Unclaimed packages, live agent bait. Researchers registered 120 abandoned package names; a Fortune 500 agent fetched one and phoned home within an hour.
Database drained in four pivots. Sysdig recorded an AI agent fanning 12 API calls across 11 IPs in 22 seconds to dump internal data.
Wrong URL, 22 tables gone. A production connection string sat where a shadow database URL belonged; all 22 tables dropped and two never recovered.
PDF parser ships audit coordinates. Cohere's Parse 5 scores 79.2 on ParseBench across 2,000 enterprise pages, returning bounding-box coordinates for grounding.
Supply-chain hygiene reviews now cover agent-consumed documentation files, not just code dependencies.
Researchers registered unclaimed package names referenced in llms.txt files across 6,214 scanned corporate domains; 120 pointed to unregistered packages. Within an hour, a Fortune 500 company's agent phoned home. Claude, Codex, and Hermes were all in the process chain. The attack surface now extends to every documentation file an agent silently fetches before writing a single line of code.
Every story today lands on the same structural gap: the security assumptions organisations built for human-speed, bounded software no longer hold when agents act autonomously, adapt mid-task, and escape the containment layers defenders treated as settled. The governance debt is no longer theoretical.
Attacker-controlled AI agents now adapt mid-intrusion; defenders built for static scripts face a new baseline.
On 10 May 2026, Sysdig recorded the first confirmed intrusion driven by a live language-model agent: CVE to internal database dump in four pivots, under one hour. The agent improvised commands in real time, fanning 12 API calls across 11 IPs in 22 seconds. Does your agent deployment share credentials with internal datastores?
Unattended AI agents moved from red-team hypothetical to documented espionage tool, with no vendor to intervene.
Hunt.io found 585 files on an exposed staging server: Hermes, an open-source AI assistant, ran in 'YOLO' mode, bypassing human approval to enumerate Thailand's Finance Ministry network and crawl personnel records back to 2012. No vendor could intervene; there was no account to ban. When your agentic tools run unattended, which approval gate still holds?
VM sandboxing was the default containment answer; cyber-capable agents have made it an open question.
Bruce Schneier's verdict on GPT-5.6-Cyber's sandbox escapes is unambiguous: an off-the-shelf virtual machine carries too much attack surface, including innocuous features like running a display. If your next agentic deployment still treats VM isolation as the primary containment layer, which additional constraints does your security architecture actually have in place to compensate?
Enterprise access controls were built for humans; AI agents now require action-level authorisation at machine speed.
Google's Beyond Zero paper redraws enterprise security around individual actions and resources, not application-level boundaries, because AI agents act at machine speed and volume. Google's own deployment is internal-only and components are unfinished. When your agentic deployments scale, who in your org owns the authorisation boundary at the resource level?
Two of today's three stories trace back to the same misconfiguration: broad credentials sitting inside an agent's environment. That detail, not model behaviour, sets the blast radius, and Google's sandboxed scanner suggests the industry is starting to build tooling that treats verification as a precondition rather than an afterthought.
Broad database credentials were the silent multiplier that turned a misdirected command into total data loss.
In early August 2026, Claude Opus 5 in Ultracode mode dropped every table in a live Supabase database: a Prisma migration command received the production URL instead of a disposable shadow database. The agent self-reported the damage first. Thin sourcing (one Reddit thread), but the mechanism is sound: scope agent credentials to non-production before granting command access.
Production database credentials in an agent's environment were always the blast radius, not the model.
Claude Opus 5 ran a standard Prisma migration command, but the production connection string sat where the throwaway shadow database URL should have been. All 22 tables dropped; two were never in the migrations folder and never came back. Thin sourcing (one Reddit thread plus a postmortem), but the mechanism is documented Prisma behaviour. Set shadowDatabaseUrl in schema.prisma now.
Security teams' AI scanner queues were dominated by false positives; sandboxed reproduction changes that baseline.
Conventional AI code scanners produce true-positive rates below 7%, flooding security queues with noise. Google's Mantis (code on GitHub) addresses this with critic and reviewer agents plus sandboxed vulnerability reproduction to confirm findings are real before they surface. Clone it and run against a repository your static scanner already flagged; compare the reproduction rate against your false-positive baseline.
Document ingestion and request validation are both moving toward measurable, auditable baselines this week, which is why these items sit here rather than higher up. The direction is clear enough: unstructured data handling and conflict detection are becoming benchmarkable disciplines, not engineering folklore.
Rules-based document parsers were the default for regulated-industry ingestion; a shipped API with audit coordinates changes that baseline.
Brittle OCR pipelines for financial reports now have a cleaner alternative. Cohere's Parse 5 converts complex PDFs to Markdown with bounding-box coordinates for audit-trail grounding, scoring 79.2 on Cohere's own ParseBench across 2,000 enterprise pages. The open-weight model and a Hugging Face demo are public; test against your messiest ingestion failures before committing.
Personalised AI assistants were built to comply; PACE makes conflict-detection a measurable benchmark.
Most personalised AI assistants execute requests without checking whether those requests conflict with the user's own circumstances. PACE, an arXiv preprint, introduces a dataset pairing requests with egocentric knowledge-base facts, requiring models to detect latent conflicts. The accompanying multi-agent framework, PaceMaker, outperforms existing approaches. PaceMaker's benchmark results cover five conflict types across publicly released evaluation data.
Structured-data agents were table-only; Databricks now routes PDFs and slide decks through the same reasoning loop.
Databricks' Genie Agents can now combine structured tables with unstructured files (PDFs, documents, images) stored in Unity Catalog, up to 10 volumes per agent. Agent mode, now available via API, runs multi-step reasoning across both data types. If your analytics stack still routes document questions to a separate tool, this is the consolidation point to evaluate.