Appendix B: AI Security Controls Inventory
September 8, 2026 · View on GitHub
Source:
1.01-dev/en/0x91-Appendix-B_AI_Security_Controls_Inventory.md
Overview
Appendix B is a developer-facing inventory that regroups every numbered AISVS requirement into 19 control families (AD.1 Authentication & Identity through AD.19 Human Oversight & Shutdown Control). The inventory is non-normative: it reorganizes the existing requirements for ease of implementation and assigns each requirement to exactly one family, so an implementer can find all related defenses in one place regardless of which chapter defines them. Requirement IDs use the canonical C{chapter}.{section}.{requirement} form (for example, C5.1.1). The requirement chapters (C1 through C12) remain the source of truth. Across the 19 families the inventory maps exactly 194 numbered requirements — verified family-by-family against the C1–C12 chapters as of July 2026 (AD.6 Input Validation is the largest at 19, AD.7 Inbound Content & Policy Screening and AD.9 Rate Limiting, Budgets & Resource Control the smallest at 3) — so the families can be checked for completeness against the chapters.
This research page maps each control family to its primary and secondary chapter coverage, tracks implementation tooling, assesses per-family maturity, records the incidents that stress-test each family, and cross-references the major external AI security frameworks.
Control Family to Chapter Mapping
| # | Family | Primary Coverage | Secondary Coverage | Mapped Reqs |
|---|---|---|---|---|
| AD.1 | Authentication & Identity | C5, C10 | C4, C9 | 11 |
| AD.2 | Authorization & Access Control | C5, C9 | C10 | 12 |
| AD.3 | Data Classification & Tenant Isolation | C5 | C4, C8 | 4 |
| AD.4 | Encryption & Data Protection | C4, C9 | C1, ASVS | 5 |
| AD.5 | Integrity, Signing & Provenance | C3, C9, C10 | C1, C4, C7 | 10 |
| AD.6 | Input Validation & Sanitization | C2 | C9, C10, C11 | 19 |
| AD.7 | Inbound Content & Policy Screening | C2 | C1 | 3 |
| AD.8 | Output Handling & Safety | C7 | C5, C11 | 9 |
| AD.9 | Rate Limiting, Budgets & Resource Control | C9 | C11, ASVS V2.4 | 3 |
| AD.10 | Sandboxing & Workload Isolation | C4, C9 | C3, C10 | 17 |
| AD.11 | Network & Egress Control | C10 | C4 | 5 |
| AD.12 | Supply Chain & Artifact Integrity | C6 | C3, C10, ASVS/SLSA/SCVS | 10 |
| AD.13 | Model Lifecycle, Deployment & Rollback | C3 | C6 | 10 |
| AD.14 | Training Data Integrity & Governance | C1 | C12 | 11 |
| AD.15 | Memory, Embeddings & RAG Security | C8 | C7 | 14 |
| AD.16 | Adversarial Robustness & Privacy Defense | C11 | C1 | 13 |
| AD.17 | Logging & Audit | C12 | C3, C9, ASVS | 7 |
| AD.18 | Monitoring, Detection & Incident Response | C12 | C9, C11 | 14 |
| AD.19 | Human Oversight & Shutdown Control | C9 | C10 | 17 |
Implementation Maturity by Category
Industry adoption data drawn from multiple sources including the Gravitee State of AI Agent Security 2026 report, CSA AI Security and Governance survey (December 2025), Microsoft Cyber Pulse AI Security Report, Lakera GenAI Security Readiness Report 2025, and the Zscaler 2026 AI Security Report (which observed an 83% year-over-year surge in AI/ML traffic across more than 3,400 enterprise applications).
| # | Family | Maturity | Key Tools & Frameworks | Adoption Evidence |
|---|---|---|---|---|
| AD.1 | Authentication & Identity | Low–Med | Microsoft Entra Agent ID (GA at RSAC 2026), Keycloak, Auth0, SPIFFE/SPIRE, FIDO2/WebAuthn, OAuth 2.1 (added to MCP spec June 2025), 1Password Unified Access Pro (NHI vaulting, GA March 17, 2026), Astrix Security NHI discovery, Permiso Security AI agent runtime identity attribution (May 14, 2026, Autodesk launch customer), Akeyless Runtime Authority for AI Agents (intent-aware credential issuance), agent identity registries | Only 21.9% of orgs treat agents as identity-bearing entities; 45.6% still use shared API keys for agent-to-agent auth. The NHI-to-human ratio now runs about 45:1 in modern enterprises and 144:1 in cloud-native/DevOps environments, with 47% of NHIs over a year old without credential rotation and roughly two-thirds of enterprises reporting at least one breach via a compromised NHI. Palo Alto Networks' announced $25B acquisition of CyberArk, Microsoft's GA of Entra Agent ID alongside Agent 365 (May 1, 2026), and Cisco's intent-to-acquire Astrix Security (May 4, 2026, ~$300M) signal that agent identity is consolidating into mainstream IAM platforms rather than living in standalone agent governance tools. CVE-2026-33032 ("MCPwn", CVSS 9.8, actively exploited in the wild from April 13, 2026) showed that this gap is now an attacker entry point: nginx-ui's /mcp_message endpoint was missing the AuthRequired() middleware, so any network-adjacent attacker could call 12 privileged MCP tools — including nginx_config_add with auto-reload — and take over the web server in two HTTP requests (the source maps MCP per-request token validation to C10.2.1). ~2,689 exposed instances were observed globally, primarily in China, the U.S., Indonesia, Germany, and Hong Kong. The upstream advisory lists all versions as affected and no patched version; it recommends adding AuthRequired() to /mcp_message and separately says to consider a fail-closed whitelist default. Treat every MCP endpoint as a privileged control plane: enforce AuthRequired() on every tool route, never expose MCP servers to untrusted networks, and inventory MCP endpoints alongside other privileged APIs. MCPwn was not a one-off: CVE-2026-44338 in PraisonAI (May 11, 2026, CVSS 7.3) shipped a legacy Flask API with hard-coded AUTH_ENABLED = False, exposing unauthenticated agent enumeration and workflow-triggering endpoints — and Sysdig observed scanners probing the exact endpoint 3h44m after the advisory published. June 2026 telemetry quantifies the surface: Censys counted 12,520 internet-accessible MCP services (most unauthenticated), a separate study found ~40% of remote MCP servers expose tools with no authentication at all, and nine MCP CVEs trace to broken OAuth flows. The NSA's May 20, 2026 Cybersecurity Information Sheet on MCP security design considerations makes default-deny authentication for agent-facing endpoints official U.S. government guidance. |
| AD.2 | Authorization & Access Control | Low | OPA, Cedar, Casbin, Kubernetes RBAC, Kong Agent Gateway, Salt Agentic Security Platform, Operant Endpoint Protector, Microsoft Agent 365 control plane (Defender + Entra + Purview), Astrix Security policy engine, Akeyless Runtime Authority (intent-aware policy at credential-mount time), Google Model Armor + Agent Gateway (runtime tool-call filtering, May 2026) | 27.2% use custom hardcoded auth logic; only 21% have complete visibility into agent permissions. The OWASP Agentic Top 10 (2026) frames this as a "least agency" problem — keep the action set as narrow as the business problem allows. The source makes the model-can't-override-policy rule explicit (C9.5.3) and requires a policy decision point isolated from the agent execution environment (C5.2.5). MCP and A2A gateways now expose scope-filtering and runtime RBAC (C10.2.4 scope-filtered tool discovery, C10.2.5 per-invocation argument validation), but policy coverage is still uneven across local agents, IDE plugins, and remote MCP servers. The Anthropic Shared Responsibility Model (April 2026) makes the layering explicit: the AI provider owns the Model layer, but the integrator owns the Harness (instructions/policies/guardrails), Tools (MCP/APIs/plugins), and Environment (deployment context and data access) — so authorization gaps in tool exposure and environment scope sit squarely with the deployer. |
| AD.3 | Data Classification & Tenant Isolation | Low–Med | Pinecone namespace-per-tenant, Weaviate native multi-tenancy, Qdrant tenant-keyword payload filtering, NVIDIA H100 Confidential Computing + MIG (7 isolated instances per GPU), Intel TDX / AMD SEV-SNP confidential VMs, classification-label propagation tooling, prompt-cache partitioning by user boundary | The newest research shows logical multi-tenancy is not enough against shared-infrastructure side channels — the source requires both cross-tenant isolation in shared serving (C5.3.1) and classification-label propagation to downstream resources like embeddings and prompt caches (C5.2.7). A Stanford audit of 17 commercial LLM APIs (arXiv 2502.07776, February 2025) found 8 implement prompt caching and 7 of those 8 share caches globally across users, enabling timing-based detection of another user's cached prompts; at least 5 providers changed caching behavior after disclosure, and DeepSeek demonstrated per-user isolation with no measurable cache-hit timing difference. KV-cache time-to-first-token side channels (arXiv 2508.08438, August 2025) let an unprivileged remote attacker reconstruct another tenant's prompt token-by-token in globally cache-sharing deployments. Hardware confidential inference (H100 CC with AES-256-GCM HBM encryption, ~2–5% throughput overhead) and MIG hardware partitioning are productized but still early in enterprise adoption; classification-label propagation through embeddings and inference remains the least mature area, largely vendor guidance with no standard. |
| AD.4 | Encryption & Data Protection | High | AWS KMS, Azure Key Vault, HashiCorp Vault, LUKS, mTLS (cert-manager, Istio), TLS 1.3, SOPS, AWS Secrets Manager, hardware-backed key stores / secure enclaves for on-device weights, 1Password Unified Access (NHI vault + JIT credential issuance), 1Password Environments MCP Server for Codex (May 2026, runtime secret mounting without prompt exposure) | Encryption at rest and in transit is standard enterprise practice; cloud providers encrypt model storage by default. The AI-specific requirements are narrower and less covered: integrity protection of training data in storage and transfer (C1.1.3), encryption of locally stored model weights using hardware-backed key stores (C4.3.4), encrypted on-device model packages decrypted only inside a trusted runtime (C4.3.5), and — critically — keeping secrets and credentials out of the model's observable context window, system prompts, and tool-call parameters (C9.5.4). The Comment-and-Control disclosure (April 2026) is the canonical failure of C9.5.4: agents posted host-repository API keys as PR comments because long-lived secrets were co-located with prompt-context inputs. Remaining gaps: data-in-use encryption during inference is uncommon, GPU interconnects (NVLink, PCIe) are typically unencrypted in multi-tenant clusters, and API-key sprawl is severe (~1,200 unofficial AI apps per enterprise create unmanaged key surfaces). |
| AD.5 | Integrity, Signing & Provenance | Low–Med | Sigstore/cosign, in-toto, Notary v2, OpenSSF Model Signing (OMS, June 2025), sigstore/model-transparency, signed MCP tool responses with nonce + timestamp (C10.4.6), tool-definition snapshotting with re-approval (C10.4.8), AI-generated-media watermarking (C7.4.4) | OMS specification published June 2025; as of early 2026 NVIDIA's NGC catalog, Google's Kaggle, and Hugging Face have begun rolling out OMS signing flows. The source spans this family across model artifacts (C3.1.2 signing, C3.1.3 admission/load verification), agent execution chains (C9.4.2 cryptographic binding for non-repudiation), and the MCP tool surface (C10.4.6/C10.4.8 replay and tampering defense). 48% of security professionals still say orgs are behind on SBOM; ML-BOM adoption is far lower, and many private model registries still lack signing support. Replay protection on tool responses and re-verification of tool definitions between MCP invocations are rarely implemented in practice. |
