Your agents have hands

The taxonomy caught up in December

OWASP published a separate Top 10 for Agentic Applications on 9 December 2025. It is the first serious attempt to name what actually goes wrong, and it is worth knowing by heart because your vendors will start quoting the identifiers at you.

Tool poisoning, and the confirmation dialog that does not help

The most instructive of these is ASI04, and the disclosure that named it is worth reading in full.

In April 2025, Invariant Labs demonstrated that a malicious Model Context Protocol server can embed instructions inside a tool description, the metadata the agent reads to understand what a tool does. The agent reads that description as part of its context. The instructions execute.

Their demonstration exfiltrated SSH keys and configuration credentials. The detail that should worry anyone relying on human oversight is that it succeeded even with user confirmation enabled, because, in their words, the user is only shown a simple summarized tool name, where tool arguments are hidden. The human approved something. It was not the thing that happened.

They documented two further variants. A rug pull, where a server changes its tool description after the client has already approved it. And tool shadowing, where a malicious server injects instructions that alter the behavior of a different, trusted server, letting an attacker hijack an agent without ever appearing explicitly in the agent's user-facing interaction log.

Microsoft confirmed the pattern in June 2026, warning that poisoned MCP tool descriptions can drive agents to exfiltrate data without alerting anyone, and citing the MCPTox benchmark finding poisoned-tool attacks effective at rates as high as 72.8%. Microsoft's framing of the root cause is the most useful sentence written about agent security this year: the weakness is not in any one system, it lives in the trust boundary between them.

The NSA and Carnegie Mellon's Software Engineering Institute published a Cybersecurity Information Sheet on MCP security in May 2026 naming eight threat classes, including one that deserves its own mention: output poisoning, where tool outputs may be misinterpreted as executable prompts rather than passive content. Your agent calls a tool, the tool returns data, and the data is instructions.

It is not theoretical, and it has not been for a year

EchoLeak, CVE-2025-32711, disclosed in June 2025 by Aim Security, was the first zero-click prompt injection in a production LLM system. Malicious instructions hidden in an ordinary email or document caused Microsoft 365 Copilot to exfiltrate data through image URL references. No user interaction. Microsoft patched it server-side.

SearchLeak, CVE-2026-42824, found by Varonis Threat Labs and disclosed on 15 June 2026, was worse. A parameter-to-prompt-injection chain combined with HTML injection and server-side request forgery turned Microsoft 365 Copilot Enterprise into a one-click data exfiltration tool: email content, one-time passcodes and multi-factor codes, password-reset links, calendar detail and private files. Microsoft rated it critical.

Indirect injection in the wild. On 2 July 2026, Zscaler ThreatLabz documented two live campaigns using search-engine poisoning plus hidden CSS and JSON-LD to plant instructions for autonomous browsing agents. In testing across 26 models, four actually executed fraudulent payments, and two more misclassified a typosquatted crypto site as legitimate. This is no longer a laboratory finding. Somebody is running it as a business.

GTG-1002. In November 2025, Anthropic disclosed what it assessed with high confidence to be a Chinese state-sponsored cyber-espionage campaign in which AI performed 80 to 90% of the work, with human operators intervening at only four to six critical decision points. Around 30 targets across technology, finance, chemicals and government. It succeeded in a small number of cases, which is the honest framing and also not especially comforting. At peak the system made thousands of requests, often several per second.

Anthropic's follow-up analysis in June 2026, covering 832 accounts banned for malicious cyber activity over twelve months, found 67.3% using AI to write malware and the proportion of medium-risk-or-higher actors rising from 33% to 56% between the first and second halves of the period.

JADEPUFFER. On 1 July 2026 Sysdig documented what it describes as the first complete LLM-driven ransomware attack. An agent autonomously exploited an unauthenticated remote code execution flaw in Langflow, harvested credentials, self-corrected a failed login in 31 seconds, and encrypted all 1,342 configuration items in a Nacos service database. The payloads contained natural-language commentary explaining each action, which is a genuinely strange thing to find in an incident response. The encryption key was ephemeral and never transmitted, so the victim could not recover the data even by paying.

It stopped being theoretical

Documented AI-specific security incidents and disclosures, December 2023 to July 2026

1. Dec 2023

   Chevrolet dealership chatbot

   Prompt-injected into agreeing to sell a Tahoe for $1. Never honored, never litigated.

2. Feb 2024

   Moffatt v. Air Canada

   Tribunal rejected the argument that a chatbot is a separate legal entity. The airline owns what its bot says.

