High-signal AI/security/automation notes.
NHIcon 2026 conference recap: why traditional IAM fails AI agents, and the new frameworks for dynamic identity, secretless execution, and continuous behavioral validation.
Security researcher Christian Schneider details how agentic AI transforms prompt injection from isolated model manipulation into orchestrated multi-tool attack chains, mapping defenses to the OWASP Agentic Top 10 and Promptware Kill Chain.
AI system from AISLE found 12 zero-day vulnerabilities in OpenSSL, including CVE-2026-22796 (dating to 1998) and a HIGH-severity stack overflow in CMS parsing — bugs missed by 27 years of human review.
Researchers warn that open-weight LLMs can be locally stripped of safety guardrails and weaponized for phishing, spam, and disinformation at scale.
EchoLeak is a real-world, zero-click prompt injection chain against Microsoft 365 Copilot that exfiltrates data via email + auto-fetch behaviors, illustrating concrete trust-boundary failures in production copilots.
Cisco argues that local personal agents with shell/file access turn third‑party ‘skills’ into a high-risk supply chain; they open-sourced Skill Scanner to detect exfiltration/prompt-injection patterns in skills.
CrowdStrike maps a practical attack surface for agent tooling: malicious tool metadata, cross-tool prompt influence, and post-integration behavior drift — especially in shared tool hubs like MCP.
A practical breakdown of prompt injection and tool poisoning against MCP servers, plus concrete defense layers (least privilege, tool governance, and monitoring).
INCIBE-CERT warns of a critical command-injection issue (CVE-2026-0756) in github-kanban-mcp-server, an MCP server that lets LLM agents manage GitHub issues; no fix yet, so restrict exposure.
A new arXiv paper argues system prompts are an underprotected attack surface in agentic coding systems, and demonstrates autonomous prompt extraction strategies against black-box models.
LangChain’s January 2026 update covers agent robustness improvements in LangChain JS, streaming progress from subagents, and a push toward observability-driven evaluation via LangSmith.
Microsoft details LangGrinch (CVE-2025-68664): a LangChain Core serialization injection bug where attacker-controlled dictionaries can be misinterpreted as trusted objects via the reserved lc key.
CVE-2026-24842: a path traversal check mismatch in node-tar can allow crafted TAR archives to create hardlinks outside the extraction directory and overwrite arbitrary files.
Obsidian Security details a chained Langflow vulnerability (CVE-2025-34291) combining permissive CORS, missing CSRF protections, and a code-validation endpoint to reach account takeover and server-side code execution.