| AD.6 | Input Validation & Sanitization | Medium | LLM Guard (Protect AI), Lakera Guard, NeMo Guardrails, AWS Bedrock prompt attack filter, Pydantic, Zod, MCPTox benchmark, SandboxAQ AQtive Guard runtime guardrails (March 23, 2026), Check Point AI Defense Plane (multi-turn injection detection), Google Model Armor (Agent Gateway / Agent Runtime / Langchain preview / Firebase GA, Cloud Next 2026) | 34.7% have deployed dedicated prompt injection defenses; 89% of models remain vulnerable to prompt attacks; and OWASP's June 1, 2026 State of Agentic AI Security and Governance (v2.01) found prompt injection now maps to six of the ten Agentic Top 10 categories, making this the single highest-leverage family to get right. This is the largest control family in the source (19 requirements), spanning text normalization (C2.1.1), encoding/representation-smuggling detection (C2.1.2), injection screening (C2.1.3), instruction-hierarchy enforcement (C2.1.6), cross-modal attack detection (C2.2.4), tool-output schema validation (C9.3.2), and the full MCP response-validation chain (C10.4.1–C10.4.5). CVE-2026-25592 (Microsoft Semantic Kernel .NET SDK, detailed May 7, 2026, CVSS 9.9) and CVE-2026-26030 (Python SDK) confirmed that prompt-injection-to-RCE remains live in mainstream agent frameworks — a single injected prompt steered an exposed [KernelFunction] (DownloadFileAsync) into arbitrary file writes outside the Azure Container Apps sandbox. The Comment-and-Control disclosure (mid-April 2026) showed that a single GitHub PR-title injection hijacked Anthropic's Claude Code Security Review action (initially CVSS 9.3, raised to 9.4 on 2025-11-25, then reclassified to None on 2026-04-20), Google's Gemini CLI Action, and GitHub's Copilot Coding Agent into posting host-repository API keys as PR comments — using GitHub itself as the C2 channel. Clinejection (February 17, 2026) chained indirect prompt injection in a GitHub issue title to a postinstall script in cline@2.3.0, dropping OpenClaw on ~4,000 developer machines. CVE-2026-26118 (Microsoft MCP Server, CVSS 8.8, patched March 10, 2026 on Patch Tuesday) let attackers manipulate tool-invocation requests generated by an AI assistant. MCPTox (AAAI 2026) found tool metadata poisoning remained effective across realistic MCP tool catalogs, so tool descriptions and manifests must be treated as untrusted input alongside the prompt itself. The VIPER-MCP study (arXiv, May 20, 2026) scaled this up: static taint analysis plus feedback-driven prompt evolution across 39,884 open-source MCP server repositories surfaced 106 zero-day taint-style vulnerabilities — shell-exec, filesystem, and network sinks reachable from natural-language input — with 67 CVE IDs assigned via coordinated disclosure. Even Copilot was hit: Microsoft's June 9, 2026 Patch Tuesday remediated three command/prompt-injection CVEs in M365 Copilot and Edge Copilot Chat (CVE-2026-45497 RCE, CVE-2026-42824 and CVE-2026-47644 information disclosure), all fixed cloud-side with no customer action. On the tooling side, NeMo Guardrails v0.22.0 (May 22, 2026) added streaming output rails, OpenTelemetry tracing, and speculative generation that runs input rails in parallel with generation to hide guardrail latency. Agentjacking (Tenet Threat Labs, disclosed to Sentry June 3, publicized June 12, 2026) sharpened the "tool output is untrusted input" thesis into a new injection channel: attacker-forged Sentry error events, injectable through any public DSN, were returned to AI coding agents (Claude Code, Cursor, Codex) by the legitimate, authenticated Sentry MCP server as trusted "diagnostic resolution steps," and the agents executed attacker-controlled npm packages — 2,388 orgs had injectable DSNs and 100+ live agent executions were confirmed across organizations up to the Fortune 100. Sentry declined to fix at the root (calling full remediation "technically not defensible") and shipped a payload-string content filter; Tenet open-sourced agent-jackstop hardening configs (June 18, 2026). Telemetry, logs, and error streams are now a first-class indirect-injection surface, not just prompts and retrieved documents, so the MCP response-validation chain (C10.4.1–C10.4.5) must cover observability data too. |
| AD.7 | Inbound Content & Policy Screening | Medium | OpenAI omni-moderation-latest (multimodal, GPT-4o-based, free), Azure AI Content Safety, AWS Bedrock Guardrails content filters (Hate, Insults, Sexual, Violence, Misconduct, Prompt Attack across four strength levels; image filters GA March 2025), Meta Llama Guard 4 (12B multimodal, MLCommons hazards taxonomy), Google Cloud content classifiers | Production-grade managed classifiers for violence, self-harm, hate, and sexual content are widely available with multimodal support and configurable severity thresholds — the source requires inbound classification against configurable thresholds with rejection or sanitization before model context (C2.2.1), plus detection and removal of disallowed content before training (C1.3.4). The persistent, exploitable gap is multilingual coverage: commercial LLMs show significantly weaker safety performance in non-English and low-resource languages, and low-resource-language prompts reliably bypass safety filters (survey arXiv 2505.24119, 2025). The source flags this directly with C2.2.2 (evaluation of content classification for unsupported languages). 2025–2026 benchmarks built to measure and close the gap include PolyGuard / PolyGuardMix (1.91M samples across 17 languages), IndicSafe, RabakBench, and PL-Guard — but coverage outside high-resource languages remains uneven. Screening the training corpus, not just live prompts, is the commonly missed half of this family. |
| AD.8 | Output Handling & Safety | Medium | Guardrails AI, NeMo Guardrails, Presidio, OpenAI Moderation API, AWS Bedrock content filters, OpenAI Lockdown Mode (June 2026) | 41% have runtime guardrails, mostly focused on content safety rather than security-specific output handling. The source defines a full output-side chain entirely within C7: schema validation with rejection on mismatch (C7.1.1), length and termination controls (C7.1.2), confidence estimation and threshold-gated fallback (C7.2.1, C7.2.2), high-risk verification (C7.2.3), harmful-content classifiers (C7.3.1), system-prompt and backend-data leakage detection (C7.3.2), prevention of output-triggered outbound requests (C7.3.3), and hidden/encoded output detection — homoglyphs, formatting, metadata, structured fields (C7.3.4). C7.3.4 makes the encoding-smuggling defense symmetric with input-side C2.1.2; few guardrail products inspect outputs for encoding smuggling today. OpenAI's Lockdown Mode (rolled out June 4, 2026) takes the channel-reduction approach instead: it disables or limits web access, image rendering, connectors, and file downloads to cut exfiltration paths, while explicitly acknowledging it does not stop the injection itself. |
| AD.9 | Rate Limiting, Budgets & Resource Control | High | Kong AI Gateway 3.14 / Kong Agent Gateway (April 2026: LLM + MCP + A2A unified governance, token/cost quotas, full audit logging of A2A conversations), LiteLLM Proxy, Envoy AI Gateway, AWS API Gateway, Zuplo | Standard API gateway capability, and all major LLM providers enforce rate limits natively. The AI-specific framing in the source is narrower: per-tool quotas and timeouts (C9.1.1), per-execution budgets covering recursion depth, token use, and monetary spend enforced by the runtime (C9.1.2), and per-principal inference rate limits sized to the extraction threat model rather than a generic API throttle (C11.2.2). Per-agent token/cost budgets for agentic loops are newer but converging — Kong's 3.14 release (April 14, 2026) is the first unified gateway spanning LLM, MCP, and agent-to-agent traffic from a single control plane. The common gap is rate-limiting per endpoint but not per agent session, and ignoring tool fan-out when sizing budgets. |
| AD.10 | Sandboxing & Workload Isolation | Medium | gVisor, Kata Containers, Firecracker, E2B, WASM runtimes, MCP STDIO allow-lists, Azure Container Apps dynamic sessions, hardened [KernelFunction] annotations, Microsoft Agent Governance Toolkit (open-source runtime security, April 2, 2026), Microsoft Execution Containers (MXC) SDK, Windows 365 for Agents | Container isolation is well-established; agent tool execution sandboxing is less mature. This family is broad in the source (17 requirements) — model sandboxing (C4.1.1), safe-deserialization formats (C4.1.2), workload attestation (C4.1.3), confidential inference (C4.1.4), version-pinned and boot-attested accelerator firmware (C4.2.1), TEE isolation (C4.2.2), GPU attestation (C4.2.3), GPU memory partitioning and sanitization (C4.2.4), per-tool least-privilege sandboxes (C9.3.1), isolation of untrusted-data processing from tool-calling (C9.3.5), and dev/staging/prod separation (C3.4.1, C3.4.2). CVE-2026-25592 in Microsoft Semantic Kernel demonstrated that LLM-callable helpers leak through the sandbox boundary if any kernel function lacks path or argument validation — the fix in 1.71.0 removed DownloadFileAsync from LLM exposure rather than tightening the sandbox itself. OX Security's April 15, 2026 "Mother of All AI Supply Chains" disclosure escalated this further: a systemic RCE pattern across the official Anthropic MCP SDKs (Python, TypeScript, Java, Rust) affecting 150M+ downloads, 7,000+ exposed servers, and an estimated 200,000 vulnerable instances, with successful command execution on six live production systems. Anthropic confirmed the behavior as intentional and declined to modify the protocol, so the sandbox boundary becomes the deployer's responsibility. Microsoft's AutoJack disclosure (June 18, 2026) demonstrated another boundary failure: attacker-controlled JavaScript rendered by an AutoGen browsing agent reached an unauthenticated loopback MCP WebSocket and spawned a process under the developer's account. The affected surface existed only in upstream development and never shipped in a PyPI release; commit b047730 hardened it. The lesson is broader than AutoGen: loopback is not a trust boundary when an agent can browse untrusted pages, so privileged local control planes need authentication, authorization, origin validation, and process isolation. The OS vendors are now building this layer natively: Microsoft's Execution Containers (MXC) SDK (early preview, June 2, 2026) brings policy-driven process isolation (already adopted by GitHub Copilot CLI) and session isolation (separating the agent from the user's desktop, clipboard, and input, with its own Entra identity) to Windows and WSL, with micro-VM hardware isolation on the roadmap; Windows 365 for Agents (GA) runs agents in fully isolated, policy-governed Cloud PCs. |
