AI Agents

2026-07-017 minCrowdStrikemedium

The rapid deployment of AI agents in enterprises creates an identity problem: OAuth access tokens (RFC 9068) lack standardized fields to represent agent instance identity, the user on whose behalf an agent acts, and the delegation relationship between them. This gap can lead to coarse-grained authorization, over-privileged access, and the confused deputy problem in transitive agent call chains. The article calls for industry standardization of this identity context within or adjacent to OAuth tokens.

2026-06-246 minPalo Alto Networkshigh

Threat actors are exploiting the OpenClaw AI agent ecosystem by publishing malicious skills on the ClawHub marketplace. These skills leverage semantic instruction hijacking to bypass traditional security controls, delivering macOS infostealers via base64-encoded droppers, utilizing massive file padding for defense evasion, and executing novel agentic financial fraud schemes like runtime affiliate injection and front-running.

2026-06-183 minCisco Talosinfo

The article details a novel approach to reverse engineering where the VB6 disassembler vbdec exposes its internal object model via the Windows Component Object Model (COM). This allows local AI agents to programmatically query and automate complex analysis tasks, such as decompilation and call graph generation, without requiring built-in AI features or cloud uploads.

2026-06-115 minPalo Alto Networkshigh

The article introduces Behavioral Integrity Verification (BIV) to audit third-party skills for AI agents by comparing declared metadata against actual executable code and natural-language instructions. Analysis of the OpenClaw registry found that while most deviations are benign documentation errors, a critical 5% of skills contain multi-stage attack chains such as silent credential exfiltration and instruction-override hijacking.

2026-06-095 minVaronishigh

Varonis Threat Labs demonstrated that enterprise AI agents, specifically an OpenClaw deployment, are vulnerable to traditional phishing and social engineering techniques. In simulated attacks, the agent successfully identified technical phishing indicators like malicious OAuth flows but failed to recognize social context, resulting in the exfiltration of AWS credentials and sensitive CRM data to an external attacker.

2026-06-036 minTrail of Bitshigh

Security researchers successfully bypassed multiple AI agent skill scanners, including ClawHub, Cisco's skill-scanner, and skills.sh integrations, using techniques like file truncation, embedded payloads, Python bytecode poisoning, and prompt injection. The findings highlight that automated scanning of AI agent skills is fundamentally flawed due to the complex mix of natural language, code, and limited scanner context windows, necessitating a shift towards curated, trusted skill repositories.

2026-05-185 minTrend Micromedium

Autonomous AI agents introduce significant security risks by operating within trust boundaries using delegated credentials, effectively bypassing traditional perimeter defenses. Effective security requires "agentic governance," focusing on strict identity management, granular action-level permissions, approval gates for high-risk operations, and comprehensive logging to mitigate threats like prompt injection and scope creep.

2026-05-135 minSophosmedium

AI agents deployed in enterprise environments are highly susceptible to indirect prompt injection attacks, enabling data theft and unauthorized actions. Security teams must adopt an 'assume breach' architecture for LLMs, focusing on blast radius reduction through agent sandboxing, credential isolation, egress restrictions, and human-in-the-loop governance.

In Q1 2026, vulnerability registrations continued to rise, heavily influenced by AI-assisted discovery tools. Threat actors and APT groups actively exploited a mix of legacy and newly discovered vulnerabilities across Windows, Linux, and Microsoft Office, frequently utilizing C2 frameworks like Metasploit and Sliver to bypass authentication and gain initial access.

2026-05-136 minZscaler ThreatLabzhigh

Threat actors are exploiting the OpenClaw AI agent framework by publishing a deceptive 'DeepSeek-Claw' skill that distributes malware. The campaign utilizes malicious installation instructions to deploy Remcos RAT on Windows via DLL sideloading and GhostLoader on macOS/Linux via obfuscated Node.js scripts, enabling persistent access and data exfiltration.

2026-05-135 minHuntresshigh

The rapid adoption of AI agents like OpenClaw has introduced a new identity threat surface in Microsoft cloud environments. These applications are often granted sweeping tenant-wide permissions, effectively acting as highly privileged service principals that bypass traditional endpoint defenses and could allow attackers to inherit administrative control if the agent is compromised.

2026-05-134 minAkamaihigh

The proliferation of autonomous AI agents like OpenClaw has introduced severe security risks, including unauthorized data access and silent exfiltration via prompt injection and malicious plug-ins. To mitigate these threats, organizations must transition from local agent deployments to hardened, isolated cloud environments utilizing defense-in-depth strategies such as kernel-level eBPF monitoring and runtime prompt interception.

2026-05-133 minElastic Security Labslow

Elastic has introduced open-source Agent Skills that enable AI coding agents to natively interact with Elastic Security. These skills allow security teams to rapidly provision cloud environments, generate realistic sample attack data, and manage alerts and detection rules directly from their IDEs.

2026-05-134 minSockethigh

The rapid proliferation of GitHub Security Advisories (GHSAs) for the OpenClaw AI agent has highlighted a significant gap in vulnerability tracking, as many GHSAs lack corresponding CVE identifiers. This discrepancy creates critical blind spots for enterprise security tools that rely exclusively on CVEs, prompting debate over the future of decentralized vulnerability disclosure and the need for multi-source advisory tracking.

2026-05-137 minPalo Alto Networkscritical

Adversaries are actively exploiting web-based Indirect Prompt Injection (IDPI) to manipulate Large Language Models (LLMs) and AI agents. By embedding hidden or obfuscated instructions within benign web content, attackers can coerce AI systems into performing unauthorized actions such as data destruction, SEO poisoning, and bypassing content moderation when the AI processes the webpage.