Changelog

Every change, dated

New resources, incidents, and link fixes, newest first. Also available as an Atom feed; the full history is in the repository.

3 Nov 2026Update#

Stage 1: Where You Inject Matters: The Trust Region Effect in LLM Agents (Guo et al.), the same injected instruction lands 2.6 times more often in a README or TODO file than in code or data.
Stage 3: Design Tenets for Agent Identity Management Systems (Booth, Fisher, Galluzzo, Clancy; NIST and MITRE), ten tenets for agent identity and authorization, including separation of policy from reasoning.
Stage 5: Blocking at the Boundary (Liu, Han, Lyu, Wang, Yu), a preprint on auditing each pending action against staged prompt injection in Claude Code and Codex.
Stage 7: INFUSE (Nguyen, Guo, Dubauskas, Damuluru, Johnson, Leach), an indirect prompt injection benchmark across 19 LLMs with code.
Stage 8: The Secure Software Factory: A Reference Architecture (Agent Baseline), four boundaries enforced outside the agent at three levels of autonomy; draft, open for comment.

Malicious Claude Code extension in Cursor's marketplace (Cursor), modified extension versions that planted an SSH key and persistence on Oct 29.
Unauthorized AI relays switch the sandbox off (Symantec), a relay that reconfigures genuine Codex and Claude Code CLIs to "danger-full-access" and routes traffic through its own servers.
MCPhantom (Glow Labs), coding agents installing archived MCP reference servers from training-data memory.

29 Oct 2026Update#

Stage 3: Authority Is Not a String (Bouras, Dai, Mechtaev), CapScope: typed capabilities held outside the model, checked on every tool call.
Stage 6: LLM Agents Can Easily Tamper With Their Own Traces (Qin, Schmotz, Prinzhorn, Beurer-Kellner, Prabhu, Andriushchenko), why trace logging must sit outside the agent's control.
Stage 7: buried-injections (Rudratosh Shastri), a reproducible benchmark of 10 injection detectors on 629 AgentDojo attacks.

Mistral Vibe shell permission bypass (SecMate), a permission check that parsed one thing while the shell ran another; advisory.
Accessing and changing internal systems during dashboard research (OpenAI), a model that reverted a setting but kept the token it had obtained.

22 Oct 2026Update#

Stage 3: MCP Tool Exposure is a Privilege Grant: A Two-Gate Authorization Model (Badal Bhushan, CSA), capability admission versus per-call execution authorization.
Stage 3: ToolFence (Li, He, Dai, Xiao), a preprint on typed authorization blueprints enforced by a deterministic monitor.
Stage 5: Agent Governance Toolkit (Microsoft), open-source policy enforcement, zero-trust identity, and execution sandboxing for agents.

Claude models reached real systems during cyber evaluations (Anthropic), a misconfigured evaluation environment left the internet open.
A Vault with a Heap-View on AWS AgentCore Harness (Unit 42), prompt injection to credential exfiltration through a default shell tool.

21 Oct 2026Update#

Stage 3: OWASP Agent Control Standard, runtime hooks and portable policy enforcement.
Stage 3: Loopjacking (Adithyan Arun Kumar), how human approval gets decoupled from the executed action.
Stage 4: CoSAI MCP Security v2.0, four assurance levels and eight security dimensions.
Stage 7: OWASP GenAI Red Teaming Manual v1.0 (published 2026-10-20).
Stage 8: CoSAI Zero Trust for AI Systems.
Learn and practice: Learn Agent Security From Scratch.

MITRE ATLAS entry now points to the v2026.09 release (new agent recon and trigger-channel techniques).

MCP Security Best Practices and Snyk Agent Scan links still resolve. The MCP page now covers state handle hijacking (stateless protocol) instead of session hijacking.

21 Oct 2026Launch#

9 roadmap stages, from threat modeling to governance, with 50+ verified resources.
The fenced agent reference architecture diagram.
The fenced agent production checklist (17 items across Contain, Constrain, Record, Prove).
4 incidents worth studying: EchoLeak, the GitHub MCP exploit, agent framework RCEs, and indirect prompt injection in the wild.

NeMo Guardrails moved to NVIDIA-NeMo/Guardrails.
PyRIT moved to microsoft/PyRIT.
mcp-scan is now Snyk Agent Scan (snyk/agent-scan).
OpenTelemetry GenAI conventions moved to open-telemetry/semantic-conventions-genai.
Lakera Gandalf now lands on Agent Breaker.
LLM Guard (Protect AI) was archived in July 2026 and is not listed.