| AD.11 | Network & Egress Control | High | Cilium, Calico, AWS Security Groups, cloud VPC, mTLS/DPoP sender-constrained tokens, Istio, cert-manager | Standard network controls apply, but the source narrows this family to AI-specific transport boundaries: authenticated encrypted streamable HTTP for remote MCP (C10.3.1), stdio transport restricted to controlled local environments (C10.3.2), independent Origin and Host header validation for DNS-rebinding defense (C10.3.3), minimum protocol-version enforcement against downgrade (C10.3.4), and accelerator interconnects restricted to approved, authenticated topologies (C4.2.5). Gap: 86% of orgs report no visibility into AI data flows, suggesting AI-specific segmentation (model serving vs. training vs. RAG) is not standard, and exposing stdio or SSE transports beyond the local host remains a common MCP misconfiguration. |
| AD.12 | Supply Chain & Artifact Integrity | Low | ModelScan, Guardian (35+ formats), Fickling, safetensors, CycloneDX, Black Duck AI (Oct 2025), Palisade (Sigstore), sigstore/model-transparency, MCP registry review, GitHub npm provenance, GitGuardian non-human secret monitoring, Microsoft Defender AI Model Scanning (preview, Build 2026) | 91% use unvetted pre-trained models; 67% of models lack security scanning. The source covers model-registry inventory (C3.1.1), malicious-code scanning before import (C6.1.1), approved-source-only downloads (C6.1.2), per-artifact integrity verification (C6.1.3), signed and completeness-checked AI BOMs (C6.2.1–C6.2.3), and trusted/allow-listed MCP components (C10.1.1, C10.1.2). Between January and February 2026, security researchers filed 30+ CVEs against MCP servers, clients, and infrastructure, ranging from trivial path traversals to a CVSS 9.6 RCE in a package downloaded nearly half a million times. The compounding signal in early 2026 is that agent-adjacent packages are being weaponized against the developers who install them: Clinejection (Cline CLI 2.3.0, February 17, 2026, ~4,000 installs in 8 hours via a compromised publish token plus a malicious postinstall script delivering OpenClaw), the LiteLLM 1.82.7/1.82.8 PyPI compromise (March 24, 2026), the Axios npm supply-chain compromise (April 2026), CVE-2026-26118 in the Microsoft MCP Server (CVSS 8.8, March 10, 2026), OX Security's April 15, 2026 systemic MCP advisory enumerating CVE-2025-65720 (GPT Researcher), CVE-2026-30623 (LiteLLM), CVE-2026-30615 (Windsurf), CVE-2026-30624 (Agent Zero), CVE-2026-40933 (Flowise), and CVE-2026-30625 (Upsonic), and CVE-2026-33032 "MCPwn" (CVSS 9.8) — the first major MCP exploit observed actively exploited in the wild, with PurpleOps chaining it to CVE-2026-27944 by April 16, 2026. ENISA 2025 also documents poisoned models and trojanized packages. Agent dependencies need pinned versions, source provenance, signed artifacts, scoped npm/PyPI publish tokens, explicit review of tool launch paths, and continuous monitoring of MCP server inventories. VIPER-MCP (May 20, 2026) added 67 more coordinated-disclosure CVEs across open-source MCP servers in one study, and Akamai's "One Is a Fluke, 3 Is a Pattern" research (May 13, 2026) found SQL injection in the Apache Doris MCP Server (CVE-2025-66335, fixed in 0.6.1), a potential account takeover in Apache Pinot MCP, and an unauthenticated metadata-exfiltration flaw in Alibaba RDS MCP that the vendor declined to fix. The next MCP specification release (locked May 21, 2026; final publication July 28, 2026) is the version to track for protocol-level fixes. |
| AD.13 | Model Lifecycle, Deployment & Rollback | Medium | MLflow, Seldon Core, BentoML, ArgoCD, Kubernetes, Weights & Biases | MLOps tooling covers versioning and deployment, but security is not integrated by default. The source covers pre-deployment safety testing (C3.2.1), re-evaluation of quantized models against the same suite (C3.2.2), provider-change-triggered re-evaluation (C3.2.3), automated rollback triggers and full state restoration (C3.3.1, C3.3.2), isolated parallel-version runtime state (C3.3.3), and the RLHF/fine-tuning pipeline integrity controls (C3.5.1–C3.5.4, including reward-hacking detection and stage-by-stage verification). Rollback is rarely tested before it is needed, retired model artifacts linger in serving caches, and reward models are often treated as static infrastructure rather than versioned, validated artifacts. Microsoft's June 2026 Patch Tuesday remediation of three Copilot injection CVEs cloud-side with zero deployer action is a useful example of lifecycle control working as intended. Model retirement/deprecation policies remain rare, and shadow AI (~1,200 unofficial apps/enterprise) indicates lifecycle management failure at the organizational level. |
| AD.14 | Training Data Integrity & Governance | Low | Data Provenance Initiative / Data Provenance Explorer (1,800+ datasets audited), DVC and lakeFS (git-like dataset versioning), C2PA provenance metadata, dataset watermarking (arXiv 2510.09210), poisoning-detection research tooling | Attack research is far ahead of deployed defenses. The Anthropic / UK AISI / Alan Turing study (October 2025) found as few as ~250 malicious documents can implant a backdoor regardless of model size (600M–13B parameters tested), overturning the assumption that attackers need a percentage of training data. Carlini et al.'s split-view and frontrunning web-scale poisoning attacks remain practical (poisoning 0.01% of LAION-400M/COYO-700M for ~$60), and OWASP formalized the risk as LLM04:2025 (Data and Model Poisoning). The source mandates data minimization (C1.1.1), a complete source inventory with origin/license/use-constraints (C1.1.2), dataset watermarking for attribution (C1.1.5), labeling-platform access controls (C1.2.1), poisoning and clean-label-poisoning detection (C1.3.1, C1.3.5), bias evaluation for security-relevant decisions (C1.3.3), and dataset lineage plus write-time document tagging in the audit chapter (C12.5.1, C12.5.2, C12.5.4). Provenance (Data Provenance Initiative, C2PA) and versioning (DVC/lakeFS, with lakeFS acquiring DVC stewardship in 2025) exist but adoption for full AI-BOM/data-origin tracking is early. EU AI Act Article 10 (data governance for high-risk systems) drives demand but its obligations only enter application in August 2026; practical poisoning-detection tooling remains largely research-stage. |
| AD.15 | Memory, Embeddings & RAG Security | Low–Med | Pinecone namespace-per-tenant, Weaviate native multi-tenancy, Qdrant tenant-keyword filtering, Guardrails AI Provenance LLM, Anthropic Citations API (Jan 2025), Ragas / TruLens / Databricks Mosaic AI Agent Eval (groundedness + citation precision), RAGForensics, RevPRAG | Attack research here is mature and quantified; defenses are emerging but incomplete. PoisonedRAG (USENIX Security 2025) showed injecting just 5 malicious texts per target question — poisoning only 0.04% of a corpus — reaches 98.2% attack success. Embedding inversion has advanced to few-shot and data-free black-box settings (ALGEN, arXiv 2502.11308; Zero2Text, 2026), reconstructing source text including clinical identifiers from leaked vectors. MINJA (Memory INJection Attack) injects malicious records into an agent's memory bank using query-only interaction with >95% injection success. OWASP codified these as LLM08:2025 (Vector and Embedding Weaknesses) — naming multi-tenant cross-context leakage, embedding inversion, and corpus poisoning — and added ASI06 (Memory and Context Poisoning) to the 2026 Agentic Top 10. The source mandates per-tenant vector-ID/namespace uniqueness (C8.1.1), immutable document metadata (C8.1.2), retrieval scope constraints (C8.1.3), sensitive-field detection before embedding (C8.2.1), outlier-vector quarantine (C8.2.2), source validation before writing to trusted memory (C8.2.3), retrieval-manipulation rejection/quarantine (C8.2.4), expired-vector exclusion (C8.3.1), and model-derived (not model-generated) RAG attribution traceable to the retrieved chunk (C7.4.1–C7.4.3). Tenant isolation in vector DBs is production-ready but opt-in: namespaces and multi-tenancy default-insecure if developers skip them. Detection/forensics (RAGForensics, RevPRAG) remain research-stage, and no widely adopted RAG-security benchmark or certification exists yet. |
| AD.16 | Adversarial Robustness & Privacy Defense | Low–Med | ART (IBM), TextAttack, Garak, Counterfit, Deepchecks, Lakera Red, F5 AI Red Team, Opacus / TensorFlow Privacy (DP-SGD), PySyft, Flower, Anthropic's distillation classifiers and behavioral fingerprinting (Feb 2026 deployment), Microsoft Defender multi-model agentic defense (May 12, 2026), SentinelOne Prompt AI Red Teaming (RSAC 2026 GA), Sweet Security Sweet Attack (May 13, 2026 — agentic red-team agent operating in live production environments) | 12% of orgs perform adversarial robustness evaluation. The source folds privacy hardening into this family: differential privacy with documented epsilon (C11.2.4), output calibration to reduce inference-exploitable overconfidence (C11.2.3), suppression of directly-inferred sensitive attributes (C11.2.1), membership-inference simulation that must show accuracy no better than random (C11.2.5), alignment/safety suites run on every model update (C11.1.1, C11.1.2), modality-relevant adversarial evaluation (C11.1.3), model watermarking/fingerprinting (C11.3.3), and protection of the safety-violation feedback pipeline (C11.4.3). These inherit the family's low maturity: differential privacy sits at roughly Level 3 maturity (12% of orgs), machine unlearning remains academic with no production-grade LLM solutions, and the privacy-accuracy tradeoff is unsolved. Fine-tuning attacks bypassed Claude Haiku in 72% of cases, GPT-4o in 57%, and 45% of models are susceptible to extraction. Anthropic's February 23, 2026 disclosure (≈24,000 fraudulent accounts and 16M+ exchanges across DeepSeek, Moonshot AI, and MiniMax — including prompts that explicitly elicited step-by-step chain-of-thought to generate distillation training data) shows extraction now happens at industrial scale against frontier models. Defensive practice is shifting from query-rate throttling alone to volume + structure + intent fingerprinting, coordinated indicator-sharing with cloud providers, and chain-of-thought elicitation filters at the API edge. By mid-2026 the red-team tooling itself is going agentic and continuous: SentinelOne's Prompt AI Red Teaming continuously simulates prompt injections, jailbreaks, privilege escalations, and data-poisoning attacks, and Sweet Attack runs whitebox attack-chain discovery against real production topology. The OWASP GenAI AI and Agentic Red Teaming Solutions Landscape (Q2 2026, June 1) is the first quarterly-maintained map of this tooling space, and garak v0.15.1 (June 5, 2026) added ProPILE probes for PII-leakage testing. Microsoft reports that over 40% of its June 2026 Patch Tuesday fixes originated from AI-assisted discovery. |
| AD.17 | Logging & Audit | Medium | OpenTelemetry, Langfuse, LangSmith, Splunk, Elastic, Datadog LLM Obs, Databricks Lakewatch (open agentic SIEM on the lakehouse, launched in private preview at RSAC 2026 — Genie ingests and parses new log sources to OCSF, authors detections, and runs natural-language queries; Adobe and Dropbox are launch customers) | 47.1% of agents are monitored, meaning >50% operate without security oversight or logging. The source defines this family around capture quality and integrity: AI interaction logging with session context and AI-specific telemetry (C12.1.1), safety/policy-decision logging (C12.1.2), a structured interoperable inference-event schema (C12.1.3), RAG retrieval-event logging (C12.1.4), audit logs capturing the full approval chain for security-critical proactive actions (C12.4.2), kill-switch and override logging (C12.4.3), and immutable audit records for all model changes (C12.5.3). No standard log schema for AI operations exists, but OCSF is emerging as the common detection schema and Lakewatch leans on it heavily. Microsoft's Build 2026 wave (June 2, 2026) added an Agent 365 SDK (GA) for embedding observability and compliance enforcement into agent dev workflows and an Agent Registry (preview) that surfaces unmanaged local agents discovered via Defender/Entra/Intune telemetry across 20+ agent types. The recurring failure is logging prompts without redaction and using mutable storage without integrity protection. |
