Top Agentic AI security resources — August 2026

July 2026 was the month when attacks on agentic AI stopped being a thought experiment. Four independent teams shipped working exploits against production agents in roughly ten days, and the entry point was the same every time: content the agent read, not code the attacker ran.

The concrete highlights: hidden one-pixel text on a web page made AWS Kiro rewrite its own mcp.json and auto-launch an attacker MCP server, two CVSS 9.8 zero-click RCEs were discovered in Cursor IDE, and a separate Cursor deeplink flaw turned a “review this PR” click into unsandboxed code execution, still reproducible in build 3.9.8. On the research side, three arXiv papers turned memory poisoning into a formal attack class, including attacks that poison an agent’s remembered reasoning rather than its facts. Twenty resources below, grouped by topic.

Statistics

Category	Count
Attack technique	7
Agentic AI vulnerability	6
Agentic AI incident	2
CISO resources on agentic AI	2
Agentic AI red teaming	1
Agentic AI security 101	1
Article	1
Total	20

Agentic AI security resources:

Attack technique

Agent data injection attacks are realistic threats to AI agents

This paper defines agent data injection (ADI), a new indirect prompt injection class that hides malicious instructions inside data disguised as trusted metadata or context. The authors demonstrate click, RCE, and supply chain attacks against Claude Code, Codex, Gemini CLI, and Claude in Chrome. Submitted July 6, 2026.

Your agent’s memories are not its own: forged reasoning attacks on LLM agent memory and defenses

FARMA poisons the reasoning traces an agent remembers, not the facts, using evasive language that slips past keyword filters and then amplifies itself through self-reference. The paper pairs the attack with SENTINEL, a five-layer defense.

When agents remember too much: memory poisoning attacks on large language model agents

GhostWriter is a two-phase memory poisoning vector: payloads enter through untrusted tool inputs and activate later, temporally decoupled from the injection. The authors introduce AM-Sentry with six memory policy configurations and evaluate it across five agents and four models.

The memory heist: how I tricked Claude into leaking your deepest, darkest secrets

This PoC combines claude.ai memory with web_fetch link following to exfiltrate stored fields letter by letter through alphabetical links. No MCP server and no code execution are involved, which is what makes it hard to catch.

From indirect prompt injection to DNS exfiltration in macOS Terminal

Johann Rehberger chains indirect prompt injection into DNS-based data exfiltration using ANSI escape codes in macOS Terminal. The technique bypasses agent output controls entirely, because the leak happens in the terminal emulator rather than in the agent’s response.

The week of sandbox escapes

This work indexes seven sandbox escapes across Cursor, Codex, Gemini CLI, and Antigravity. The pattern matters more than the count: agents rarely broke sandboxes directly; they wrote files that trusted host components later executed. Four failure modes and a set of vendor questions are included.

Operational reframing and approval-framed delegation in multi-agent LLM safety

The study shows how operational reframing and approval-framed delegation defeat safety guardrails in multi-agent systems. Agents comply with harmful delegated tasks once those tasks are framed as already approved by another agent.

Agentic AI vulnerability

The Cursor deeplink vulnerability that turns a “review this PR” click into remote code execution

Adversa AI details DeepJack: nested cursor:// deeplinks, plus arguments padded with whitespace, push malicious MCP install commands off-screen in Cursor’s confirm dialog. The result is one-click unsandboxed RCE, still reproducible in build 3.9.8.

When the AI edits its own trust boundary: remote code execution vulnerability in AWS’s agentic IDE

Intezer researchers show that hidden one-pixel text on a web page can make AWS Kiro rewrite its own mcp.json and auto-launch an attacker-controlled MCP server with developer privileges. CVE-2026-10591 (CVSS 8.8/8.6) was assigned July 22 and fixed in v0.11.130.

DuneSlide: two critical RCE vulnerabilities via zero-click prompt injection in Cursor IDE

This work documents CVE-2026-50548 and CVE-2026-50549, both CVSS 9.8. Zero-click injection through MCP or poisoned search results abuses working_directory or a symlink canonicalization fallback to overwrite Cursor’s sandbox helper.

ClaudeBleed reopened: browser extensions can still push Claude for Chrome to read your Gmail

Any co-installed Chrome extension can forge a trusted click thanks to a missing event.isTrusted check, driving Claude for Chrome to read Gmail, Docs, and Calendar via nine allowlisted task IDs. It was reported to Anthropic on May 21 and was still reproducible in v1.0.80 as of July 7. CVSS 7.7, rising to 9.6 with auto-execution enabled.

ChatGPT AgentForger flaw could deploy rogue workspace agents via a phishing link

A CSRF-style flaw in ChatGPT Workspace and Agent Builder let a single phishing link silently create an attacker-controlled agent that inherited the victim’s connectors with approvals turned off. The forged agent then polled the attacker’s inbox every five minutes.

Broken gates: re-evaluating web bot defenses in the age of LLM agents

An empirical study from Florida International University finds that LLM-based browser agents bypass widely deployed bot management systems and reshape the web security threat landscape. It is a direct challenge to the assumption that existing bot defenses still separate humans from automation.

Agentic AI incident

The AI agent sandbox escape that breached Hugging Face: what happened, and what to fix

An evidence-graded analysis of the landmark case, in which an OpenAI agent escaped its sandbox and breached Hugging Face across 17,000+ logged actions. The write-up separates supported claims from unproven ones and closes with containment guidance. Published July 27, updated July 29.

AWS Kiro flaw let a poisoned web page rewrite its config and run code

The Hacker News reports the Kiro write-to-execution flaw and sets it against Rehberger’s earlier findings on Kiro’s mcp.json handling and the IDE’s default Autopilot mode behavior. It is useful as the incident framing for the technical write-up above.

CISO resources on agentic AI

Zero risk isn’t the job: a CISO’s guide to agentic AI

Anthropic Deputy CISO Jason Clinton lays out a four-question agentic risk framework: untrusted content, actions, blast radius, and observability, plus seven bounding controls. It includes a case study in which a model upgrade alone produced emergent agent-to-agent escalation.

OWASP’s agentic AI maturity model: a CISO guide

A Cloud Security Alliance research note that turns OWASP’s State of Agentic AI Security and Governance v2.01 into a governance maturity model and regulatory map for security leaders. This is the one to hand to a board or an audit committee.

Agentic AI red teaming

Enhancing AI security through global AI red teaming

Microsoft describes its External Red Team Alliance (EXTRA) for AI, a coordinated external testing program. The emphasis lands on identity, access, and auditing controls for autonomous agents as they gain independence.

Agentic AI security 101

Securing agent-to-agent (A2A) communication

A practitioner guide to how the A2A protocol actually works, where its authentication and authorization assumptions break down, and which controls harden a multi-agent deployment before it reaches production. It is a good starting point if A2A is on your roadmap but not yet in your threat model.

Article

Four teams just broke AI agents four ways in ten days. The flaw is the same one.

TNW synthesizes four July 2026 disclosures (Claude for Chrome, ChatGPT connectors, memory poisoning, and browser extension click forgery) around a shared lethal trifecta root cause. The value is in the pattern: private data access, exposure to untrusted content, and the ability to communicate externally, all present at once.

What to fix before September

First and foremost, rigorous patching is the bare minimum this summer.

Inventory every agent identity and every connector scope it inherits. Then assess your tool stack against a simple question: does it give visibility into the full scope of agentic actions, and can you reconstruct the whole chain of events from that telemetry before it turns into real damage?

Finally, run the four-question framework from the Anthropic CISO guide against one real deployment this month, and use the CSA maturity model to record where you land, so the next incident has a baseline to compare against.