loading the attacker's URL. While the vulnerable handler was not included in stable PyPI releases, it shipped in two pre-release builds that remain unyanked, leaving anyone who installed those versions exposed.

Delphi Ships AI Karamo Brown Clone for Kē Wellness App

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 TechCrunch AI Jun 19, 2026

Karamo Brown's Kē wellness app deploys an AI digital clone of the celebrity — voice, persona, and advisory content — built by Delphi from interviews, podcasts, and public clips, enabling real-time conversational coaching at scale. For defenders, celebrity-clone architectures introduce layered risks: the training corpus is largely public and manipulable, the voice synthesis surface is exploitable for deepfake derivation, and the mental-health context creates elevated harm potential if the persona is hijacked or jailbroken. Security teams evaluating similar deployments should treat the persona boundary as a primary control point, since users in vulnerable emotional states are disproportionately exposed to manipulation if guardrails fail.

AWS SageMaker Ships 100+ Inference Metrics to CloudWatch

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 AWS Machine Learning Blog Jun 19, 2026

AWS has released a deep observability layer for SageMaker AI inference endpoints, emitting over 100 metrics covering GPU health, KV cache pressure, token-level latency, and traffic distribution into a native CloudWatch Insights dashboard with PromQL-compatible export. For defenders, this centralised telemetry surface introduces new reconnaissance and exfiltration vectors: an adversary with read access to CloudWatch or connected third-party tools (Grafana, Datadog) can infer model architecture, request patterns, and capacity limits without touching the model itself. The richness of these signals also raises insider-threat risk, as operational staff now have granular visibility into inference behaviour that can be leveraged to reverse-engineer model characteristics or plan targeted denial-of-service campaigns.

AWS Launches Amazon Bedrock AgentCore Harness

FIRST LOOK ATLAS OWASP HIGH ▲ 8.2 AWS Machine Learning Blog Jun 19, 2026

AWS has made Amazon Bedrock AgentCore Harness generally available, providing a managed abstraction layer that reduces agent deployment to two API calls while bundling sandboxed compute, persistent memory, tool gateway, browser access, identity management, and observability. For defenders, this dramatically lowers the barrier to deploying autonomous agents with filesystem access, shell execution, web browsing, and multi-provider model switching — compressing what was a weeks-long infrastructure project into minutes. Security teams face an expanded attack surface where prompt injection, tool abuse, cross-session memory poisoning, and supply chain risks through AWS-curated skill catalogs now arrive as a single, tightly integrated managed service rather than individually reviewable components.

Microsoft AutoGen Studio RCE via MCP Bypass

ATLAS OWASP HIGH ▲ 9.1 Microsoft Security Blog Jun 19, 2026

Researchers at Microsoft identified a three-stage exploit chain in AutoGen Studio that allows a malicious web page visited by a browsing AI agent to reach the host's local Model Context Protocol (MCP) WebSocket and spawn arbitrary processes. The chain exploits a bypassable origin allowlist, authentication middleware that excluded MCP endpoints, and unsanitised URL-derived command parameters. Although the vulnerable surface was never shipped in a PyPI release, the finding exposes a systemic architectural risk in any agent framework that combines untrusted browsing with privileged localhost services.

Midjourney Medical Releases Full-Body AI Ultrasound Scanner

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 The Verge AI Jun 18, 2026

Midjourney Medical has launched the Midjourney Scanner, a ring-based full-body ultrasound device that uses an array of sensors and AI inference to produce MRI-comparable anatomical imagery, marking a significant expansion of accessible diagnostic technology into consumer and prosumer health monitoring. For defenders and healthcare operators, this class of device opens new ground in longitudinal health visibility — enabling earlier detection of physiological changes at a cadence and cost point previously unavailable outside clinical settings. Realising that potential fully will require commensurate investment in data governance, model validation, and supply chain assurance to match the sensitivity of the data the platform generates.

Odyssey Launches Physical World Model Platform Backed by Amazon

FIRST LOOK ATLAS OWASP MEDIUM ▲ 6.2 TechCrunch AI Jun 18, 2026

Odyssey has raised a $310M Series B to scale its world model platform, which ingests real-world physical environment data to generate interactive simulations, video, and training environments for robotics and gaming. The platform's reliance on large-scale physical data collection, multi-tenant simulation outputs, and deep AWS infrastructure integration introduces supply chain, data poisoning, and adversarial simulation risks defenders should assess. Organizations consuming Odyssey-generated synthetic environments for robotics training or game content pipelines are newly exposed to integrity attacks targeting the underlying world model.

OpenAI Launches ChatGPT for Science with Institutional Access

FIRST LOOK ATLAS OWASP MEDIUM ▲ 5.8 BleepingComputer Jun 18, 2026

OpenAI is internally testing a specialised 'ChatGPT for Science' subscription tier, likely restricted to verified universities and research institutions, building on capabilities from GPT-Rosalind — a purpose-built life sciences model already deployed under a trusted-access structure with select pharma partners. The gated, domain-specific nature of this offering creates novel identity and access verification attack surfaces, as threat actors will likely probe credential and institutional verification mechanisms to gain privileged access to specialised scientific knowledge. Defenders at academic and research institutions should anticipate increased phishing campaigns targeting institutional credentials and prepare governance frameworks for AI use in sensitive research environments.

Z.ai Releases GLM-5.2 Open-Weights 753B LLM

FIRST LOOK ATLAS OWASP HIGH ▲ 6.2 Simon Willison Jun 18, 2026

Z.ai has released GLM-5.2, a 753-billion-parameter mixture-of-experts model under an MIT license, ranking as the top open-weights model on the Artificial Analysis Intelligence Index and second on the Code Arena WebDev leaderboard. For defenders, the combination of frontier-level capability, unrestricted open-weights distribution, and a 1-million-token context window materially lowers the barrier for threat actors to self-host a highly capable model outside any provider's safety controls. The model's agentic coding performance and massive context window expand the viable attack surface for automated code generation, targeted phishing, and large-scale document analysis without API-level monitoring.

Anthropic Ships Claude Fable 5 with Exploit Generation

FIRST LOOK ATLAS OWASP CRITICAL ▲ 8.7 Wired Security Jun 17, 2026

Anthropic's Mythos 5 and Claude Fable 5 deliver frontier-grade vulnerability discovery and exploit-development capabilities that, for the first time, give enterprise defenders access to the same AI-assisted offensive analysis previously limited to well-resourced nation-state teams. This closes a long-standing asymmetry: security teams can now use AI-native tooling to enumerate exploitable paths, generate proof-of-concept primitives, and compress red-team cycles from weeks to hours. The regulatory framework governing Fable 5's deployment addresses Anthropic specifically but does not yet extend equivalent standards across the broader ecosystem of competitive and open-weight models converging on the same capability tier.

Google Launches Android 17 with Gemini Omni Integration

FIRST LOOK ATLAS OWASP HIGH ▲ 7.2 TechCrunch AI Jun 17, 2026

Android 17 embeds Gemini Omni, AudioLM, and Lyria 3 directly into core OS functions including call handling, video editing, real-time audio translation, and emergency detection on Pixel devices. This deep integration gives defenders on-device AI capabilities that can surface anomalous behaviour, support safer communications, and automate emergency response without requiring third-party tooling. Organisations adopting Android 17 in managed fleets should establish baseline permission policies and input-validation standards to ensure these capabilities mature into enterprise-grade controls.

Researcher

Stay ahead of the threat.