Daily digest · 2026-08-12
Daily Digest, 2026-08-12
TL;DR: Today's theme is that the checks people rely on to keep agents in line don't hold. Reviewers wave through about a third of dangerous coding-agent requests, including asking for AWS credentials, and a malicious tool server can split one nasty instruction into harmless-looking pieces to walk off with SSH keys and source code. On shared model hosting, one customer can time the cache and rebuild another customer's prompt. Attackers are running agents too: a Chinese-speaking actor pointed a DeepSeek agent at 1,200+ machines at a security firm, while an AI agent did much of the work finding an unauthenticated SharePoint takeover chain.
Top stories
- GhostSplice: malicious MCP servers split instructions so coding agents leak SSH keys and source (The Hacker News, 2026-08-11). ASSET Research Group shows a connected MCP server extracting SSH keys, environment secrets and customer data by fragmenting the request across channels the assistant already uses, which succeeds after the blunt version was refused. Per-instruction refusal checks miss staged exfiltration; review has to happen at the trajectory level.
- KV cache timing side channel lets one tenant reconstruct another's prompt (arXiv cs.AI, 2026-08-12). Prefix reuse in shared key-value caches gives an adversarial tenant a latency oracle to rebuild another tenant's private prompt. Breaks the isolation assumption behind sending regulated data to hosted models, and points at tenant-scoped cache partitioning as the fix.
- Humans in the loop miss a third of dangerous coding-agent requests (The Register AI, 2026-08-06). Reviewers approved roughly a third of dangerous agent requests, such as Claude Code being asked to dump AWS credentials or Kubernetes config. Approval prompts are the last gate in most deployments, so credential reads need deterministic policy blocks behind the click.
- AI-assisted research finds unauthenticated SharePoint RCE chain (CVE-2026-55040) (The Hacker News, 2026-08-11). CVSS 9.1 chain granting entry as any user including admin, with no account, across Subscription Edition, 2019 and 2016. SharePoint holds the enterprise document store, and an agent did much of the discovery work, which shortens the patch window.
- Chinese actor turns a DeepSeek agent on a security firm, targeting 1,200+ hosts (Dark Reading, 2026-08-03). Researchers intercepted the agent mid-campaign, aiming at proxyjacking to stage later attacks. Gives defenders real behavior and scale data for autonomous attacker detections.
- Gateway architecture for enterprise MCP authentication and identity delegation (arXiv cs.CR, 2026-08-12). Large organizations went from zero to dozens of internal MCP servers in a year, with per-team auth ranging from full OAuth to none at all. The proposed gateway consolidates auth and delegated identity, which is the control point for deciding who an agent acts as when it reaches enterprise data.
Also notable
- Tracebit: prompt injections planted next to AWS secrets stop AI hacking agents, deception control that trips an attacking agent's own guardrails
- MasDrift, benchmark for whether authorization boundaries survive supervisor-to-subagent delegation
- System instruction extraction via encoding attacks, recovers credentials and internal policy stored in system prompts
- Stealing reasoning traces from proprietary LLM APIs, client-held encrypted chain-of-thought blocks are recoverable
- TraceSafe, tests guardrails against multi-step tool-call trajectories instead of final outputs
- Android accessibility trees expose mobile AI agents to indirect prompt injection, the A11y tree as an untrusted input channel
- Rethinking agent security as a networking problem, moves policy enforcement out of the agent and into the network path
- EFF opposes the Youth AI Privacy Act and KOSA, Senate Commerce advanced both on August 5; age verification would add identity collection