| AD.18 | Monitoring, Detection & Incident Response | Medium | Evidently AI, NannyML, Arize AI, WhyLabs, PagerDuty, Galileo AI, CrowdStrike AIDR, Capsule Security, Operant Endpoint Protector, Salt AG-DR, Zscaler AI Runtime Guardrails, Permiso Security AI agent runtime visibility (May 14, 2026), Microsoft MDASH agentic scanning harness (May 12, 2026), Google Model Armor (Cloud Next 2026), Sweet Security Sweet Attack (May 13, 2026), Databricks Lakewatch (RSAC 2026), SentinelOne Prompt AI Agent Security (RSAC 2026 GA) | 38% monitor AI traffic end-to-end (Microsoft Cyber Pulse). The source now maps 14 requirements to this family: signature and behavioral detection (C12.2.1, C12.2.2), AI-specific custom rules (C12.2.3), extraction-alert events with query metadata (C12.2.4, C11.3.1, C11.3.4), token-usage attribution (C12.2.5), covert-channel/C2 monitoring of LLM API traffic (C12.2.6), drift and hallucination monitoring (C12.3.1–C12.3.4), automated tool containment (C9.3.8), and security evaluation plus threat-landscape assessment for autonomous action triggers (C12.4.1). Despite the family name, the current inventory no longer maps dedicated requirements for an AI incident-response plan, AI-specific forensic tooling, automated model isolation, or post-incident retraining feedback; deployments still need those capabilities from their broader incident-response program. Salt Security's 1H 2026 report finds 48.9% of organizations are effectively blind to non-human traffic and 48.3% cannot reliably distinguish legitimate AI agents from malicious bots — while 99% of attack attempts in Salt Labs telemetry originate from authenticated sources, increasingly rogue agents operating with valid credentials but no rate limiting or behavioral guardrails. EMA's December 2025 study adds that only 17% of organizations continuously monitor agent-to-agent (A2A) interactions and just 20% have a tested AI incident-response plan. The "runtime gap" — the window between prompt receipt and action execution — is the primary focus of the newest entrants. Microsoft's MDASH harness, orchestrating 100+ specialized AI agents, found 16 new Windows networking/auth vulnerabilities (including four Critical RCEs) in its first published run, illustrating that monitoring tooling is now itself agentic. |
| AD.19 | Human Oversight & Shutdown Control | Medium | Label Studio, custom approval workflows, Slack/webhook gates, policy-bound approval services, out-of-band kill-switch channels, CSA STAR for AI assurance, CSAI Catastrophic Risk Annex pilot assessments (Phase 1 starting June 2026) | 82% of executives feel confident policies protect against unauthorized agent actions, but actual governance enforcement is at 7%. The source makes the approval gate verifiable as a chain: runtime blocking of high-impact/irreversible actions until verified human approval (C9.2.1), canonicalized untruncated parameter display (C9.2.2), reversibility classification and runtime enforcement (C9.2.3, C9.2.4), bounded self-modification (C9.2.5), AI-augmented review that adds to (not replaces) the deterministic gate and is itself injection-resistant (C9.2.6, C9.2.7), approvals cryptographically bound to parameters/identity/context with a single-use nonce (C9.2.8), approval-key isolation from the agent runtime (C9.2.9), highest-impact-wins classification across chains (C9.2.10), a manual kill-switch (C9.6.1), fail-closed default when approval is not received in time (C9.6.2), an out-of-band kill-switch channel isolated from the agent runtime (C9.6.3), a swarm-level kill-switch (C9.1.3), and explicit consent on local MCP server installation (C10.4.7). CSAI's Catastrophic Risk Annex (announced April 29, 2026, extending the CSA AICM) explicitly calls for testing that human-in-the-loop controls cannot be bypassed, that action gating prevents unsafe escalation, that kill-switches and rollback function under pressure, and that telemetry detects emergent behavior — a testable framing that maps directly onto AISVS C9.2 and C9.6 requirements. The recurring failures are documenting a high-risk action policy never wired to a runtime gate, binding approval to parameters without binding to identity or context, defaulting to fail-open, assuming an in-band kill-switch will work against a compromised agent, and never exercising the kill-switch. Two May–June 2026 disclosures confirm that C9.2.2 (canonicalized, untruncated parameter display) is load-bearing rather than cosmetic: SymJack (Adversa AI, May 26, 2026) used a symlink-disguised file copy to make six coding agents — Claude Code, Cursor, Antigravity, GitHub Copilot, Grok Build, and one more — execute remote code while the approval prompt misrepresented what was being authorized, and TrustFall (Adversa AI, June 2026) chained a trust-dialog regression with settings-scope inconsistency into one-click RCE on local machines and no-click execution on CI runners across Claude Code, Cursor, Gemini CLI, and GitHub Copilot. An approval gate that renders a misleading or truncated action is worse than none, because it manufactures consent — and auto-approving CI runners remove the human entirely. |
External Framework Cross-Reference
How the 19 AD families map to major external AI security frameworks. As of July 2026, the most actionable frameworks for control-level mapping are MITRE SAFE-AI (100 NIST 800-53 controls), CSA AICM (243 control objectives) plus the new CSAI Catastrophic Risk Annex, OWASP LLM Top 10 (2025), the OWASP Agentic AI Top 10 (2026), NIST IR 8596 (initial preliminary draft; comment period closed January 30, 2026), ISO/IEC 27090 (FDIS approval stage), and NIST's SP 800-53 Control Overlays for Securing AI Systems (COSAiS) project, which has begun publishing annotated outlines for predictive AI and is developing separate single-agent and multi-agent overlays. MITRE's 2026 ATLAS updates continue shifting attention from model-centric attacks to execution-layer exposure, with threat modeling now accounting for autonomous workflow chaining, delegated authority persistence, tool metadata poisoning, and API-level orchestration risk.
| Family | MITRE ATLAS Technique/Mitigation | NIST IR 8596 (Cyber AI Profile) | CSA AICM Domain | OWASP LLM Top 10 (2025) | OWASP Agentic Top 10 (2026) | EU AI Act |
|---|---|---|---|---|---|---|
| AD.1 Authentication & Identity | Mitigations for AML.T0053 (AI Agent Tool Invocation), AML.T0098 (Agent Tool Credential Harvesting) | PR.AA (Identity Management) | Identity & Access Management | — | ASI03 (Identity & Privilege Abuse) | — |
| AD.2 Authorization & Access Control | Mitigations for AML.T0086 (Exfil via Agent Tool), AML.T0096 (AI Service API) | PR.AA | Identity & Access Management | LLM06 (Excessive Agency) | ASI03, ASI02 (Tool Misuse & Exploitation) | — |
| AD.3 Data Classification & Tenant Isolation | AML.T0024 (Exfiltration via ML Inference API) | PR.DS (Data Security) | Data Security & Privacy | LLM02 (Sensitive Info Disclosure) | — | — |
| AD.4 Encryption & Data Protection | — | PR.DS | Data Security & Privacy | — | — | — |
| AD.5 Integrity, Signing & Provenance | Mitigations for AML.T0020 (Poison Training Data) | PR.DS, ID.AM | Supply Chain Mgmt | LLM03 (Supply Chain) | ASI04 (Agentic Supply Chain Vulnerabilities) | Annex IV §6 |
| AD.6 Input Validation & Sanitization | AML.T0051 (Prompt Injection) | PR.DS | Model Security | LLM01 (Prompt Injection) | ASI01 (Agent Goal Hijacking) | Art. 15 §5 |
| AD.7 Inbound Content & Policy Screening | — | PR.DS | Model Security | LLM01 (Prompt Injection) | ASI01 | Art. 15 |
| AD.8 Output Handling & Safety | — | PR.DS | Model Security | LLM02 (Sensitive Info Disclosure) | ASI06 (Memory & Context Manipulation) | Art. 15 |
| AD.9 Rate Limiting, Budgets & Resource Control | AML.T0029 (Denial of AI Service), AML.T0034 (Cost Harvesting) | PR.IR | Model Security | LLM10 (Unbounded Consumption) | ASI08 (Cascading Failures) | Art. 15 §4 |
| AD.10 Sandboxing & Workload Isolation | AML.T0080 (AI Agent Context Poisoning), AML.T0101 (Data Destruction via Agent Tool) | PR.PS | — | LLM06 (Excessive Agency) | ASI02 (Tool Misuse & Exploitation) | — |
| AD.11 Network & Egress Control | — | PR.IR | — | — | — | — |
| AD.12 Supply Chain & Artifact Integrity | AML.T0020, AML.T0084.002 (Activation Triggers), AML.T0099 (Agent Tool Data Poisoning) | ID.SC (Supply Chain) | Supply Chain Mgmt | LLM03 (Supply Chain) | ASI04 (Agentic Supply Chain Vulnerabilities) | Annex IV §2 |
| AD.13 Model Lifecycle, Deployment & Rollback | AML.T0020 | PR.PS (Platform Security) | — | — | — | Annex IV §6, §9 |
| AD.14 Training Data Integrity & Governance | AML.T0020 (Poison Training Data), AML.T0019 (Publish Poisoned Datasets) | ID.AM, PR.DS | Data Security & Privacy | LLM04 (Data & Model Poisoning) | — | Art. 10, Annex IV §2 |
| AD.15 Memory, Embeddings & RAG Security | AML.T0070 (RAG Poisoning), AML.T0080 (AI Agent Context Poisoning) | PR.DS, DE.CM | Data Security & Privacy; Model Security | LLM08 (Vector & Embedding Weaknesses) | ASI06 (Memory & Context Manipulation) | Art. 15 |
| AD.16 Adversarial Robustness & Privacy Defense | AML.T0020, AML.T0024, AML.T0051, AML.T0059 | DE.CM, DE.AE, PR.DS | Model Security; Data Security & Privacy | LLM01, LLM02 (Sensitive Info Disclosure), LLM09 (Misinformation) | ASI01, ASI10 (Rogue Agents) | Art. 10, Art. 15 §5, Annex IV §2, §5 |
| AD.17 Logging & Audit | — | DE.CM (Continuous Monitoring) | — | — | — | Art. 12 |
| AD.18 Monitoring, Detection & Incident Response | AML.T0029 | DE.CM, DE.AE, RS.RP | — | LLM10 (Unbounded Consumption) | ASI10 (Rogue Agents) | Art. 15 §4, Annex IV §9 |
| AD.19 Human Oversight & Shutdown Control | — | GV.RM (Risk Management) | Transparency & Accountability | LLM06 (Excessive Agency) | ASI09 (Human-Agent Trust Exploitation) | Art. 14 |
Key external frameworks referenced:
- NIST IR 8596 (Cyber AI Profile, preliminary draft December 2025; comment period closed January 30, 2026; Spring 2026 working sessions on April 28, May 5, and May 12) — maps AI cybersecurity concerns to CSF 2.0 outcomes across Secure, Defend, and Thwart focus areas. Identified gap: implementation guidance for agentic patterns is still emerging.
- NIST SP 800-53 Control Overlays for Securing AI Systems (COSAiS) — implementation-focused overlay work for generative assistants, predictive AI, single-agent systems, multi-agent systems, and AI developers. This is a useful bridge from Appendix B families to audit-ready control baselines.
- NIST AI RMF Profile for Trustworthy AI in Critical Infrastructure — concept note released April 7, 2026. The planned profile will guide critical-infrastructure operators (energy, water, transport, healthcare) toward specific risk-management practices when deploying AI-enabled capabilities.
