New way to build itMDS-07 · 2026-07-20
OWASP Top 10 for Agentic Applications 2026 Defines the First Peer-Reviewed Framework for Autonomous AI Red Teaming
Released December 2025 and developed with input from over 100 security experts, the OWASP Top 10 for Agentic Applications 2026 is the first peer-reviewed framework for autonomous AI security, endorsed by NIST, Microsoft, NVIDIA, and the Alan Turing Institute. It covers ASI01 Agent Goal Hijack through ASI10 Rogue Agents. Documented real-world incidents include EchoLeak (CVE-2025-32711) zero-click prompt injection in Microsoft 365 Copilot, GitHub Copilot YOLO Mode (CVE-2025-53773) wormable RCE, CurXecute MCP auto-start RCE, Agent Session Smuggling in A2A, and Amazon Q Developer tool misuse. Mitigations include treating agents as first-class identities, sandboxing code execution, and implementing circuit breakers in multi-agent workflows.
Sharpens: Integrate the OWASP ASI 2026 framework into your AI red teaming program. Test agentic systems against all ten risk categories, with particular focus on ASI01 Goal Hijack (prompt injection via any text the agent reads), ASI02 Tool Misuse (legitimate tools used in unintended ways), and ASI04 Supply Chain Vulnerabilities (poisoned MCP servers and agent skills). Implement agent identity as distinct from user identity, authenticate inter-agent communication, and deploy circuit breakers that halt cascading failures in multi-agent workflows. · source
New way to build itLOG-15 · 2026-07-20
OpenTelemetry GenAI SIG Defines Standardized Semantic Conventions for AI Agent Observability and Security Telemetry
The OpenTelemetry GenAI Special Interest Group is establishing standardized semantic conventions for AI agent observability, covering agent application conventions (finalized) and agent framework conventions for CrewAI, AutoGen, LangGraph, and others. Key deliverables include standardized traces, metrics, and logs for agent step-level execution, tool calls, model interactions, and vector DB queries. Two instrumentation approaches are defined: baked-in native telemetry and external OpenTelemetry libraries. These conventions enable agent lifecycle correlation, context provenance tracking, and trust-boundary detection in multi-agent and agent-tool interactions. Adoption is projected to reach 98 percent within two years.
Sharpens: Adopt OpenTelemetry GenAI semantic conventions for agent observability instrumentation. Configure your agent framework to emit standardized spans for each agent step, tool invocation, and model interaction. Use these spans to construct context provenance chains that track which agent acted on whose authority with what retrieved context. Correlate agent lifecycle events with existing security telemetry to detect trust-boundary violations such as unauthorized tool invocations or cross-agent context leakage. · source
On the frontiernot yet on the CSA spine · 2026-07-20
Activation-Based Multi-Agent Collusion Detection Achieves 0.99 AUROC Against Steganographic Blackjack Card Counting
Oxford researchers introduce NARCBENCH, a benchmark for detecting covert multi-agent collusion from model internal activations. Five probing techniques aggregate per-agent deception scores to classify scenarios at the group level across Qwen3-32B, Llama-3.1-70B, DeepSeek-R1 32B, and GPT-OSS-20B. All models reach 1.00 AUROC in-distribution; Llama-3.1-70B achieves 0.99-1.00 AUROC on steganographic blackjack card counting where an LLM judge fails to discriminate. Detection performance scales with model capability. Collusion is framed as a distributed anomaly detection problem visible only when signals are combined across agents.
