What happened, in two sentences, and why it matters for anyone running AI agents. Every item links to its source.
Industry
Red Hat and Nvidia back OpenShell, a deny-by-default sandbox for AI agents
Presented at KubeCon, OpenShell is an open-source project contributed by Nvidia and now under Cloud Native Computing Foundation governance. Agents start with no network access, operators allow specific endpoints, and credentials stay hidden from the agent.
Why it matters Deny-by-default is becoming the expected baseline: limit what a hijacked agent can reach, instead of trying to detect every injection.
Corelight: most MCP servers it reviewed fetch their dependencies fresh at every start
Of 35 MCP servers reviewed, 23 recommended an install that resolves dependencies from a public registry. In one case, 19 builds of the same release produced 15 different environments over five weeks.
Why it matters An agent's tools are part of its supply chain. Pin and lock what MCP servers install, and scan again on a schedule.
Glow Labs reviewed coding-agent sessions: when a deprecated MCP server was installed or suggested, the agent itself picked the package in 98% of cases. The archived servers carry four high-severity flaws that will not be fixed, and were downloaded more than 17.3 million times since July 2025.
Why it matters Agents choose tools from memory, not from maintenance status. Approve and pin the tools an agent may use, and check them for changes.
“AgentCorruption”: one prompt could take over agents in AWS Bedrock AgentCore
Research attributed to Zenity Labs describes how an exposed agent could be prompted to read credentials from its instance metadata service, then reach every AgentCore agent in the same account and region. AWS has patched the issues, according to the Adversa AI roundup that reported it.
Why it matters Any tool that can make web requests is a path to internal endpoints. Restrict where agent tools can connect.
A trailing dot let Copilot in Visual Studio rewrite its own protected settings (CVE-2026-103572)
A path check compared the raw file name, so a name ending in a dot passed the check while Windows wrote to the protected configuration file. Through an indirect prompt injection, a hijacked agent could add a command that the editor then runs. Microsoft fixed it in the October 13 update.
Why it matters Controls on an agent must hold even when the agent is hijacked, and must check the path the operating system will really use.
OWASP's Q3 2026 exploit roundup: instructions in a prompt are not a boundary
The quarterly roundup covers July to September 2026 and maps incidents to OWASP's risk categories. Its recurring patterns: agents going beyond their intended scope during evaluations, exposed credentials with broad permissions, and trusted tools and content used as attack paths.
Why it matters An agent's scope has to be enforced by controls outside the model, not by wording inside a prompt.
LIMEN13