- MITRE ATLAS (2026 monthly cadence) — Secure AI's May 2026 recap notes 45+ new techniques/sub-techniques, 10+ mitigations, 20+ case studies, a Technique Maturity filter, and a Knowledge Graph. The v2026.05 data release (May 27, 2026) then tagged every technique with one or more platforms — Predictive AI, Generative AI, Agentic AI, Enterprise — and shipped ATLAS Data v6.0.0 (typed-relationship YAML schema, Pydantic validation, REST API, regenerated STIX/Excel/Navigator outputs), which makes platform-filtered control mapping against Appendix B families practical for the first time. The OpenClaw rapid-response report remains the most useful example for this inventory because it maps prompt injection, poisoned skills, exposed control interfaces, credential harvesting, exfiltration, and data destruction into a single agentic attack chain.
- MITRE SAFE-AI — maps ATLAS threats × 4 system elements (Environment, AI Platform, AI Model, AI Data) → 100 identified NIST SP 800-53 controls. The most granular threat-to-control mapping available.
- CSA AI Controls Matrix (AICM) — 243 control objectives across 18 security domains with ISO 42001, EU AI Act, and NIST AI RMF mappings completed August 2025. The 2026 update to AICM (March 10, 2026 CSO Awards recognition) is followed by the CSAI Catastrophic Risk Annex (April 29, 2026), which extends AICM and the STAR for AI assurance program to scenarios involving loss of human oversight, uncontrolled system behavior, and society-wide consequences. The annex rolls out in four phases between June 2026 and December 2027, aligned with NIST AI RMF, EU AI Act, and ISO/IEC 42001, and is the first AI controls framework explicitly built around testable kill-switch, action-gating, rollback, and emergent-behavior detection requirements.
- ISO/IEC 27090 — Cybersecurity guidance for AI systems remains under development. ISO advanced it from FDIS registration (stage 50.00) to the eight-week approval ballot/proof stage (50.20) on June 23, 2026; as of July 12 it has not reached publication stage 60.00. It is intended to complement ISO/IEC 42001's management-system focus with lifecycle guidance for understanding, detecting, and mitigating AI-specific security threats. ISO/IEC 27091 (AI privacy) is further behind: its DIS ballot closed February 26, 2026 with no FDIS registration announced, so late-2026 publication is the realistic floor.
- OWASP AI Maturity Assessment (AIMA, v1.0 August 2025) — integrates with OWASP SAMM and ISO/IEC AI standards for organizational security maturity assessment.
- OWASP Agentic AI Top 10 (December 2025, peer-reviewed by 100+ researchers) — ASI01–ASI10 covering agent goal hijack, tool misuse, identity and privilege abuse, agentic supply chain, unexpected code execution, memory and context poisoning, insecure inter-agent communication, cascading failures, human-agent trust exploitation, and rogue agents. A Dark Reading poll found 48% of cybersecurity professionals identify agentic AI as the number-one attack vector heading into 2026. The companion AI Security Solutions Landscapes (Q2 2026 editions published June 1, 2026 — one for Agentic AI, one for AI and Agentic Red Teaming) are now quarterly-updated maps of the open-source and commercial tooling that implements these controls, useful for populating the tools column of any AD-family gap assessment.
- OWASP State of Agentic AI Security and Governance (v2.01, June 1, 2026) — the GenAI Security Project's second edition pivots from cataloguing theoretical threats to tracking real CVEs, vendor advisories, and breach reports across 53 live agentic projects (28 of them coding agents, with the five most-advisory-heavy repositories carrying 11–57 advisories each and seven projects shipping updates daily or faster — one averaging a release every eight hours). Its headline finding for this inventory: prompt injection now maps to six of the ten OWASP Top 10 for Agentic Applications categories, confirming AD.6 as the highest-leverage family. It also frames the narrowing breach-disclosure windows AD.18 must meet — 4 hours (DORA), 72 hours (RAISE Act), 15 days (California SB 53) — and cites IBM data that only 37% of organizations have any policy to detect shadow AI.
- NSA CSI: Model Context Protocol Security Design Considerations (May 20, 2026) — the first U.S. government guidance dedicated to MCP, warning that adoption has outpaced safeguards. It calls out serialization risks, inverted client-server trust boundaries, unverified task propagation, dynamic tool invocation, implicit trust relationships, and uncontrolled automated actions, and states plainly that traditional authentication, authorization, and input-validation controls are necessary but insufficient for agentic systems. Maps directly onto AD.1, AD.2, AD.6, AD.10, AD.11, and AD.19.
- Microsoft Zero Trust for AI (March 2026) — new AI pillar added to the Zero Trust Workshop, bringing the framework to 700 security controls across 7 pillars (Identity, Devices, Data, Network, Infrastructure, Security Operations, AI). Automated Zero Trust Assessment for AI expected summer 2026.
- EU General-Purpose AI Code of Practice — the Safety and Security chapter gives providers of systemic-risk GPAI models a practical path to demonstrate AI Act Article 55 compliance, complementing the Appendix B families for model lifecycle, monitoring, incident response, and human oversight. The European Commission and EU AI Board have confirmed the GPAI Code as an adequate voluntary tool for Articles 53 and 55 compliance. From August 2, 2026 the Commission's enforcement powers enter into application for GPAI obligations, including fines, while the EU AI Omnibus political agreement (May 7, 2026) proposes targeted simplifications that providers should track: high-risk obligations deferred to December 2, 2027 (standalone) / August 2, 2028 (embedded), transparency obligations still applying August 2, 2026 with the synthetic-content grace period cut from six to three months (new deadline December 2, 2026), a new Article 5 prohibition on NCII/CSAM "nudifier" systems (compliance required by December 2, 2026), and national sandbox deadlines pushed to August 2, 2027. The simplifications are now near-final law rather than a political agreement: the European Parliament adopted the Digital Omnibus on AI in plenary on June 16, 2026 (423 in favour, 57 against, 174 abstentions), with the Council expected to formally adopt the text on June 29, 2026 ahead of publication in the Official Journal. On June 1, 2026 the Commission appointed the AI Act Scientific Panel (60 independent experts on frontier AI, technical auditing, and evaluation methodology) and the Advisory Forum (174 members, with ENISA and the Fundamental Rights Agency holding permanent seats) to advise the AI Office on GPAI classification, systemic risk, and evaluation standards.
- Linux Foundation Agentic AI Foundation (AAIF) — directed fund formed late 2025 by Anthropic, Block, and OpenAI with Google, Microsoft, AWS, Cloudflare, and Bloomberg. MCP joined as a founding project alongside Block's goose and OpenAI's AGENTS.md. Multi-vendor stewardship is now the baseline assumption for MCP-related controls in AD.1, AD.2, AD.6, AD.10, AD.11, AD.12, and AD.17.
- CIS Controls v8.1 — MCP, Agentic AI, and Non-Human Identity Companion Guides (CIS + Astrix + Cequence, released April 20, 2026) — three new companion guides apply the CIS Critical Security Controls to AI-specific surfaces. The MCP guide treats every MCP server as a new identity, access control, logging, and application security surface, with explicit guidance on secure tool access, NHI management (API keys, service accounts, OAuth tokens), and auditable interactions across the protocol layer. The companion-guide framing is the most direct path from a CIS-aligned program into AISVS Appendix B families AD.1, AD.2, AD.4, AD.6, AD.10, AD.12, and AD.17.
- OWASP AI Exchange — 300+ pages of open-source AI security guidance, feeding into EU AI Act (70 pages contributed), ISO/IEC 27090 (AI security), and ISO/IEC 27091 (AI privacy) standards through official liaison partnerships.
- Anthropic Shared Responsibility Model for AI Agents (April 2026) — formalizes a four-layer split that maps cleanly onto Appendix B: Model (owned by the AI provider — alignment, refusal behavior, distillation defenses), Harness (owned by the integrator — system prompts, policies, runtime guardrails), Tools (owned by the integrator — MCP servers, APIs, plugin scopes), and Environment (owned by the integrator — deployment context, secrets, data access). Most controls in AD.2, AD.4, AD.6, AD.10, AD.12, and AD.19 sit in the Harness/Tools/Environment layers and are not satisfied by switching models. Useful when scoping a deployment review or red-team engagement: catalog responsibilities by layer first, then map to AD families.
AI Security Platform Coverage
Which commercial and open-source platforms address which control families. Reflects the major consolidation wave of 2024–2025: Robust Intelligence → Cisco (Oct 2024), Protect AI → Palo Alto (Apr 2025), Lakera → Check Point (Sep 2025), Prompt Security → SentinelOne (Aug 2025, ~$250M), SPLX → Zscaler (2026). The broader cybersecurity M&A wave totaled $76–96B across 320–400 deals in 2025 (Return on Security / Momentum Cyber), with AI security as a distinct acquisition category. Early 2026 shows a second inflection point: established endpoint, API, and gateway vendors (CrowdStrike, Kong, Salt, Zscaler) are extending existing platforms to AI, while newer entrants (Capsule Security, Noma Security, Operant) target the runtime gap between prompt arrival and agent action. By July 2026 the picture has shifted again — the SentinelOne Prompt AI line (Agent Security + Red Teaming + Auto Investigation), Databricks Lakewatch (agentic SIEM on the lakehouse, Adobe and Dropbox as launch customers), Sweet Attack (whitebox agentic red-team agent for live production), and Citrix NetScaler's MCP Gateway functionality have moved agent identity, tool policy, rate limits, and agent-traffic observability into mainstream security and application-delivery platforms. The newest tools are themselves agentic, treat agent-to-agent traffic as a first-class telemetry source, and assume — consistent with Salt Security's 1H 2026 finding that 99% of attack attempts originate from authenticated sources — that the attacker is increasingly a rogue agent with valid credentials rather than an external unauthenticated probe.
