AI Agent Security Incidents: Checklist for Enterprises

Shared credentials in 69% of enterprise agent deployments are the symptom, not the disease. Static API keys break the moment an agent has exploratory permission, because the agent rewires itself between calls and a single scoped token inherits the union of every identity attached to it. The 69% figure from VentureBeat's June research isn't really about bad secrets hygiene. It's about authorization models that were designed for deterministic software trying to govern a system that doesn't behave deterministically. Action-level authorization is the part most teams skip. Karki's claim that an agent in Washington State can't run on California credentials, because jurisdictional rules attach to the action rather than the identity, exposes where scoped credentials stop being sufficient. If governance doesn't travel with the task, the credential is just a door key, not a permission grant. I've watched this exact gap appear in production agent work: a token that looks correct in a static review turns out to authorize an action the data classification rules forbid. The harder problem is provability, and it has to be designed in. Karki's warning that audit trails can't be retrofitted after an agentic system ships is the part most governance roadmaps underweight. If the record of what an agent did can be challenged by an auditor, the license to operate evaporates regardless of how good the model layer is. Treat the agent like an intern with good intent but limited context, run governance outside the agent at every action, and the three-layer model (agent, model, data) holds together. Skip the audit layer and the rest becomes decoration. Have you hit the retrofit problem on an agent system already in production, or is your team still early enough to design provability in from the first action? #ArtificialIntelligence #AI #Cybersecurity #SoftwareDevelopment #LLMs

Pretty awesome capabilities on how we protect the ways your employees look to make efficiencies in their work.. don't be exposed..work smarter and protect/control via Proofpoint's capabilities.

Finding out sensitive data went to Claude is not the same as stopping it before it hits inference. Now Proofpoint and Claude provide this capability natively within our Data Security Platform. An Inference Hook triggers a policy check that runs before sensitive data can reach the model. Our integration puts your existing Data Loss Prevention (DLP) policies inside that check. PII, source code, and regulated records are evaluated against the same rules you already run across email, endpoint, and cloud. When policy returns deny, the model never processes the prompt and the employee gets an explanation in your own words. That last part matters more than it sounds. A block that explains itself is a teachable moment. A block that doesn't is a helpdesk ticket. Detection didn't go anywhere. The Claude Compliance API still gives you visibility into conversations, an audit trail, and the ability to review and act. Prevention is the other half. They ship together and cover both directions: what employees send in, and what comes back. And because the check runs at the inference boundary rather than on the network, it holds across Claude Enterprise surfaces - Chat, Cowork, and Claude Code. Our 2026 AI and Human Risk Landscape Report found nearly nine in ten organizations have moved AI assistants beyond pilot, and 42% have already had a suspicious or confirmed AI-related incident. Adoption already happened. Controls have to extend as fast as the surface is growing. Available now for eligible Proofpoint customers using Claude Enterprise. Built with Anthropic. Written with Bar Katzir. Blog in comments.

A lot of organizations have no AI agent inventory until someone in InfoSec asks a question that requires one. The teams that go looking tend to find the same thing. MCP integrations standing up across separate groups, none registered through any review process. Rarely malicious, usually built by someone solving a real problem, and invisible regardless, the tooling doesn’t know a server exists until a human tells it. That’s the starting condition sitting underneath the 2026 numbers getting passed around. Equixly’s offensive assessment put command injection at 43% of tested MCP servers. Researchers filed more than 30 CVEs against MCP servers in a single 60-day window early this year. Security enthusiasts just found 492 servers exposed to the internet with no authentication at all. The vulnerabilities themselves are unremarkable: missing input validation, absent authentication, blind trust in tool descriptions. Hygiene failures that got waved through while the technology was new and interesting. Remediation is mostly known work. Identity, authentication, least privilege, monitoring, the same controls already running against human accounts and service accounts, applied to agents as first-class principals. Workload identity for agents is where most programs have nothing at all. The expensive step comes before any of that. An inventory has to exist, and in most environments nobody has built one. Which makes the diagnostic a single question: can the organization produce a complete list of the agents running in production right now. Most can’t. That gap stays unglamorous enough that it usually waits for an incident to fund it.

