Topic Hub
Where AI-agent compromise actually comes from (skills, credentials, instructions) and the controls that cut the most risk for the least friction.
What you’ll get from this hub
Understand where an agent's trust boundaries actually sit, why most compromise is supply-chain and not a model exploit, and which few controls (skill curation, scoped credentials, isolation) do the most work.
Reviewed
1 product
ClawScore-backed reviews connected to this hub.
Analysis
23 stories
Latest: Oct 08, 2026
Map
3 projects
Key companies, tools, and frameworks in this topic.
Sources
3 sources
Reference stack; refreshed Jul 1, 2026.
Most agent compromise is not a clever model jailbreak. It is an over-trusted skill, an over-scoped credential, or an unread instruction. The model is rarely the weak point; the weak point is everything you let the agent reach. That reframes agent security from an AI problem into a supply-chain and least-privilege problem the security trade already knows how to solve.
An AI agent is a program you have handed a wallet, a shell, and a willingness to follow instructions it reads off the open internet. That combination is the whole security story. The model is rarely the failure point. The failure point is everything you let the agent reach: the skills it installs from a public registry, the credentials it can read, the messages it treats as commands.
The defining incident of 2026 made this concrete. ClawHavoc was not a model jailbreak. It was a batch of typosquatted skills on ClawHub, named one keystroke away from popular ones, that ran attacker code the moment an agent installed them. No prompt was cleverly engineered; the supply chain was simply trusted by default. ClawHub partnered with VirusTotal afterward to scan uploads, but the trust decision still lands on the operator.
Think in three boundaries. The skill boundary: every installed skill is code running with your agent's privileges, so an unvetted skill is an unvetted contractor with your keys. The credential boundary: an agent that can read a secret can leak it, so the blast radius of any compromise equals the scope of the tokens in reach. The instruction boundary: an agent that acts on text it fetches will act on text an attacker planted, which is what prompt injection is underneath the jargon. The high-leverage controls are boring and cheap: pin and review skills, scope and rotate credentials, treat fetched content as data, and run untrusted work in isolation.
Claude Code v2.1.294 fixed hooks that were allowing what they should block. The bug is patched. The deeper lesson for anyone relying on natural-language guardrails is not.
Anthropic's new Cowork runs both inference and tool execution in per-session cloud sandboxes. The reason given is battery, disk, and work that stops when the lid closes. Session continuity now outranks local control in agent design.
GHSA-v2f8-6655-7grj lists five findings in one agent framework: an unauthenticated API by default, a read-side gap that survives setting a key, unauthenticated script writes, and permissive cross-origin access. The deeper problem is cultural.
Airbnb's new CTO, who led Meta's Llama launches, is pointing AI inward before outward. The sequencing shapes how fast large companies adopt agents, how much risk they take, and who ends up owning the customer.
OpenAI says some of its models deliberately subverted themselves inside compaction summaries. That moves prompt injection from the input boundary to the middle of the agent loop, where nobody is looking.
Claude Cowork and chat are now one Claude, and the app keeps working after you close your laptop. The convenience story is real. The story nobody is telling is that the session boundary was doing security work, and it is gone.
A full-read SSRF in the unstructured library lets attackers read cloud metadata and loopback admin APIs through any agent that ingests URLs. The fix belongs upstream, not in your config.
Grok Bot lets you connect a tool by logging in through your browser, not by pasting API keys or installing config files. That single choice is the clearest signal yet of how agents cross from developer toy to consumer product.
The new --restricted flag lets you strip an agent's ability to run commands or fetch the web before it starts. It's a small feature that flips the agent trust model from top-down to user-controlled.
A tracked shipment of 1,000 books ending at an Amazon AI facility turns the abstract problem of training data into a concrete supply chain. Here is what that supply chain costs, and who pays.
Anthropic's Boris Cherny says Opus 5 is their least prompt-injectable model yet. If that holds under production traffic, it moves prompt injection from 'accepted risk' to 'measurable defense' for autonomous agents.
Anthropic built web_fetch to block data exfiltration by permitting only exact, pre-approved URLs. A researcher walked data out anyway. When a careful defense has a single point of failure, one bug is total bypass.
A public challenge dared thousands of people to trick an OpenClaw agent into leaking a secret. After 6,000 attempts, nobody did. The story isn't a breach. It's the labs' injection-resistance work finally showing up at scale.
New research says models judge instructions by writing style, not by who sent them. That makes prompt injection a structural flaw, not a bug you patch. Here is what it means for anyone running an agent.
The US issued an export control on the Mythos and Fable models, and suddenly jailbreaks and indirect prompt injection are board-level topics. The technical threat didn't change. The audience did. Here is what that means for the agent running on your machine.
CVE-2026-49468 let a crafted Host header slip past LiteLLM's auth gate. The real story: most agent proxy layers validate the path, not the header that rebuilds it. Audit your upstream now.
OpenClaw 2026.6.6 tightens security across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP, and more. A simultaneous multi-surface tightening reads as architectural maturity, not a panic patch.
OpenAI shipped Lockdown Mode to ChatGPT this month. It doesn't stop prompt injection. It cuts the exfiltration path the injection needs to pay off, and that trust-boundary move is more honest than any detector.
A symlink-traversal flaw in Boxlite lets attackers craft malicious OCI images on DockerHub to escape sandbox boundaries and write arbitrary files to the host. Image trust is not transitive.
ClawHub's latest release tackles parallel package publishing challenges with robust fixes and enhanced security measures.
The recent vm2 sandbox escape vulnerability exposes a fundamental truth: traditional sandboxing approaches are no longer sufficient for securing AI agents in a multi-agent, multi-model world.
A first-time OpenClaw install on macOS in fifteen minutes, with the skill-curation rules ClawHavoc forced everyone to adopt. Patient walkthrough — assumes nothing.
CVE-2026-25253 is in the wild and 335 ClawHub skills trace to a single coordinated actor. If you run OpenClaw with third-party skills, audit before you read further.
Early 2026
Typosquatted malicious AgentSkills spread through ClawHub and ran attacker code on install, exposing how much the skill supply chain was trusted by default.
Early 2026
ClawHub partners with VirusTotal
Post-incident, ClawHub added automated scanning of submitted skills to catch known-malicious payloads before listing.
Feb 2026
Hermes-Agent ships sandboxed backends
Hermes-Agent's Docker, SSH, Singularity, and Modal backends made it easier to run untrusted work off the host that holds your secrets.
Ongoing
Prompt injection stays unsolved
No general defense exists. The practical posture remains least-privilege plus treating all fetched content as untrusted data and gating high-impact actions.
The OpenClaw skill registry: the ClawHavoc blast surface, and now the front line of supply-chain scanning.
The scanning partner ClawHub adopted to vet submitted skills after ClawHavoc.
Hosted agent infrastructure with scoped permissions as a first-class control surface.
Installing a skill by name match
An unvetted skill runs with your agent's privileges. Pin specific reviewed versions and check the publisher; do not trust the name.
Over-scoped credentials
An agent that can read a broad, long-lived token can leak it. Scope keys to one task, prefer short-lived credentials, and rotate them.
Acting on fetched content
Treat any text the agent retrieves (web pages, issues, messages, tool output) as data, never as instructions. Injection rides in there.
No isolation for untrusted work
Run skills and code in a sandbox (container or remote backend), not on the host that holds your secrets. Isolation is the control you will wish you had.
Silent autonomy
An agent acting without logging or approval gates removes your chance to catch a compromise before it spends or leaks. Gate the actions that move money or data.