| Platform | AD.1 | AD.2 | AD.6 | AD.8 | AD.9 | AD.12 | AD.16 | AD.17 | AD.18 | Notes |
|---|---|---|---|---|---|---|---|---|---|---|
| Cisco AI Defense | X | X | X | X | X | X | MCP Catalog for MCP server risk (Feb 2026); AI BOM for asset governance; algorithmic red teaming | |||
| Protect AI (Palo Alto) | X | X | X | X | X | X | LLM Guard (OSS, 15 input + 20 output scanners); Guardian (35+ model format scanning); ModelScan (OSS) | |||
| Lakera (Check Point) | X | X | X | X | Lakera Guard (runtime, single-line integration); Lakera Red (automated red teaming) | |||||
| SentinelOne Prompt AI Agent Security + Prompt AI Red Teaming (RSAC 2026 GA) | X | X | X | X | X | X | X | Builds on the Prompt Security acquisition (Aug 2025) — Prompt AI Agent Security is a real-time discovery and governance control plane for AI agents and agentic workflows, extending Singularity Autonomous Security Intelligence into the agentic layer. Prompt AI Red Teaming continuously simulates prompt injections, jailbreaks, privilege escalations, and data poisoning before apps ship. Sub-200ms inline latency; semantic DLP; 250+ model coverage. | ||
| Straiker | X | X | X | X | X | Agentic-first; Ascend AI (adversarial agent testing) + Defend AI (runtime security); 8x growth in 6 months (Feb 2026); multi-six/seven-figure enterprise deals | ||||
| CalypsoAI | X | X | X | X | Agentic cognitive-layer intervention; CrewAI + MCP support | |||||
| HiddenLayer | X | X | X | Model integrity monitoring; adversarial attack prevention | ||||||
| Qualys TotalAI | X | X | X | X | Inventory-first approach; 650+ AI-specific detections; MCP server graph inventory (March 2026); shadow model discovery; AI CVE scanning | |||||
| Kong AI Gateway 3.14 / Agent Gateway | X | X | X | X | X | X | X | April 14, 2026 release — unified governance of LLM + MCP + agent-to-agent (A2A) traffic from one control plane; token-aware rate limiting; full A2A audit logging; AI Semantic Prompt Guard; MCP server security | ||
| Citrix NetScaler MCP Gateway | X | X | X | X | Announced July 9, 2026: centralized MCP authentication with per-user/global tokens and OAuth or hybrid flows, tool-level rate limits, server allow/block lists, protocol-aware health monitoring, and token/request attribution by team, user, or application. This is gateway enforcement and visibility, not a substitute for response-content screening or per-tool sandboxing. | |||||
| Operant Endpoint Protector | X | X | X | X | X | X | X | X | May 4, 2026 launch — endpoint-native discovery, agent loop tracing, inline data exfiltration defense, runtime RBAC for MCP clients/servers/tools, and CodeInjectionGuard for package and shell execution attacks | |
| Salt Agentic Security Platform | X | X | X | X | X | March 18, 2026 launch — Agentic Security Graph linking LLMs, MCP servers, and APIs; AG-SPM for posture management and AG-DR for real-time detection across agent-driven activity | ||||
| AWS Bedrock Guardrails | X | X | 6 guardrail types; automated reasoning with formal logic; 88% harmful content blocking | |||||||
| Azure AI Content Safety | X | X | Prompt Shields; Groundedness Detection (preview); detection-oriented | |||||||
| Datadog LLM Obs | X | X | X | Auto-instrumentation; prompt injection scanning; PII leak detection; $8/10K requests | ||||||
| Langfuse (OSS) | X | 19K+ GitHub stars; multi-turn tracing; prompt versioning | ||||||||
| F5 AI Guardrails + Red Team | X | X | X | X | X | CalypsoAI acquisition; model-agnostic runtime guardrails; autonomous red-team agent swarms with 10K+ attack techniques/month; Fortune 500 deployments (Jan 2026) | ||||
| Varonis Atlas | X | X | X | AI Gateway for real-time prompt/response inspection; data-aware posture management; shadow AI discovery; full lifecycle (discovery → runtime → compliance); launched March 2026 | ||||||
| SandboxAQ AQtive Guard | X | X | X | AI security posture management; MCP server discovery and monitoring; runtime guardrails for prompt injection and data leakage; announced ahead of RSAC 2026 | ||||||
| Arize Phoenix (OSS) | X | X | OpenTelemetry-native; drift detection; 7.8K+ GitHub stars | |||||||
| CrowdStrike AIDR / Falcon | X | X | X | X | X | RSA 2026 announcement: AIDR for Copilot Studio (real-time prompt inspection, injection detection), AIDR for Endpoint (desktop LLM clients), Shadow AI Discovery across endpoint/SaaS/cloud, AI Data Flow Discovery for Cloud | ||||
| Capsule Security | X | X | X | Launched April 15, 2026 with $7M seed (Lama Partners, Forgepoint); agentless runtime monitoring and policy enforcement for AI agents (Cursor, Claude Code, Copilot Studio, ServiceNow, Salesforce Agentforce); founded by ex-F5/Unit 8200 and Transmit Security veterans | ||||||
| Zscaler AI Guard / SPLX | X | X | X | X | AI Runtime Guardrails integrated with NVIDIA NeMo Guardrails (aiguard-nemo-guardrails connector); blocks prompt injection, PII exposure, data poisoning, and malicious outputs; 2026 SPLX acquisition extends coverage across the enterprise AI lifecycle | |||||
| Noma Security | X | X | X | X | Runtime guardrails for Microsoft Copilot Studio agents; policy enforcement on agent behavior before action completes | |||||
| Microsoft Agent 365 (GA May 1, 2026; Build 2026 expansion June 2, 2026) | X | X | X | X | X | X | X | Control plane for AI agents bundled in Microsoft 365 E7; combines Defender (prompt manipulation, model tampering, attack-chain detection), Entra Agent ID (first-class agent identity GA at RSAC 2026), and Purview (oversharing prevention); supports OAuth 2.0, MCP, and A2A for agent authentication. Build 2026 added the Agent 365 SDK (GA, observability/access-control/compliance enforcement in agent dev workflows), Agent Registry (preview, surfaces unmanaged local agents via Defender/Entra/Intune across 20+ agent types with Intune-policy blocking), Purview Runtime DLP for agent prompts (preview), and Defender AI Model Scanning (preview, model artifact validation across registries and CI/CD) | ||
| Cisco AI Defense + Astrix (announced May 4, 2026) | X | X | X | X | X | X | X | Acquisition adds non-human identity discovery, agent NHI fingerprinting across cloud/IdP/SaaS/DevOps, NHI lifecycle management, and shadow-AI-agent discovery via EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender); MCP server inventory and policy enforcement | ||
| 1Password Unified Access Pro (GA March 17, 2026) | X | X | Three-layer platform — Discover (endpoint/browser AI activity, exposed secrets), Secure (NHI vaulting), Audit (forthcoming) — plus 1Password Environments MCP Server for Codex (May 20, 2026) for just-in-time credential mounting without prompt/code/model-context exposure | |||||||
| Check Point AI Defense Plane × Google Cloud (late June 2026) | X | X | X | X | X | X | X | Integrates with Google Cloud's Gemini Enterprise Agent Platform across three layers — control plane (identity/connectivity), governance (pre-deployment policy on tools and MCP servers), and runtime intelligence (prompt-injection detection across inputs/tool responses/multi-turn conversations, sensitive-data-leakage prevention, tool-call screening) | ||
| Permiso Security AI Agent Runtime Security (May 14, 2026) | X | X | X | X | X | Identity runtime attribution across managed and shadow agents; continuous visibility into agent runs, events, tool calls, and data access spanning agents, sub-agents, MCP servers, and underlying infrastructure; Autodesk Fortune 500 launch customer | ||||
| Google Cloud Model Armor + Gemini Enterprise Agent Platform (Cloud Next 2026) | X | X | X | X | X | X | Model Armor integrates with Agent Gateway, Agent Runtime, Langchain (preview), and Firebase (GA) to block prompt injection, tool poisoning, and data leakage at runtime; unified agentic control plane for build/optimize/govern | |||
| Akeyless Runtime Authority for AI Agents | X | X | X | X | Intent-aware credential issuance and policy enforcement at the moment a credential is requested by an autonomous agent; integrates with existing secret-management workflows so policy travels with the credential rather than living at the gateway | |||||
| Microsoft Agent Governance Toolkit (open source, April 2, 2026) | X | X | X | X | X | Open-source runtime security primitives for AI agents — agent inventory, scoped tool permissions, runtime policy enforcement, audit hooks — that integrators can embed in custom agent stacks instead of taking a dependency on a closed platform | ||||
| Microsoft MDASH agentic scanning harness (May 12, 2026) | X | X | X | X | X | Multi-model agentic security system orchestrating 100+ specialized AI agents across frontier and distilled models to discover, debate, and prove exploitable bugs end-to-end; found 16 new Windows networking/auth vulnerabilities including four Critical RCEs in its first published campaign | ||||
| OpenAI Daybreak (May 2026) | X | X | X | X | X | AI-powered vulnerability detection and patch-validation tooling; complements MDASH-style agentic discovery with provider-side validation that proposed patches actually resolve the underlying exploit chain | ||||
| ServiceNow AI Control Tower + Autonomous Security & Risk (Knowledge 2026, May 2026) | X | X | X | X | X | X | Knowledge 2026 expansion brought AI Control Tower across Microsoft, NVIDIA, and security partners. The new Autonomous Security & Risk product pulls Veza (identity governance) and Armis (asset visibility) into a single ServiceNow plane for AI agent identity, permission, and connected-asset governance — useful when the AI security program needs to land inside an existing ITSM / GRC tool of record rather than a standalone control plane. | |||
| Sweet Security Sweet Attack (May 13, 2026) | X | X | X | X | First agentic AI red-team agent designed to run inside live production environments rather than synthetic test conditions. Uses runtime data already indexed by Sweet (application behavior, identity paths, exposed interfaces, deployed source) to identify combinations of weaknesses — vulnerabilities, identity relationships, permissive scopes, exposed APIs, unauthenticated endpoints — and probes them step-by-step to prove exploitable chains. Positioned by the vendor against the "Mythos" benchmark of AI-assisted attack capability. | |||||
| Databricks Lakewatch (RSAC 2026 private preview) | X | X | Open, agentic SIEM running directly on the Databricks lakehouse, powered by Claude. Genie automates OCSF log onboarding, new-detection authoring, false-positive tuning, and natural-language-to-SQL queries. Decouples compute from storage so petabytes of detection data can be retained for years at up to 80% lower cost than legacy SIEMs. Adobe and Dropbox cited as launch customers. | |||||||
| Cisco Cloud Control / AgenticOps (Cisco Live US, June 2, 2026) | X | X | X | X | Unified control plane "built for humans and AI agents" spanning Cisco networking, security, compute, observability, and collaboration from one data layer, positioned as the foundation of Cisco's AgenticOps model. Folds in AI Defense, Zero Trust for agents, and the Agentic SOC, plus Live Protect (runtime shielding of Cisco products against new vulnerabilities with no reboot/upgrade) and Quantum Ready Assessments for harvest-now-decrypt-later exposure. Complements the separately announced Cisco + Astrix non-human-identity work (May 4, 2026). |
Notable Incidents (2026)
Each of these incidents stress-tests one or more AD families. The pattern is consistent: prompt injection moves laterally into supply chain, identity, and sandbox failures, so single-family controls are rarely sufficient on their own.
