OWASP is a nonprofit community publishing open security standards and guidance, known for its Top 10 risk lists covering web, API, and LLM applications.
Reflectiz's AI pentest agent logged into a major insurer's production site by sending its one-time code to an inbox it controlled. The server never checked the address against the account, so the code proved nothing about who held it.
Reality
Google reports 0.7% attack success for Gemini 4 Argon across 15 adaptive attempts on Gray Swan's injection benchmark. The launch post does not list the scenarios, so teams giving coding agents live tokens cannot size the risk that remains.
Reality
In a post on aminrj.com, an OWASP working-group member says CVEs fit only two of six places where AI agent and MCP flaws live. Over-broad permissions, shared service accounts and confused-deputy designs sit in the other four, where a scanner has nothing to flag.
Reality
Google's Gemini breached three real companies in May 2026 after a bug in an Irregular-run CTF test let it reach the live internet, Google says. Open outbound access and a look-alike target name are the two things to check in any agent eval harness.
Reality
Vijil released DART, which tests enterprise AI agents with its own multi-turn attacker agents and claims 1.5 times a rival's attack success rate. For teams looking to replace manual red-teaming, that ratio comes from a single benchmark and has to be reproduced on their own agents.
Reality
Apple announced on October 2 that macOS Full Disk Access can be granted only through very explicit user action, citing the added risk from AI agents. Agent builders can scope to user-selected folders now.
Reality
CyberXDefend counts about 11 named attacks on AI agent memory and learning, three of them demonstrated on production ChatGPT and OpenClaw. It found no confirmed criminal campaign, but in each case one poisoned write outlives the session, the property behind OWASP's ASI06 category.
Reality
Vectorize CEO Chris Latimer says coding agents he used wrote API keys, credentials and sensitive documents into plain-text long-term memory. His attack scenario is hypothetical, and it still puts agent memory on the list of places where secrets live.
Reality
Retried Buy clicks get the original order back in a dev.to guide that commits each order with its attempt key in one SQLite transaction. A disabled button only cuts double-clicks, and the guide's available text ends before it covers charging the card.
Reality
OpenAI's August 19 update promises it keeps nothing after a request. The copies your own app leaves behind in logs, queues and databases are governed by you, not by a toggle.
Perspective Coverage
5 publishersReality
Qrator says x47.c, a Windows botnet sold for up to $950, burns a victim's OpenAI or xAI credit with a valid API key while the website stays up. Website filtering never sees the requests, so the defenses are key revocation and spending caps.
Perspective Coverage
3 publishersReality
Dev.to author dharani2d argues agent security depends on who picks the next tool call, citing Excessive Agency's rise from sixth to third at OWASP. The proposed control plane keeps identity, authorization, argument checks and approvals in deterministic code outside the model.
Reality
Three separate IDs and one Postgres row per retry let an investigator list every attempt for a tenant in order, according to a dev.to design. Adopting it means carrying an operation ID into every enqueue call, and its sample redactor lets bearer tokens through.
Reality
Disclosure volume is climbing faster than the process around it. CISA's answer is a framework that describes what a good CVE record is and how the program should be judged on producing one.
Perspective Coverage
3 publishersReality
Patrick Wardle published working code that sends Muse's dictated audio to a server of the attacker's choosing. Because the assistant holds file, microphone, camera, calendar and paired-iPhone access, whoever redirects it inherits all of it.
Perspective Coverage
3 publishersReality
OWASP's August 3 edition added no categories and removed none, yet eight of the ten entries changed rank, with Unbounded Consumption up four places and Improper Output Handling down five. Prompt Injection still holds first.
Reality
Forcepoint's unguarded research agent ran 500 tool calls for a simulated $10, a total set by the test's own ceiling, while the same scenario with a call budget, recursion cap and circuit breaker ended after one call and $0.02.
Reality
A dev.to post keeps the spend ceiling in an authorization service the agent has no credential for, reserving each job's maximum charge before dispatch and accepting fewer concurrent admissions per period as the cost.
Reality
Air Security's Plugin4Shell lets a plugin be swapped during a background refresh while the agent reports the audited commit. Anthropic and OpenAI have patched, Copilot has no fix, and Google is retiring Gemini CLI.
Reality
A dev.to post argues that model-assisted analysis has made decompiled Android code cheap to understand, and proposes DEX encryption plus a native interpreter as the answer. Its own feature list shows what that costs to adopt.
Reality
Product · September 17, 2026 · Confirmed3 publishers
Build · September 10, 2026 · One report1 publisher
Invest · September 2, 2026 · Confirmed2 publishers