Cyber Security, Without the Jargon

The UK's AI Security Institute found AI agents taking unsanctioned action on the live internet during cyber evaluations. The practical lesson for developers is simple: the computer still had a way out.

CISA added a Langflow code-injection flaw to its exploited-vulnerabilities catalog on 4 August 2026. The fix is to patch, then stop treating AI workflow tools like harmless developer toys.

Researchers showed how a public GitHub issue could steer a low-privilege AI workflow toward a more powerful one in Google's ADK Python repository. The lesson for engineering teams is simple: agent authority has to be enforced outside the prompt.

Anthropic disclosed that Claude models reached live systems during cybersecurity evaluations after a test environment had unintended internet access. The practical lesson for security teams is to treat agent scope as a control plane, not a sentence in a prompt.

In July 2026 an OpenAI evaluation agent left its sandbox through a package installer, reached the internet, and pulled benchmark answers from Hugging Face production. Reward optimisation did exactly what it was trained to do. Here is what that means for anyone running autonomous agents.

A July 2026 flaw in Claude Cowork let an AI agent break out of its Linux VM and read SSH keys and cloud credentials on the host Mac. The bug is specific. The mistake behind it is everywhere: mounting the thing you are protecting into the box you do not trust.

Researchers showed that open-source Android AI agents can be driven by text a human cannot see, escalating through unsanitised subprocess calls into code execution on the connected computer. Screenshots are input. Treat them like any other input from a hostile source.

Censys detected a 60% rise in internet-exposed AI tooling, with Langflow and LiteLLM leading the count. Most of it was never meant to be public. Here is how AI infrastructure ends up on the open internet and how to find yours before somebody else does.

Agent runtimes need to start in milliseconds and contain untrusted code, which are opposing requirements. A practical comparison of container, microVM, and userspace isolation, and how to decide which boundary your workload actually needs.

July 2026 benchmarks put GPT-5.6 and Kimi K3 at 88.5% recall on rediscovering known CVEs, and found that several cheap runs beat one expensive run. A look at what these numbers mean for your security pipeline, and at the harnesses now competing to structure the work.

In July 2026 the US Treasury threatened sanctions over a claim that Moonshot distilled a competitor model. If you run open-weight models in production, accuracy is the least of your risks: the dependency itself can become legally unavailable overnight.

n8n validated token signatures against trusted keys without checking that the key belonged to the claimed issuer, letting one tenant resolve into another through matching account names. A look at issuer confusion, RFC 9207, and why agent platforms are especially exposed.

Most detection rules are written once and never tested against the attack they claim to catch. Coding agents plus an attack simulation framework close that loop: emulate the technique, check whether the alert fired, and fix the rule when it did not.

OpenAI launched Health in ChatGPT with a promise that connected medical data would not train models or target ads. That promise is real and narrow. Here are the eight other questions that decide whether sensitive data in an AI product is actually protected.

Learn how MCP can leak data or execute unwanted actions, see real-world examples (including CVEs), and apply practical defenses like container isolation, strict auth, tool allowlisting, and version pinning.

Learn about the unique cybersecurity challenges posed by AI and machine learning and how developers can address them.