| Date | Incident | Primary AD Families | Why It Matters |
|---|---|---|---|
| Dec 2025–Feb 2026 (reported Apr 10) | AI-assisted breach of nine Mexican government agencies — Gambit's forensic report found that one operator used Claude Code for roughly 75% of remote-command activity and a custom GPT-4.1 pipeline to process harvested server data. Recovered materials included more than 400 attack scripts, 20 tailored exploits, 1,088 prompts, and 5,317 AI-executed commands across 34 live-infrastructure sessions; hundreds of millions of citizen records were exfiltrated. | AD.17, AD.18 | Monitoring has to join model prompts and responses to endpoint, identity, network, and tool-execution telemetry. Either side alone misses the causal chain: benign-looking model traffic can drive hostile commands, while host activity loses the agent and prompt context needed to reconstruct orchestration across sessions and providers. |
| Feb 17, 2026 | Cline CLI 2.3.0 / Clinejection — compromised npm publish token plus an added postinstall script delivered OpenClaw to ~4,000 developer machines in 8 hours; initial foothold via prompt injection in a GitHub issue title that an automatic triage workflow ingested. | AD.6, AD.12, AD.17 | Indirect prompt injection now compromises packages and the developers who install them. Scope publish tokens, freeze AI-agent triage permissions, and treat GitHub issue content as untrusted input. |
| Feb 23, 2026 | Anthropic distillation campaign disclosure — ≈24,000 fraudulent Claude accounts and 16M+ exchanges across DeepSeek, Moonshot AI, and MiniMax; included chain-of-thought elicitation to generate training data. Anthropic deployed classifiers, behavioral fingerprinting, stronger verification for educational/research accounts, and indicator sharing with cloud providers. | AD.16, AD.9, AD.18 | Industrial-scale model extraction now hits frontier models. Rate-limits alone fail; behavioral fingerprinting, CoT-elicitation filters, and cross-provider indicator-sharing are needed. |
| Mar 24, 2026 | LiteLLM 1.82.7/1.82.8 PyPI compromise — malicious updates pushed to widely used proxy. | AD.12, AD.13 | Pinned versions and signed artifacts; review CI/CD ingestion paths for AI-adjacent packages. |
| Apr 2026 | Axios npm supply-chain compromise — patient-zero npm worm hitting JavaScript dev environments. | AD.12, AD.17 | Auditable lockfiles, scoped publish tokens, and outbound monitoring on developer machines. |
| Mar 10, 2026 | Microsoft MCP Server CVE-2026-26118 (CVSS 8.8, Patch Tuesday) — flaw in Microsoft's MCP server let attackers manipulate tool-invocation requests generated by an AI assistant, opening a path to unauthorized access on connected services or injection of malicious responses into AI workflows. | AD.6, AD.10, AD.2 | Patch MCP server deployments promptly; validate every tool-invocation request server-side rather than trusting the assistant-generated payload; assume any MCP server bridging an AI to internal tools is a high-value asset. |
| Apr 13, 2026 | nginx-ui CVE-2026-33032 "MCPwn" (CVSS 9.8, actively exploited in the wild) — the /mcp_message endpoint was missing the AuthRequired() middleware, letting an unauthenticated network-adjacent attacker invoke 12 privileged MCP tools (including nginx_config_add with auto-reload) for full nginx takeover in two HTTP requests. Recorded Future reported in-the-wild exploitation on April 13, 2026; PurpleOps observed chained exploitation with CVE-2026-27944 by April 16, 2026. ~2,689 exposed instances globally (China, U.S., Indonesia, Germany, Hong Kong). The upstream advisory lists all versions as affected and no patched version. Its remediation recommends adding AuthRequired() and separately says to consider making an unconfigured whitelist fail closed; it does not describe either change as shipped. Widely described as the first major MCP exploit observed in the wild. | AD.1, AD.6, AD.10, AD.12 | Treat MCP endpoints as privileged control planes — every tool route needs AuthRequired() (or equivalent) middleware, every MCP server needs an inventory entry alongside other privileged APIs, and exposure to untrusted networks should be the exception not the default. Pair authentication enforcement with destination allow-lists and tool-invocation logging so the next missing-auth case is detected before exploitation. |
| Mid-Apr 2026 | Comment and Control disclosure — a single GitHub PR-title prompt injection hijacked Anthropic's Claude Code Security Review action (initially CVSS 9.3 Critical, raised to 9.4 on 2025-11-25, then reclassified to None on 2026-04-20), Google's Gemini CLI Action, and GitHub's Copilot Coding Agent into posting host-repository API keys as PR comments — using GitHub itself as the command-and-control channel. Reported 2025-10-17 by Aonan Guan with Johns Hopkins collaborators; the coordinated disclosure shipped with no CVE record and no vendor advisory page. | AD.6, AD.4, AD.17 | Treat every PR title, issue body, and comment as untrusted instruction context for any agent that reads them; scope agent GitHub tokens to minimum required permissions; do not co-locate long-lived secrets with prompt-context inputs (C9.5.4); add gateway-level filters on agent posts back to the repository. |
| Apr 15, 2026 | OX Security MCP "Mother of All AI Supply Chains" disclosure — systemic RCE pattern across the official Anthropic MCP SDKs (Python, TypeScript, Java, Rust) affecting 150M+ downloads, 7,000+ publicly exposed servers, and an estimated 200,000 vulnerable instances, with successful command execution on six live production systems. CVE-2025-65720 (GPT Researcher), CVE-2026-30623 (LiteLLM), CVE-2026-30615 (Windsurf), CVE-2026-30624 (Agent Zero), CVE-2026-40933 (Flowise), and CVE-2026-30625 (Upsonic) issued alongside the advisory. Anthropic confirmed the behavior as intentional and declined to modify the protocol. | AD.10, AD.12, AD.11 | Block public internet access to sensitive services; treat external MCP configuration as untrusted; use verified official registries only; sandbox MCP-enabled services with restricted permissions; monitor tool invocations for anomalous activity; update to patched downstream versions even when the upstream protocol remains unchanged. |
| May 7, 2026 | Microsoft Semantic Kernel CVE-2026-25592 (CVSS 9.9) and CVE-2026-26030 — a prompt-injected agent escaped the Azure Container Apps Python sandbox via DownloadFileAsync, an internal helper accidentally tagged [KernelFunction] with no path validation. Patched in .NET SDK 1.71.0 / Python SDK 1.39.4. | AD.6, AD.10, AD.12 | LLM-callable surface is the new attack surface. Audit every [KernelFunction] (or framework equivalent) for argument validation and exposure scope; treat kernel-function annotations as policy decisions, not convenience tags. |
| May 11, 2026 | PraisonAI CVE-2026-44338 (CVSS 7.3) — auth bypass probed within 4 hours — the framework's legacy Flask API shipped with hard-coded AUTH_ENABLED = False, exposing unauthenticated GET /agents (agent enumeration) and POST /chat (triggers the configured agent workflow, including tool execution with file I/O). Affects 2.5.6–4.6.33, patched in 4.6.34. Sysdig telemetry caught a "CVE-Detector/1.0" scanner probing the exact endpoint 3h44m after the advisory published. | AD.1, AD.2, AD.9, AD.18 | Exploitation velocity against AI agent frameworks now runs in hours, not days. Defaults matter: a framework that ships with auth disabled fails its deployers; verify auth-enabled defaults during supply-chain vetting and monitor for scanner probes against agent endpoints from day zero. |
| May 13, 2026 | Akamai "One Is a Fluke, 3 Is a Pattern" — three flaws in database-facing MCP servers: SQL injection in Apache Doris MCP Server <0.6.1 (CVE-2025-66335, exec_query fails to validate db_name, bypassing the SQL validator), potential account takeover in Apache Pinot MCP, and an unauthenticated metadata-exfiltration flaw in Alibaba RDS MCP that the vendor declined to fix. | AD.1, AD.6, AD.12 | MCP servers that front databases inherit classic injection bugs plus agentic reachability — natural-language input becomes a SQL injection vector. Vet database-facing MCP servers like any other data-plane API, and track unpatched vendor declinations in the risk register. |
| May 20, 2026 | VIPER-MCP coordinated disclosure: 106 zero-days, 67 CVEs — an academic framework combining two-pass static taint analysis with feedback-driven prompt evolution auto-generated working proof-of-concept exploit prompts across 39,884 open-source MCP server repositories, finding shell-exec, filesystem, and network sinks reachable from natural-language input. | AD.6, AD.10, AD.12, AD.16 | Vulnerability discovery in the MCP ecosystem is now automatable at scale — assume the attackers run the same pipelines. Static taint analysis over MCP server code (prompt-reachable sinks) belongs in CI for any in-house MCP server. |
| May 26, 2026 | SymJack (Adversa AI) — a symlink-disguised file copy tricked six AI coding agents (Claude Code, Cursor, Antigravity, GitHub Copilot, Grok Build, and one more) into executing remote code while the in-agent approval prompt misrepresented the action being authorized. | AD.19, AD.10, AD.6 | The human-in-the-loop approval gate is only as trustworthy as its rendering — C9.2.2 (canonicalized, untruncated parameter display) is the control that stops symlink/format deception from manufacturing consent. Audit how every agent renders the action it asks a human to approve, not just whether a gate exists. |
| Jun 9, 2026 | Microsoft June 2026 Patch Tuesday — three Copilot injection CVEs — CVE-2026-45497 (M365 Copilot RCE via command injection, CVSS 7.7), CVE-2026-42824 (M365 Copilot information disclosure, CVSS 6.5, unauthenticated), and CVE-2026-47644 (Edge Copilot Chat injection leading to information disclosure, CVSS 6.5). All remediated cloud-side with no customer action; Microsoft reported over 40% of the month's 206 fixes originated from AI-assisted discovery. | AD.6, AD.8, AD.13 | Injection bugs reach flagship SaaS assistants, not just niche frameworks — but the cloud-side remediation model also shows what AD.13 lifecycle control looks like when it works: fix deployed centrally before public disclosure, zero deployer action required. |
| Jun 12, 2026 | Agentjacking (Tenet Threat Labs) — attacker-forged Sentry error events, injected via any public DSN, were returned to AI coding agents (Claude Code, Cursor, Codex) by the legitimate Sentry MCP server as trusted "diagnostic resolution steps," driving execution of attacker-controlled npm packages. 2,388 orgs had injectable DSNs; 100+ live agent executions confirmed up to the Fortune 100. Disclosed to Sentry June 3, 2026; Sentry declined a root fix ("technically not defensible") and deployed a payload-string filter; Tenet open-sourced agent-jackstop (June 18, 2026). | AD.6, AD.12, AD.2 | Telemetry, logs, and error streams are a first-class indirect-injection channel — not just prompts and documents. Treat all MCP tool output, including observability data, as untrusted instruction context; never let an agent act on log/error content without sanitization and human-verified, least-privilege execution. A trusted, authenticated MCP server is no guarantee its content is trustworthy. |
| Jun 18, 2026 | AutoJack (Microsoft) — attacker-controlled JavaScript rendered by an AutoGen browsing agent opened an unauthenticated loopback MCP WebSocket and supplied a command that AutoGen Studio spawned under the developer's account. The chain combined misplaced trust in a localhost Origin, authentication middleware that skipped MCP paths, and a command-bearing server_params payload. Maintainers hardened upstream main in commit b047730; the affected surface never shipped in a PyPI release. | AD.1, AD.6, AD.10, AD.11 | A browsing agent is a local principal, so localhost does not authenticate the caller. Negative-test privileged loopback services with script execution originating from agent-rendered pages; require authentication and authorization on every MCP route, validate Origin and Host independently, reject command-bearing configuration from untrusted content, and isolate spawned processes. |
| Jun 2026 | TrustFall (Adversa AI) — a trust-dialog regression combined with settings-scope inconsistency enabled one-click RCE on local machines and no-click execution on CI runners across Claude Code, Cursor, Gemini CLI, and GitHub Copilot. | AD.19, AD.10 | Trust and approval dialogs are security-critical UI: regressions in how scope and consent are presented reopen the exact RCE path the approval gate exists to close. Auto-approving CI runners are the highest-risk deployment because they delete the human entirely. |
Coverage Gap Analysis
Candidate Cross-Cutting Categories
The 19 families assign each requirement to exactly one place, which is good for completeness but means some cross-cutting concerns are spread thin across several families. These are the areas where a single-family view loses the most signal:
- Standalone Privacy & Data Governance — Privacy defense is folded into AD.16 (differential privacy, output calibration, membership-inference defense) and data governance into AD.14, so no single family covers data minimization, lineage tracking, retention, and inference-time privacy together. A privacy program still has to read across AD.3, AD.4, AD.14, AD.15, and AD.16.
- Model Fairness & Bias Testing — Bias evaluation for security-relevant decisions lives at C1.3.3 inside AD.14, but there is no dedicated fairness requirement set spanning representativeness, disparate-impact testing, and post-deployment fairness monitoring.
