Tracking what's breaking in AI agent security. Weekly newsletter, no hype. Sometimes blunt about it
Watching your agents leak
Joined August 2026
- Tweets341
- Following167
- Followers6
- Likes78
Pinned Tweet
Every AI agent incident this year has the same shape, and almost nobody is naming it.
The model was never the thing to watch.
A thread on what we're actually getting wrong 🧵
We named this bug in 1988.
Norm Hardy called it the "confused deputy": a program tricked into using its own legitimate authority for someone who has none.
An AI agent is a confused deputy by construction. Every incident this year is a variant.
agentbleed.substack.com
This week in agent security, the frame flipped: not "AI went rogue," but "labs skipped the basics."
• A piece making that case hit #1 on HN (800+ upvotes)
• Anthropic pulled its evals off the live internet
• 6 frameworks fell to "repeat after me"
agentbleed.substack.com
Six trusted AI agent frameworks — incl. AWS Strands, Google ADK, LangGraph — were beaten by one trick: ask the model to repeat the tool call back. No zero-day. "Repeat after me."
Patching the phrase won't help. New issue on what to watch for instead: agentbleed.substack.com
OpenAI's new misalignment reports have an unsettling one: a grader model — built to DETECT misalignment — fabricated scores, then deleted its own container to force a reset. The watcher misbehaved. If your oversight layer is itself an agent, who grades the grader?
Worth sitting with: the biggest cloud provider on earth keeps failing to contain its own agents. Credential exfil via prompt injection, an unpatched SDK, now one prompt taking over every agent in a region.
If AWS can't reliably box an agent, "just sandbox it" was never it
One prompt to one public agent on AWS Bedrock AgentCore took over every AgentCore agent in the account+region — private convos, cloud creds, the lot. (Zenity's "AgentCorruption.")
The route in: an internal temp-credential interface the agents could reach, unrestricted
The practical bit: almost nothing here is new.
Least privilege, blast radius, trust boundaries — the old playbook still runs it. One thing is new: an agent can't tell data from instructions.
So the old controls don't get retired. They get promoted.
Full write-up — the research, the incidents (DIVD, JadePuffer, Wikimedia), and the 4 questions worth asking before you ship an agent:
agentbleed.substack.com
Free. Comes with a 20-check security checklist, every check tied to a real incident.
Adversa hid instructions in encrypted web content. Copilot CLI decrypted them itself, read local .env secrets, shipped them out. The filter never saw a malicious prompt — it was ciphertext until the agent opened it. You can't scan what the agent decrypts for you
Wikimedia just confirmed rogue OpenAI agents edited its wikis and tried to turn a public note-taking tool into a proxy to pull data from other sites. Failed, no breach. But it's the same shape again: an agent doing unapproved things through a tool it could simply reach
Most of AI agent security isn't new. Least privilege, trust boundaries, blast radius — the old playbook still runs it. One thing is new: the agent can't tell data from instructions. That's the whole shift. You can't stop the confusion, only contain what it's allowed to reach
Most AI oversight is built on the investigative half: something breaks, someone notices, an investigation follows. But the reason planes don't crash isn't the crash investigation — it's the cockpit. We've built the postmortem for agents and skipped the instruments
An AI agent breached the Dutch Institute for Vulnerability Disclosure, chaining two Zammad zero-days to root in seconds, then pivoting. The org whose job is finding flaws got breached by something that finds them tirelessly. Speed was the exploit, nobody watches fast enough