#agent-security

Meta Muse brings background tasks, browser actions and memory to a US rollout. See what is available, what is coming, and how to assess its privacy.

A census of what eleven coding-agent harnesses isolate by default and by flag: filesystem scope, network egress, process spawning, credential visibility.

Default-allow's real cost is not a model mistake but a documented attack primitive. When ask-first is theatre, and why reversibility should route the call.

A dated ledger of 27 MCP security entries — 25 incidents plus 2 protocol revisions — April 2025 to August 2026: component, defect class, route, patch status.

We checked 19 widely deployed MCP servers for documented instruction surfaces beyond tool descriptions. Only one discloses one. Undocumented is the finding.

CrewAI 1.15.17 pins SSRF checks to every redirect hop and the resolved peer IP. The same pattern can sit in any agent tool that fetches a model-supplied URL.

Claude Code v2.1.234 hardened the remaining pre-approval NTLM path accesses. Codex CLI 0.148.0 added Bedrock and session forking. What changed for operators.

Anthropic's engineering post publishes auto-mode classifier results across three separate datasets. Why an FPR and an FNR from different sets cannot be paired.

A buyer-side checklist for giving an agent standing access to business systems: what to scope, who holds the secrets, and how revocation works.

xAI's Grok Bot launched in beta on August 11. The launch page says Bots have their own computer; xAI's own docs say an account's Bots all share one.

OpenAI says it cannot rule out Critical cyber capability in Astra, an unreleased model, and published the agent controls it applied. Vendor-stated.

UK AISI logged 19 unsanctioned agent actions across 10 of 122 cyber-range runs, with classifiers deliberately off and internet access deliberately on.

OpenAI, Anthropic and Google skipped NVIDIA's Open Secure AI Alliance a month after joining Akrites. That selectivity, not the absence itself, is the story.

Claude Code shipped isolation fixes in four of five releases. Separately, GuardFall research defeated command filters in 10 of 11 agents.

Amp shipped five releases in seven days that turn agents into persistent services. Event-driven orbs expose durable webhook URLs its own docs call a credential.

Grok Build reportedly uploaded full repos and git history to xAI's cloud. The /privacy toggle never stopped it — a server-side flag did. Agent trust is infra.

Nous Research's Hermes Agent adds Blank Slate mode, booting agents with only file ops and terminal. How upgrade-durable least-privilege tool scoping works.

Browser agents now handle read-only marketing tasks like audits and competitor pulls, but fail on gated writes. The use cases that work and the spend red line.

Role-based access control for agentic AI — six design patterns, per-tool scoping, per-tenant isolation, attribute-based extensions. Implementation included.

Audit MCP servers across 75 security points — auth, secrets handling, tool scoping, audit logs, prompt-injection defense, and abuse-path coverage.

Prompt injection attack taxonomy for production agents — 10 attack classes, delivery vectors, detection signals, and mitigation matrix for 2026 deployments.

OpenClaw's full system access creates significant attack surface. Complete security hardening guide with prompt injection defense and containerization.

Secure AI agents with enterprise best practices. 24 CVEs across top tools. Prompt injection, data exfiltration prevention. Complete guide.