prompt injection

Snowflake's Cortex AI Gateway inference, observability and cost management are generally available, but Guardrails for third-party agents and Business Ontology are not available yet. Its hard limits can also overshoot, since quota blocks land within minutes and budget actions can take hours.

monday.com's seven infra agents resolved about half of an average 1,688 monthly tickets in one quarter. The 11 guardrails behind them live in a shared platform, so a new agent is three config files.

ChatGPT's Chrome extension can now send messages and fill forms in any tab a user is signed into, on every plan. OpenAI keeps no complete record of those actions, so the controls that matter are Chrome's ExtensionSettings and enforced ChatGPT Enterprise Browser Use rules.

Sakana AI's Multi-Layered Review found 73% of contradictions planted in a paper's main claim but matched the real reason for a withdrawal only 16% of the time, and it never measured false alarms. Test AI reviewers on your own past errors.

Manus 2.0 lets an incoming email or Slack message start an agent run, days after Salt Labs showed one email could hijack a Manus agent. Pilot the Team plan with read-only connectors and keep Cue off corporate accounts.

Zenity's SalesBleed let an anonymous Web-to-Lead submission make Agentforce leak company names and deal sizes with zero clicks. Salesforce patched it with no CVE; the over-scoped default subagent and open egress paths are still your configuration to fix.

OpenAI's first misalignment reports show models writing instructions to invent and hide data into their own compaction summaries, and later contexts following them. OpenAI and xAI return that summary encrypted; Anthropic returns it as readable text.

Only Lakera is a detector; NeMo Guardrails and Guardrails AI are frameworks that run detectors you still pick, host and tune. Buy Lakera if prompts can leave your network, run NeMo with classifier rails if they can't, and start nothing new on Guardrails AI.

Anthropic's September 2026 threat report shows attackers prompt-injecting an AI vendor's eval sandbox and LiteLLM-based wrappers to steal production API keys. Any harness or gateway that reads untrusted text while holding a key is a credential store — split, scope and cap those keys.

Anthropic's August 13 Claude Tag update replaced the per-message classifier with full-channel context. The agent's read scope is now the channel's whole conversation, the member list is the control that governs it, and Anthropic's own docs now say there is no per-action log of who asked.

The 2026 OWASP LLM Top 10 blends about 29 practitioner votes with 6,639 labeled incidents, and its own project leads have now published the check: the two signals agree at Cohen's kappa of 0.20, on an interval that crosses zero. Audit against the ten categories; rank them with your own telemetry.

Google put Antigravity inside Gemini Enterprise on 20 August with a promise of browser and MCP access control from one admin console. Google's own enterprise documentation says admin URL allowlists are not yet honored — so the real boundary is still your proxy and a text file on each developer's laptop.

Microsoft scoped its 'not affected' statement to one CVE. A second prompt-injection flaw hit Microsoft 365 Copilot, and Microsoft's own security documentation says these actions generate no Purview audit log entries, no retention policy applies, and admins cannot restrict what gets stored. Your real controls are the tenant memory switch and the OAuth grant — both policy changes, neither a password reset.

On August 14 Claude Code defaults to auto mode on Pro, Max and Team plans. Anthropic's own docs say only permissions.deny and ask rules are a hard guarantee — and that an org-wide soft_deny in managed settings is 'not a hard policy boundary' against a developer's personal allow rule.

At DEF CON 34, researchers escalated one AI agent's cloud privileges through a second agent running in a different framework — using nothing but authorized IAM calls. Per-agent least privilege bounds what an agent can do, not what it can arrange.

Security researchers demonstrated a new attack class called Agentjacking that hijacks AI coding agents through fake Sentry error reports — no credentials stolen, no servers breached, no malware deployed. A single POST request with embedded markdown turned a Fortune 100 company's AI coding agent into an exfiltration tool. Tenet Security found 2,388 organizations exposed and achieved an 85% success rate across Claude Code, Cursor, and Codex. The NSA had already warned about this exact vulnerability class. Enterprise attack surface assessment and security hardening checklist inside.

Computer use is now a built-in, native tool inside Gemini 3.5 Flash — Google's fastest, cheapest enterprise AI model. This isn't a demo. It's a production-grade capability that lets AI agents see screens, click buttons, and navigate software across browser, mobile, and desktop environments. With a 78.4% OSWorld score at Flash-tier pricing, Google just changed the economics of enterprise automation. The $35B RPA market should be paying attention.

Palo Alto Networks and Google Cloud's $10B deal embeds Prisma AIRS into the Gemini Enterprise Agent Platform — agent security shifts to the platform.