Posts

Google Developers Blog — Gemini CLI hooks for policy & automation

Google adds ‘hooks’ to Gemini CLI: synchronous scripts that can inject context, validate tool calls, enforce security policies, and automate guardrails inside the agent loop.

Google: Gemini 3 in Chrome adds an agentic ‘auto browse’ workflow

Google is expanding Gemini-in-Chrome with a side panel and an agentic ‘auto browse’ feature for multi-step web tasks. What it changes for automation + security.

GreyNoise — Threat actors actively targeting exposed LLM endpoints

GreyNoise reports 91k+ attack sessions observed against LLM infrastructure (Oct 2025–Jan 2026), including an SSRF/OAST-style campaign and large-scale enumeration of OpenAI-compatible/Gemini endpoints.

Bitdefender — Android dropper used Hugging Face datasets to deliver RAT payloads

Bitdefender reports an Android trojan campaign where a TrustBastion dropper redirects to Hugging Face datasets to fetch polymorphic RAT APKs, leveraging trusted infrastructure to evade suspicion.

IEEE Spectrum — Why LLMs keep falling for prompt injection (and why agents raise the stakes)

IEEE Spectrum argues prompt injection persists because LLMs lack robust context/judgment and flatten control vs data. The risk increases when models are given tools and autonomy.

Kaspersky — OWASP Agentic Top 10 (2026): practical risks + controls for AI agents

Kaspersky summarizes OWASP’s Top 10 for Agentic Applications (2026), highlighting where classic security meets agent-specific failure modes like tool misuse, memory poisoning, and cascading actions.

Kyverno (CVE-2026-22039) — Namespaced Policy apiCall can cross namespace boundaries

CVE-2026-22039 in Kyverno: a namespaced Policy apiCall can drive Kyverno’s admission controller identity to hit arbitrary Kubernetes API paths, bypassing namespace boundaries.

Model Context Protocol — MCP Apps: UI components inside agent chats

The Model Context Protocol (MCP) project announced MCP Apps: an official extension that lets tools return sandboxed, interactive UI (iframes + JSON-RPC) inside supported clients like Claude, ChatGPT, Goose and VS Code.

arXiv — Breaking the Protocol: MCP security analysis (capability attestation + origin auth gaps)

A new paper analyzes Model Context Protocol (MCP) and argues key weaknesses are architectural: capability attestation, origin authentication for sampling, and trust propagation in multi-server setups.

NVD — MCP TypeScript SDK UriTemplate ReDoS (CVE-2026-0621)

CVE-2026-0621: a ReDoS bug in Anthropic’s MCP TypeScript SDK UriTemplate matching can let crafted URIs peg CPU and hang Node-based MCP servers.

Microsoft: runtime inspection to block risky AI agent tool calls

Microsoft describes a runtime defense model for Copilot Studio agents: treat every tool invocation as a high-risk event, inspect context via webhook, and allow/block in real time.

Microsoft — CVE-2026-21509 (Office) emergency out-of-band fix

Microsoft shipped emergency out-of-band updates for an actively exploited Office security feature bypass (CVE-2026-21509) involving OLE mitigations; CISA added it to KEV.

Microsoft — turning threat reports into detection insights with AI

Microsoft outlines an AI-assisted workflow that extracts TTPs from reports, maps to MITRE ATT&CK, and does coverage/gap analysis against a detection catalog (with human validation).

n8n: sandbox escape bugs lead to full RCE in self-hosted instances

Two sandbox escape vulnerabilities in n8n (CVE-2026-1470, CVE-2026-0863) can enable remote code execution on self-hosted deployments; what changed, why it matters, and what to do.

NIST/CAISI — RFI on security practices for AI agents

NIST’s CAISI opened an RFI asking for concrete practices and measurement methods to secure AI agent systems (incl. hijacking/backdoors) with comments due March 9, 2026.

OpenAI — Hardening ChatGPT Atlas against prompt injection

OpenAI describes an automated red-teaming loop for browser agents (ChatGPT Atlas), using RL-trained attackers + simulation to discover prompt injections and ship adversarial training + safeguards.

GitHub Advisory — Orval MCP generation code injection risk (CVE-2026-22785)

arXiv: SoK on prompt injection attacks against agentic coding assistants

A new Systematization of Knowledge paper surveys prompt injection against agentic coding assistants and MCP ecosystems, arguing for architectural mitigations over prompt filtering.

Varonis — Reprompt: single-click Copilot prompt injection chain for silent data exfiltration

Varonis Threat Labs describes Reprompt: a one-click Copilot Personal deep-link technique (q=) combined with multi-request chaining that enabled silent data exfiltration; Microsoft says it has been patched.

Varonis — Reprompt one-click Copilot session hijack (patched)

Varonis disclosed ‘Reprompt’: a one-click deep-link prompt injection flow that could chain requests inside Copilot Personal to exfiltrate user data; Microsoft says it’s patched.