Daily digest · 2026-08-06

Daily Digest, 2026-08-06

TL;DR: Today is about attacks that reach an agent's tools without ever passing a guardrail. AWS, Google and Vercel patched flaws where forged instructions fired tool calls with no model turn at all, so system prompts and filters never ran. Zenity says it hijacked Claude and ChatGPT Atlas browsing with no user click, using text planted in emails and X posts, and the issues are still unpatched. Meanwhile "Ask AI" buttons on real marketing pages are carrying hidden instructions that rewrite what an assistant remembers, and OWASP's 2026 LLM Top 10 keeps prompt injection and data leakage in the top two slots.

Top stories

• AWS, Google and Vercel patch agent flaws that fire tools with no model turn (The Hacker News, 2026-08-06). Untrusted or forged instructions reached agent tools without any check that a model turn had authorized the call, meaning tools could read or move user data while every advertised guardrail sat idle. Authorization has to bind at the tool layer, not the prompt.
• Zenity: Claude and ChatGPT Atlas browsers hijacked zero-click through emails and X posts (SecurityWeek, 2026-08-06). Researchers steered agentic browsing with no user interaction; they reported to Anthropic and OpenAI in late 2025 and early 2026 and the bugs remain open. An agentic browser holding a logged-in session puts mail, documents and account data within reach of a stranger's post.
• "Ask AI" buttons carry hidden prompt injections that rewrite assistant memory (The Hacker News, 2026-08-06). Production sites are hiding payloads in pre-filled deep links to shape what an assistant later recommends, using only a feature most assistants already support. Attacker-chosen text lands in a user's persistent context through a link they clicked on purpose, with no notice or consent step.
• OWASP 2026 LLM Top 10 keeps prompt injection and data disclosure at the top (Help Net Security, 2026-08-06). First edition shaped by real incidents; the order below the top two shifted more than in past years. Sensitive Information Disclosure at number two is the reference auditors and contracts will cite when teams justify redaction, scoping and logging work.
• LoginTrap: phishing-style indirect prompt injection against web agents at the login boundary (arXiv cs.CR, 2026-08-06). Task-agnostic injections aimed at the moment credentials change hands, rather than at a specific task. An agent tricked into typing credentials on an attacker page gives away the whole account, which argues for keeping login out of agent reach or binding scoped credentials.
• Top MCP security resources, August 2026 (Adversa AI, 2026-08-06). Covers the July 28 spec revision hardening authorization, a confused-deputy attack hijacking Azure DevOps review agents, and new MCP scanners. The authorization changes set what data a server can reach on a user's behalf; the confused-deputy bug shows what happens when that boundary breaks.

Also notable

• Cross-layer semantic flow reconstruction for attack detection, ties tool calls to the file and network activity they caused, giving a usable audit trail
• SoK: frontier AI and system-level risk in critical infrastructure, agents break bounded-behavior and segmentation assumptions in regulated OT environments
• Formal analysis and supply-chain security for agentic AI skills, five theorems plus skillfortify for checking skills before install
• AgentAntibody, injection defense that carries knowledge of past attacks forward instead of judging each task alone
• Breadcrumbing Search Agents, planted breadcrumbs across sources defeat cross-checking in multi-hop search agents
• Behavioral Skill Reconstruction, closed-source skill contents including embedded secrets can be rebuilt from behavior alone
• Flatpak sandbox escape via PipeWire, CVE-2026-5674, found by an automated Claude Code pipeline, then reproduced by hand
• An AI agent got real CVEs assigned for hallucinated reports, agent noise polluting the feeds vulnerability management runs on
• RAC: keeping privacy-sensitive agent context local in split inference, compresses boundary activations so less user-derived data leaves the trusted endpoint