Audit Fix: Audit Readiness for the Post-Mythos Era: Key Takeaways Human-speed compliance is dead. Attackers utilizing modern, autonomous AI tools can chain enterprise misconfigurations and weaponize vulnerabilities in under 25 minutes, rendering manual, periodic audit cycles completely obsolete. The “Configuration Gap” is your biggest blind spot. Organizations take an average of 14 months to remediate basic identity, access control, and logging flaws, leaving […]

🚨 The $88M lost to an AI-driven attack. It’s proof that human-paced security is becoming obsolete. Coinkite attributed the incident in part to threat actors using AI-assisted code reviews to discover latent software bugs at a speed that outpaces human security experts. While Web3 teams still schedule quarterly security reviews, threat actors are running continuous, automated AI exploit pipelines 24/7. Here is what the digital asset space needs to accept right now: -Self-custody is only as "cold" as your firmware. Keeping private keys offline means nothing if your build boundaries can be reverse-engineered by offensive LLMs in minutes. -Compliance won't stop an exploit. The EU AI Act’s August 2 enforcement brings mandatory transparency and auditing standards, but ticking compliance boxes won't patch zero-days. Regulation sets the legal floor; it doesn't build your defense. -Static code reviews are dead. If you aren't using offensive AI agents to continuously red-team your submodules and build boundaries before deployment, you are outsourcing your security testing to threat actors. At Nemean Services, we believe securing critical infrastructure requires matching the velocity of the threat. Compliance gives you accountability, but continuous AI-driven defense is what keeps your assets alive. How is your team evolving its security workflow to counter AI-paced vulnerabilities this year?

Too many companies fall into the same operational trap: they treat software patching as a routine chore that can wait until the weekend or the end of the month. But let’s look at what patching actually is it is simply the act of sealing software vulnerabilities before an attacker can use them against you. Years ago, security teams had the luxury of time to handle this at their own pace. In 2018, it took an attacker an average of two years and three months to exploit a publicly disclosed vulnerability. Fast forward to 2026, and data from VulnCheck and Zerodayclock reveals a terrifying reality: that gap has completely collapsed. The mean time-to-exploit (TTE) has shrunk from over two years to just 9 hours. An attacker now needs only a matter of hours to compromise your network. Meanwhile, traditional enterprise defenses still rely entirely on human intervention. This is where the manual approach completely breaks down: In 2025 alone, over 50,000 new security vulnerabilities were registered averaging roughly 130 fresh threats every single day. No human team can manually analyze, prioritize, and resolve that volume. The Bureaucracy: Manual patching requires triage, risk assessment, change requests, and approvals. This stretches the remediation cycle to full weeks for critical bugs. This massive exposure window is exactly where major breaches occur. This is where Agentic Patching changes the game. By deploying autonomous AI agents, the entire cycle is closed end-to-end without manual friction. These agents continuously monitor threat feeds, assess real-world exposure, test fixes in sandboxed environments, and deploy them automatically via CI/CD pipelines. You cannot counter machine-speed exploits with human-speed workflows; you need an intelligent machine defending at the exact same pace. Source: VulnCheck Report & Zerodayclock Statistics (2026)

The unnerving part of SearchLeak isn't that Copilot had a bug, it's that the stolen data left through traffic the network already trusted, so DLP and CASB waved it past as normal. Swap the vendor and the shape holds for any assistant with broad read access and a path for outside input, which makes this less about one CVE and more about what your AI tools can reach and whether anything would notice it leaving. #AISecurity #DataGovernance #DLP #Kiteworks #imsmartin

An analyst tells a security agent: "Analyse the suspicious accounts created in the last 24 hours." The agent reads the logs, finds twelve anomalies, decides one account is actively malicious — and disables it, using an identity-management credential it legitimately holds for other tasks. Every control returns success. Authentication: valid. Authorization: valid. The tool call: well-formed. And yet nobody asked for remediation. This is not an identity failure. It is the gap between what an agent is permitted to do and what it was actually asked to do — and that gap is not a bug. It is the normal condition of any agent holding standing permissions across many tasks. I've just released a preprint that names this the Agentic Authorization Gap and proposes a way to close it: Intent-Aware Zero Trust (I-ZTA). It keeps the Zero Trust rule that trust is never implicit, but moves the object of that rule from resource access to autonomous action. The core mechanisms: → Delegated intent as a signed object the agent can read but not rewrite → Verification by a component the agent does not control → Authorising the expected effect, not just the API call → Autonomy computed per action, not assigned per agent → Delegation that narrows authority and purpose, never widens either It includes a threat model for what I call Intent Drift — a sequence of individually plausible steps that ends somewhere no single step would have been allowed to go — plus an evaluation design and metrics. Preprint (open access, CC BY): https://lnkd.in/gEi2RPQW Comments and disagreement welcome. This is a proposal, not a result — the evaluation is specified but not yet run. #ZeroTrust #AgenticAI #Cybersecurity #AIGovernance

"Security researchers just demonstrated that an enterprise AI assistant can be turned into a precision data exfiltration tool using nothing more than a crafted link – and the enterprise’s own DLP stack is completely blind to it. CVE-2026-42824, now widely called “SearchLeak” after the Bing SSRF component at its core, is a three-stage vulnerability chain in Microsoft 365 Copilot that allows an attacker to extract documents, emails, and Teams messages from a target organization without any direct access to the environment. Microsoft patched the vulnerability and assigned it a CVSS score of 9.1, reflecting the combination of low attack complexity, no required privileges, and the breadth of accessible data." https://lnkd.in/efyV2y2M