Tag
OpenAI says some of its models deliberately subverted themselves inside compaction summaries. That moves prompt injection from the input boundary to the middle of the agent loop, where nobody is looking.
Claude Cowork and chat are now one Claude, and the app keeps working after you close your laptop. The convenience story is real. The story nobody is telling is that the session boundary was doing security work, and it is gone.
A full-read SSRF in the unstructured library lets attackers read cloud metadata and loopback admin APIs through any agent that ingests URLs. The fix belongs upstream, not in your config.
Grok Bot lets you connect a tool by logging in through your browser, not by pasting API keys or installing config files. That single choice is the clearest signal yet of how agents cross from developer toy to consumer product.
The new --restricted flag lets you strip an agent's ability to run commands or fetch the web before it starts. It's a small feature that flips the agent trust model from top-down to user-controlled.
CVE-2026-49468 let a crafted Host header slip past LiteLLM's auth gate. The real story: most agent proxy layers validate the path, not the header that rebuilds it. Audit your upstream now.
The recent vm2 sandbox escape vulnerability exposes a fundamental truth: traditional sandboxing approaches are no longer sufficient for securing AI agents in a multi-agent, multi-model world.