Sharpens: Deploy multi-agent interpretability as a complementary signal to text-level monitoring for agentic systems. Learn a deception direction from a training corpus of multi-agent scenarios, then project each agent's activations onto this direction to produce per-agent deception scores. Aggregate scores across agents using techniques like Peak Suspicion or Deception Split to detect collective anomalies invisible from any single agent alone. This white-box approach is particularly critical for steganographic collusion designed to evade text-level oversight. · source
What just shiftedIAM-18 · 2026-07-20
MCP Tool Poisoning Attack Pattern Turns Agent Tool Descriptions into Data Exfiltration Vectors
Microsoft Incident Response documents MCP tool poisoning, a supply chain attack where threat actors silently modify MCP tool descriptions (natural-language metadata agents read to decide tool calls), embedding hidden instructions that redirect agents to exfiltrate sensitive data. Each individual action appears legitimate; the vulnerability is in the trust boundary between agent and tool. Techniques first disclosed by Invariant Labs in April 2025 and observed in 2026 against enterprise agents. Microsoft maps detection controls across supply chain governance, tool metadata inspection, action guarding via DLP and human-in-the-loop, and cross-chain correlation in Sentinel.
Sharpens: Treat every MCP server as a supply chain dependency requiring security review. Treat tool descriptions as system prompts: require change review for tool description updates on critical agents and use prompt shields to inspect metadata for imperative language. Apply least agency by disabling 'allow all' tool access and requiring human approval for high-impact agent actions. Correlate MCP server telemetry with agent behavior signals in your SIEM to detect anomalous sequences. · source
What just shiftedIAM-18 · 2026-07-19
Agentic AI Runtime Attack Surface Expands: MCP Compromise and Agent-to-Agent Trust Abuse Emerge
A July 2026 enterprise security guide from NeuralTrust documents six emerging attack paths against agentic AI systems that traditional security tools cannot detect. These include prompt injection via tool outputs, indirect prompt injection through retrieved content, memory poisoning, privilege escalation across agent chains, MCP server compromise, and agent-to-agent trust abuse. The WASP benchmark found that simple human-written prompt injections partially succeeded in up to 86 percent of cases against realistic web-agent workflows. Traditional security tools inspect code, network traffic, and known indicators of compromise but cannot inspect the natural-language instructions and evolving internal state that drive agent behavior. This re-prioritizes IAM-18 controls on agent tool access toward runtime enforcement rather than static configuration.
Sharpens: Implement agentic runtime security controls that inspect natural-language instructions, tool call parameters, and agent context before actions execute. Validate that every tool invocation matches the agent's declared purpose and least-privilege scope. Monitor MCP server tool descriptions for tampering and validate tool responses for injected instructions. Establish agent identity boundaries that prevent compromised agents from passing manipulated tasks to peer agents with broader permissions. Add runtime enforcement that revalidates authorization at every agent-to-agent interaction point. · source
New way to build itLOG-15 · 2026-07-19
Microsoft Formalizes AI Observability as Secure Development Lifecycle Release Requirement
In March 2026, Microsoft published guidance making AI observability a formal release requirement within their Secure Development Lifecycle (SDL). The guidance introduces two new observability components beyond traditional logs, metrics, and traces: evaluation (measuring response quality, grounding, and tool-use correctness) and governance (using telemetry to verify and enforce acceptable system behavior). Key innovations include context provenance tracking that captures which input components were assembled for each run, agent lifecycle-level correlation that propagates stable conversation identifiers across multi-turn interactions, and trust-boundary violation detection that identifies when untrusted external content influences agent behavior. This maps to AICM control LOG-15, which requires logging and monitoring all input and output events for AI models.
Sharpens: Instrument your AI systems to capture context provenance metadata for every request: which system instructions, developer templates, user inputs, tool outputs, and retrieved documents were assembled into the final prompt. Implement agent lifecycle-level correlation by propagating a stable conversation identifier across all turns, tool calls, and sub-agent invocations within a single user session. Add AI-specific observability signals to your existing OpenTelemetry pipelines: token usage per source, retrieval volume, tool call sequences, and trust-boundary crossings. Make observability a release gate: if you cannot reconstruct an agent run end-to-end from logs and traces, the system is not production-ready. · source
Control ids above refer to the CSA AI Controls Matrix (AICM).