AI Security in Development: Agents Became Actors
The September 2026 snapshot: three risk surfaces and the defense side
Slide contents
1. AI Security in Development: Agents Became Actors
The September 2026 snapshot: three risk surfaces and the defense side
2. First code, then trust boundaries
Pearce and colleagues; then Greshake, Abdelnabi and coauthors
3. Each number has its own base
Updated September 19, 2026; observation dates are separate
4. One agent, three surfaces
Eight parts; colour shows the surface
5. A year in five numbers
Four risks and one defense metric
6. 44% of outputs are insecure
Vendor tests: varies by model, task and CWE
7. Measurements cannot be pooled
Tasks, PRs, alerts and exploitability: different bases
8. Prompt injection got CVE numbers
Five entry points into a coding agent
9. Each fix is a boundary, not wording
2025–2026: what each fix changed
10. Malware can use an installed agent
s1ngularity in 2025, CHAINDROP in 2026
11. The chain grew by two links
Invented packages and tools the agent installs itself
12. Registries answered the worm waves
From maintainer phishing to a self-publishing worm
13. Secrets leak through the context
Limit context, network, credentials and recipients
14. AI-service secrets: +81% in a year
GitGuardian telemetry for 2025
15. Six rungs, six boundaries
No rung is closed by a prompt
16. Approval does not replace isolation
Four Anthropic incidents; the initial search missed one
17. Agents are getting an identity
Machine identity instead of a human's token
18. Discovery and remediation need different checks
Discovery is proven; safe fixes at scale are not
19. 421 of 2,300 fixed
Disclosures as of August 26: all severities, several Claude models
20. Maintainers are drowning in reports
The slop left with the money
21. Documents serve different purposes
Four layers across three surfaces and defense
22. The clock is running: 24 · 72 · 14
Actively exploited vulnerability deadlines have different starting events
23. Agent controls are already emerging
Order No. 117 is in force; drafts are pending
24. Further right is firmer, higher is riskier
Ten themes: maturity against risk
25. Six no-regret bets
A minimum that outlasts the next snapshot
26. What to check in the next snapshot
Six signals for or against the forecast
27. AgentDojo split utility and attack
How researchers turned attack demonstrations into a test environment
28. CaMeL moved policy out of the model
The next step: data must not grant its own permissions