[NEW RELEASE] Between March and October, the AI security field stopped asking how to roll AI out and started asking how to survive it. @IndreAltman and I serve on the @unpromptedconf AI Security Practitioner Conference team, and when we lined up March 2026’s 469 submissions against October 2026’s 490, the shift stunned us both. A call for papers is a census nobody else gets to take. Roughly 500 submissions in each round, each is someone describing what they are actually working on before it's shaped by committee. Only a fraction are accepted, so the final program doesn't show what the whole field is chasing. The full pile does. (I have always been more curious about the pile than the program.) The two [un]prompted CFP rounds bracket April when Glasswing and Mythos landed. The Mythos moment helped change the industry. We wanted to know whether it changed what researchers turned in. It did. The pattern under October’s 490 has less to do with a technology than an industry anxiety. 348 submissions, 71%, touch agentic systems. The headline is not “everyone is doing agents.” It is "can we trust the agents we have already deployed," and whether we can tell you what an agent actually did after the fact. 94 submissions use the word “harness,” a term that barely existed in this field a year ago. The scaffolding around the model is the attack surface: the tools, the memory, the permissions, the execution loop wrapped around the model. Proposals describing attacks on the harness layer rose from 12 in March to 33 in October, a 175% increase. Attackers go after that layer now, and defenders are still working out how to see into it. (We have a word for it before we have a way to secure it, which is the usual order of operations in this business.) 71% of October’s pool is agent-native: the harness, the MCP and skill supply chain, agent identity, prompt injection and its many children, agentic-browser attacks. 12% of submissions carry production evidence. The other 88% are experiment and prototype. The agents are in production and most of the research about them is not. (I keep going back and forth on whether that is people being careful or people being behind. Probably both.) This is not the March field with a few new talks bolted on. It is a different room. Those are a few of the findings. Indre and I wrote the rest up as the State of AI Cybersecurity report. Read it and see for yourself what changed. unpromptedcon.org @unpromptedconf 27-29 Oct in SF. Almost sold out! @unpromptedconf @SANSInstitute @gadievron @jaybeale @aaronzollman @jonsakoda @WHITEHACKSEC @dhubbard858 @brittaglade @GuanniQu @EmanuelGawrieh @GregNotch @joesu11ivan @dragosr @IdaVass1