Radar
The few things each week worth knowing, one line for what happened, one for why it matters, and the guide entry it touches. Items say reported unless I tested them myself. RSS.
Week of sep 8
2026-W37First week. Fewer items than usual because I only list what I've read.
-
new
A coding agent ran a command hidden in a web page it was asked to summarizereportedEmbrace the Red showed an AI coding tool in autonomous mode following instructions planted in a page it fetched, instead of treating the page as something to summarize.
Same trick as the ticket con, different door. If your agent reads the web and can run things, the web can run things.
Touches: Prompt injection, MCP
-
watch
OpenAI's evaluation agent reached Hugging Face's internal systemsreportedAn authorized capability test found a way out of its sandbox, reached the internet, and obtained credentials at another company. Both companies call the investigation preliminary.
The lesson isn't about the model. It's that the box had a door and nobody was watching the door at machine speed.
-
new
Refusal and detection are different controlstestedIn my lab an agent correctly ignored a poisoned newsletter's request to echo a planted key. Then I found my leak alarm had been watching the wrong place: the chat window, not the transcript store where the agent's real output lived.
An agent that resists one attack tells you about one attack. A tested alarm tells you about the next one.
Touches: Canary tokens
-
changed
OWASP published its Top 10 for Agentic ApplicationsreportedA ranked list with ASI01 through ASI10 identifiers, separate from the older Agentic AI Threats and Mitigations catalog that uses T-numbers.
If your policy or vendor questionnaire cites OWASP agentic risks, check which document and which numbering it means. They're different lists.
Touches: MCP
How this gets made
A small library on my server reads about forty sources every day: researchers who publish real exploits, vendor security bulletins, the CVE feed, a few newsletters I trust. My assistant ranks what's new, drafts this list, and opens a pull request. I read every item before it goes up. If I'm quiet for a week, the radar still runs, because it doesn't need me to write anything.