3. Jun 2025

   EchoLeak, CVE-2025-32711

   First zero-click prompt injection in a production LLM system. Microsoft 365 Copilot exfiltrated data with no user action.

4. Nov 2025

   GTG-1002 espionage campaign

   AI performed 80 to 90% of a state-sponsored campaign against ~30 targets. Humans intervened at 4 to 6 decision points.

5. Jun 2026

   SearchLeak, CVE-2026-42824

   One-click exfiltration from M365 Copilot Enterprise: email content, OTP and MFA codes, password-reset links.

6. Jun 2026

   Five Eyes joint statement

   Six national cyber agencies: “The timeline is not years, it is months.”

7. Jul 2026

   Indirect injection in the wild

   Two live campaigns using SEO poisoning to instruct browsing agents. Four of 26 tested models executed fraudulent payments.

8. Jul 2026

   JADEPUFFER

   First fully agentic ransomware. Self-corrected a failed login in 31 seconds. Key never transmitted, so paying could not recover the data.

• Incident
• Early warning
• Agency statement

Sources: AI Incident Database #622; Moffatt v. Air Canada 2024 BCCRT 149; Aim Security / Microsoft (EchoLeak); Anthropic, “Disrupting the first reported AI-orchestrated cyber espionage campaign”, 13 Nov 2025;

Varonis Threat Labs (SearchLeak), 15 Jun 2026; Five Eyes cyber agencies, “The AI shift in cyber risk”, 22 Jun 2026; Zscaler ThreatLabz, 2 Jul 2026; Sysdig, 1 Jul 2026.

Why filtering words is not the control you need

Almost every product in this category inspects the prompt. That matters, and we do it across thirteen layers. But for an agent it is the wrong last line of defense, for a simple reason.

The prompt is not where the damage happens. The action is.

An agent can be goal-hijacked through a channel you never inspected: a poisoned tool description, a corrupted memory entry from three sessions ago, a document retrieved from your own SharePoint, the output of another agent you trust. You cannot filter every one of those inbound channels, because some of them are internal and some of them did not exist when you wrote the policy.

What you can do is gate the outbound action. Before the tool call executes, deterministically:

• ✓Is this tool on the allowed list for this agent, in this context, right now?Included
• ✓Do the actual arguments, not the summarized name, fall inside the permitted envelope?Included
• ✓Does the action exceed a rate, spend or scope ceiling for this session?Included
• ✓Does the output about to leave contain data that is not permitted to leave?Included
• ✓Is this a destructive or irreversible operation that requires a human who has seen the real arguments?Included

Those checks do not need to understand intent, and they do not need to guess whether the agent has been manipulated. They need to be true or false, evaluated the same way every time, with the answer written to a log with a rule identifier next to it. Which is exactly the kind of thing determinism is for, and exactly the kind of thing a probabilistic judge is bad at.

Five things worth doing this quarter

• Inventory the agents. Not the models. The agents. Which ones exist, who deployed them, what tools each one holds, and whose credentials they act under. Most organizations cannot answer this, and ASI10 exists because of it. Shadow AI turned up in 43% of breached organizations in IBM's 2026 study, against 20% the year before.
• Audit the tool descriptions. Read them as an attacker would. Every MCP server and plugin in your dependency graph is code you did not write, in a channel your agent treats as instructions. The npm package postmark-mcp shipped fifteen clean releases before injecting malicious code in the sixteenth.
• Fix the approval dialog. If your human-in-the-loop step shows a tool name and hides the arguments, you do not have a human in the loop. You have a human being asked to rubber-stamp something they cannot see.
• Set spend and rate ceilings per agent. Not per organization, per agent, per session. An agent in a loop is functionally indistinguishable from a cost-amplification attack until the invoice arrives.
• Test on a schedule, not at procurement. Your agents get new tools, your models get swapped and the technique catalog changes monthly. A test from March describes March.

The reframe

The last two years of AI security have been spent asking whether a model can be talked into saying something bad. That was the right question for chatbots.

The question now is what your systems are permitted to do, and whether that permission is enforced by something an attacker can argue with. Because your agents have hands, and text is how somebody reaches them.

‹ All articles

Do not take our word for it. Run AI-Sentinel against your own traffic.

Monitor mode goes in non-blocking, in minutes, with zero risk to live workflows. Within days you get a written audit of the prompt injections, extraction attempts and data leaks your current stack is not catching. Then you decide.

The audit is free. The blind spot is not.