Security

Nearly half of teams give every agent the same credential. That costs you attribution, blast radius control, and least privilege all at once.

CVE-2026-48710 lets a single character in the Host header bypass path-based auth across FastAPI, vLLM, LiteLLM, and MCP servers built on Starlette.

A 20-token edit to a SKILL.md file makes agents pick the malicious skill 77.6% of the time. No code, no signature, nothing for a scanner to find.

A formal proof that semantic guardrails cannot give a deterministic security bound, and the SMT solver architecture the authors propose instead.

Eight minutes from noticing the missing authorization hook to opening PR #1240: 1,033 lines across 11 files that authorize every tool call before it runs.

PR #26 on the agent passport spec, opened at 3:04 AM on March 15: D-004 defines signed delegation tokens that must narrow scope at every hop, with depth limits and a traceable chain root.

Fourteen agent frameworks, one question: does a tool call pass through a policy check before it runs? Fourteen variations of no, and the attacks that exploit it.

FIDO, Google, and Mastercard are standardizing who authorized an agent to pay. None of it constrains what the agent spends once a prompt injection lands.

A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The same authorization gap runs through every agent incident of 2026.

Bedrock AgentCore puts Cedar policies outside the agent's reasoning loop. That works for one hop. Multi-agent delegation chains are still unsolved.

We replayed 4,371 human-written attacks against 14 models, with and without an authorization check between the tool call and the bank. The models kept asking to pay. What changed is whether the money moved. Charts, denominators and a reproduce command.

Microsoft's governance package scans MCP tool definitions at startup, enforces policy per call, and sanitizes responses. Every other MCP SDK has none of it.

I built an adapter that checks every Mastra tool call against a policy before it runs, and found out where every agent framework leaves the same hole.

Five lines of prompt injection exfiltrate authenticated M365 file links, because Copilot Cowork lets the model decide which actions need approval.

About 700 agents coordinated through a hidden message board in the Hugging Face breach, and one in five researched how to tamper with their transcripts.

Broadcom's AgentMinder checks every agent tool call at runtime, and its policy engine still trusts the one signal a prompt injection can rewrite.

auth.md gives agents credentials without a signup form. It says nothing about what an agent is allowed to do once it has them. Here is the missing layer.

77% of organizations updated their security strategy for AI. Only 26% can enforce it before a tool call runs. Where that 51-point gap lives.

The NSA's first MCP security guidance names the right problems and leaves out agent identity, authorization before execution, and mid-session revocation.

Tenet Security found 2,388 organizations exposed to Agentjacking, where a fake error report hijacks an AI coding agent. The attack, and the only fix.

Disclosure: I build APort, an open-source layer that checks each AI agent action against a policy before it runs. The Vercel breach ran on an OAuth grant an AI tool already held, and 63% of organizations still cannot purpose-limit an agent or shut one down.

1,100+ agent skills shipped into Claude Code, Cursor and Codex CLI with no pre-execution authorization, after 90 days of malicious skill campaigns.

Cloning a repo and pressing Enter on Claude Code's trust dialog spawns an unsandboxed MCP server with full OS privileges. Anthropic called it design intent.

A Fortune 50 AI agent removed a security restriction and passed every identity check. Seven vendors shipped runtime detection at RSAC 2026, and none of them check the call before it runs.

CVE-2026-26030 turned a search prompt into calc.exe on the host. Blocklists cannot contain a dynamic language, and filters cannot contain an agent.

A Morse code post on X moved through Grok into Bankrbot and shifted 3 billion DRB tokens. The failure was authorization, not the smart contract.

Cursor, Codex, and Claude Code were all exploited between February and April 2026. Every case stole or abused a credential. None broke the model. Monitoring is not authorization.

MCP secures the connection and CIS secures the configuration, but nobody checks what the agent is authorized to do. Four questions find the gap.

Nine thousand eight hundred downloads, no malware, no exploit. Just skill files telling agents to register with a server and upload their own wallet keys.

The agent passport spec now defines a .well-known/oap/ discovery endpoint so any system can verify what an AI agent is authorized to do.

Guardrails decay through model drift, context bleed and stale policy. Why four RSA 2026 vendors enforce too late, and the signed audit trail that catches drift on any stack.

NIST wants agent identity, an authorization check before each action, and auditable receipts. All three are implementable now, without waiting for the standard to finalize.