Daily digest · 2026-08-04

Daily Digest — 2026-08-04

TL;DR: The EU AI Act's transparency obligations became enforceable on August 2 — AI agents in the EU must now disclose they are not human, with fines up to €15M or 3% of global turnover — making regulation the day's dominant story. Meanwhile the MCP tool layer looks structurally fragile: Trend's scan found ~60% of 9,700 public MCP servers have security issues, HashiCorp disclosed CVEs in its Consul MCP server that broke client credential isolation, and the new MCP 2026-07-28 spec responds with major OAuth hardening. On the agent-to-agent front, the identity layer is the battleground — an IETF cross-industry draft (AWS, OpenAI, Okta, Ping) is emerging as the leading effort to give agents per-workload, revocable identities, while agentic browsers were shown to dissolve the web's same-origin protections.

Top stories

• Commission starts enforcing AI Act rules and new transparency requirements (European Commission, 2026-07-31, regulation) — The AI Office and national authorities began enforcing Article 50 on August 2: interactive AI systems must tell users they're dealing with AI, and generated content must carry machine-readable marks. The first enforceable requirement in a major jurisdiction that agents disclose their non-human identity. See also Help Net Security's enforcement analysis.

• Thousands of MCP Servers Found Vulnerable to File Access and Injection Attacks (GBHackers, 2026-07-07, mcp/research) — Trend AI Security analyzed 9,695 public MCP servers: 5,832 with security issues, 2,259 exploitable, 2,054 with no authentication at all. Popularity and verification badges were found to be meaningless trust signals — users are wiring credential-holding agents to exploitable third-party code.

• The MCP 2026-07-28 Specification (MCP Blog, 2026-07-28, mcp) — Stateless core, Enterprise Managed Authorization, RFC 9207 issuer validation, and deprecation of Dynamic Client Registration. The OAuth hardening directly targets cross-tenant leakage and token misuse — but analysts note trust-boundary enforcement now rests more heavily on server developers.

• Top AI Coding Agent Security Resources — August 2026 (Adversa AI, 2026-08-03, incident) — July's tally of coding-agent trust failures: a symlink approval-bypass shared by six assistants ('GhostApproval'), two CVSS 9.8 zero-click RCEs in Cursor, and GitHub Agentic Workflows leaking private repo contents into public comments ('GitLost').

• AI agent security: four July attacks, one shared flaw (The Next Web, 2026-07-20, incident/research) — Four disclosures in ten days share one root cause: agent access to private data plus exposure to untrusted content. Includes cross-session memory poisoning from a single email and connector supply chains routing meeting data through ten AI subprocessors.

• AI Agent Authentication and Authorization — IETF draft rev 03 (IETF, 2026-07-06, a2a) — Authors from AWS, Zscaler, Ping, OpenAI, and Okta compose SPIFFE identities, short-lived bound credentials, and OAuth delegation into an Agent Identity Management System — the leading standards effort to replace shared API keys with per-agent, revocable identity.

• Agentic AI browsers carry major security risks, UW study (UW News, 2026-06-30, research) — Four of seven agentic browsers tested let malicious sites bypass the same-origin policy via prompt injection and memory poisoning, dissolving 30 years of web data isolation.

• Claude GA on Microsoft Foundry — but EU enterprises can't deploy it (InfoQ, 2026-07-05, polycloud) — Anthropic's EU data-residency guarantees cover Bedrock and Vertex but not Foundry, a concrete case of residency guarantees fragmenting across clouds and stranding GDPR-bound buyers.

Also notable

• HashiCorp disclosed two CVEs in consul-mcp-server including cross-client credential reuse.
• Senator Warner's AI AGENT Act draft would impose fiduciary-style data duties on agent providers.
• Microsoft–Mistral sovereign-cloud partnership targets regulated industries with air-gap-capable agent platforms.
• Research wave on agent attack classes: agent data injection, CLI command-composition attacks (96.6% success vs. allowlists), and delegation laundering in multi-agent pipelines.