- Incident Forensics — AD.18 retains incident response in its title, but the July 2026 inventory no longer maps explicit requirements for AI-specific forensic tooling, a scenario-based AI incident-response plan, automated model isolation, or post-incident retraining feedback. C12.4.1 now covers security evaluation and threat-landscape assessment for autonomous action triggers; dataset lineage sits in AD.14 at C12.5.1. Reconstructing model and agent behavior after an incident therefore depends on the broader incident-response program and remains a control-level gap in this inventory.
- Hardware & Accelerator Security — Hardware controls are distributed across AD.10 (firmware C4.2.1, TEE/confidential computing C4.2.2, GPU attestation C4.2.3, memory partitioning C4.2.4) and AD.11 (interconnect topology C4.2.5). GPU partitioning, confidential computing, accelerator firmware, and attestation are a coherent surface that no single family surfaces as such.
- Multi-Agent Coordination Security — C9 covers delegation (C9.5.5) and isolation, but agent coordination patterns (consensus, conflict resolution, swarm safety) are emerging concerns. As of March 2026, 25.5% of deployed agents can create and task other agents autonomously.
- MCP-Specific Controls — MCP risk cuts across AD.1, AD.2, AD.5, AD.6, AD.10, AD.11, AD.12, AD.17, and AD.19. As of March 2026, over 10,000 active public MCP servers had appeared within roughly a year of the protocol's introduction, with 53% relying on static secrets for authentication (Astrix). OX Security's April 15, 2026 "Mother of All AI Supply Chains" disclosure escalated this from design concern to systemic supply-chain exposure: a single architectural pattern in the Anthropic MCP SDKs exposed 150M+ downloads, 7,000+ public servers, and an estimated 200K vulnerable instances, with Anthropic declining to modify the protocol. CVE-2026-33032 "MCPwn" (CVSS 9.8, actively exploited from April 13, 2026, ~2,689 exposed instances) then confirmed that "missing
AuthRequired()on an MCP route" is a real-world exploitable failure mode, not a theoretical one. The CIS Controls v8.1 MCP Companion Guide (April 20, 2026) and the NSA's May 20, 2026 CSI on MCP security design considerations both address MCP directly. June 2026 telemetry keeps the pressure on: Censys counted 12,520 internet-accessible MCP services (most unauthenticated), ~40% of remote MCP servers expose tools with no authentication, and VIPER-MCP added 67 coordinated-disclosure CVEs from a single automated study of 39,884 open-source MCP server repositories. Agentjacking (June 12, 2026) then moved the threat model from MCP server code to MCP content: attacker-forged Sentry telemetry returned through a legitimate, authenticated MCP server hijacked AI coding agents into running attacker code across 100+ organizations, and the vendor declined a root fix — proof that authenticating the server does not sanitize what it returns. A dedicated MCP control category looks increasingly necessary, with explicit guidance that the protocol layer does not sanitize inputs and the deployer must enforce authentication, scoped tool exposure, sandbox boundaries, and egress allow-lists at every MCP server. - Agentic Identity & Delegation — The OWASP Agentic AI Top 10 (2026) introduces 10 distinct risk categories (ASI01–ASI10) that cut across multiple AD families. Agent identity, delegation chains, and inter-agent trust relationships are spread across AD.1, AD.2, and AD.19 rather than treated as one surface. The EY February 2026 survey found 52% of department-level AI initiatives operate without formal approval or oversight, and 78% of leaders say AI adoption outpaces their ability to manage it.
Requirements Whose Concerns Span Multiple Families
The source deliberately places each requirement in exactly one family, but several requirements carry a control whose effect is felt across families. Tracking these explicitly avoids the illusion that one family fully "owns" the control:
| Requirement | Assigned Family | Also Serves | Why |
|---|---|---|---|
| C4.2.2 (TEE / confidential computing) | AD.10 | AD.3, AD.4 | Hardware-isolated execution with attestation also underpins tenant isolation and data-at-runtime protection |
| C9.4.2 (execution-chain signing) | AD.5 | AD.17 | Cryptographic non-repudiation is both an integrity control and an audit/forensics control |
| C5.2.4 (post-inference entitlement filtering) | AD.2 | AD.8 | A per-caller authorization decision that is enforced at the output stage |
| C9.5.4 (secrets out of model-observable context) | AD.4 | AD.1, AD.2 | Keeping credentials out of prompts and tool parameters protects both data and the identities those secrets represent |
| C7.4.1–C7.4.3 (RAG source attribution) | AD.15 | AD.8, AD.18 | Citation integrity is a memory/RAG control, an output-trust control, and a monitorable provenance signal |
| C11.2.3 (output calibration/perturbation) | AD.16 | AD.8 | Suppressing exploitable overconfidence is an extraction defense that also constrains exposed confidence in outputs |
| C5.2.7 (classification-label propagation) | AD.3 | AD.4, AD.15 | Labels must travel with data into embeddings, caches, and outputs to keep encryption and retrieval scopes honest |
| C12.5.3 (immutable model-change audit records) | AD.17 | AD.13 | One control serving both lifecycle governance and tamper-evident audit |
Industry Adoption Snapshot (June 2026)
Overall adoption remains low — 94% of enterprises use AI in production, yet only 23% have mature security programs. As of June 2026, the governance gap is widening: 97% of tech executives view broad autonomous AI as a high or essential priority, but 52% of department-level AI initiatives operate without formal oversight (EY, February 2026). The Zscaler 2026 AI Security Report logged an 83% year-over-year increase in AI/ML traffic across more than 3,400 applications, with Finance/Insurance carrying 23% of volume and Technology and Education sectors growing 202% and 184% respectively. Shadow-AI exposure is now measurable in dollars: 98% of organizations have employees using unsanctioned AI tools, ~60% of orgs have experienced at least one data exposure event tied to public GenAI, and the average shadow-AI-related breach now runs about $4.63M (Authentech/Second Talent aggregates, 2026). The OX MCP disclosure, MCPTox benchmark, and Clinejection together add a sharper point: the riskiest adoption gap is no longer just model access, but ungoverned tool execution and developer-machine compromise via agent-adjacent packages.
| Metric | Percentage | Source |
|---|---|---|
| Enterprises using AI in production | 94% | CyberSecFeed AI Security Maturity Model |
| Tech execs rating autonomous AI as high/essential priority | 97% | EY Autonomous AI Survey (Feb 2026) |
| Orgs implementing any GenAI security controls | 47% | Microsoft Cyber Pulse AI Security Report |
| Orgs enforcing AI security inline, at point of action | 23% | Industry aggregate |
| Orgs with comprehensive AI security governance | 25% | CSA AI Security & Governance Survey (Dec 2025) |
| Orgs with advanced AI security strategy | 6% | Gartner (2026) |
| Orgs with full security approval for AI agents | 14.4% | Gravitee State of AI Agent Security 2026 |
| Orgs with real-time governance enforcement | 7% | Industry aggregate |
| Dept-level AI initiatives without formal oversight | 52% | EY Autonomous AI Survey (Feb 2026) |
| AI agents actively monitored/secured | 47.1% | Gravitee |
| Models lacking security scanning | 67% | CyberSecFeed |
| Models vulnerable to prompt attacks | 89% | CyberSecFeed |
| Orgs using unvetted pre-trained models | 91% | CyberSecFeed |
| Orgs reporting AI security incidents in past year | 88% | Gravitee |
| Orgs with no visibility into AI data flows | 86% | HelpNetSecurity (March 2026) |
| Confirmed/suspected sensitive data leak via unauthorized GenAI | 45% | EY (Feb 2026) |
| Confirmed/suspected proprietary IP leak via unauthorized GenAI | 39% | EY (Feb 2026) |
| Orgs with formal GenAI governance reducing data leakage | up to 46% reduction | Practical DevSecOps (March 2026) |
| Cybersecurity pros identifying agentic AI as #1 attack vector | 48% | Dark Reading poll (2026) |
| OWASP Agentic Top 10 categories that prompt injection maps to | 6 of 10 | OWASP State of Agentic AI Security & Governance v2.01 (June 1, 2026) |
| Orgs with any policy to detect shadow AI | 37% | IBM, via OWASP State of Agentic AI v2.01 (June 2026) |
| Enterprises with at least one AI workload in production | 72% | Cybersecurity Insiders AI Risk Report (Q1 2026) |
| Orgs describing AI adoption as "mature" across functions | 28% | Cybersecurity Insiders AI Risk Report (Q1 2026) |
| Orgs with comprehensive AI security governance policies | 26% | CSA/Google Cloud AI Governance Study (2026) |
| Year-over-year growth in enterprise AI/ML traffic | 83% | Zscaler 2026 AI Security Report |
| Unique AI/ML applications observed in enterprise traffic | 3,400+ | Zscaler 2026 AI Security Report |
| Orgs with employees using unsanctioned AI tools | 98% | Authentech / Second Talent Shadow AI Statistics 2026 |
| Orgs that have experienced at least one shadow-AI data exposure | ~60% | Shadow AI aggregate (2026) |
| Avg cost of a shadow-AI-related data breach | ~$4.63M | Shadow AI aggregate (2026) |
| Orgs that can control agent actions with proper guardrails and live monitoring | 24% | Cisco AI Readiness Index (2026) |
| NHI-to-human identity ratio in modern enterprises | ~45:1 | NHI Forum / industry aggregate (2026) |
| NHI-to-human identity ratio in cloud-native / DevOps environments | ~144:1 | NHI Forum / industry aggregate (2026) |
| NHIs older than one year without credential rotation | 47% | DoControl Non-Human Identities Report (2026) |
| Enterprises that have suffered a breach via a compromised NHI | ~67% | DoControl NHI Report (2026) |
| "Identity dark matter" (unmanaged identity) as share of total identity | 57% | Orchid Security Identity Gap Snapshot 2026 (May 19, 2026) |
| CVEs exploited within 24 hours of disclosure | 28.3% | Mandiant M-Trends 2026 |
| MCP-related CVEs filed in Jan–Feb 2026 | 30+ | Heyuan / industry aggregate (March 2026) |
| Internet-accessible MCP services (mostly unauthenticated) | 12,520 | Censys, via Adversa AI MCP security roundup (June 4, 2026) |
| Remote MCP servers exposing tools with no authentication | ~40% | Adversa AI MCP security roundup (June 4, 2026) |
| Exposed MCP servers carrying CVSS 9.8 vulnerabilities | 1,467 | Trend Micro, via Adversa AI roundup (June 2026) |
| MCP CVEs assigned via one automated taint-analysis study (VIPER-MCP) | 67 | arXiv 2605.21392 (May 20, 2026) |
| Commercial LLM APIs sharing prompt caches globally across users | 7 of 8 caching APIs | Stanford prompt-cache audit, arXiv 2502.07776 (Feb 2026) |
| Documents needed to backdoor an LLM regardless of model size | ~250 | Anthropic / UK AISI / Alan Turing (Oct 2025) |
| Orgs lacking advanced AI security maturity required for autonomous agents | 92% | Salt Security 1H 2026 State of AI and API Security Report |
| Orgs essentially blind to non-human (agent/API) traffic | 48.9% | Salt Security 1H 2026 |
| Orgs unable to reliably distinguish legitimate AI agents from malicious bots | 48.3% | Salt Security 1H 2026 |
| Attack attempts (Salt Labs telemetry) originating from authenticated sources, increasingly rogue agents | 99% | Salt Security 1H 2026 |
| Security leaders reporting increased executive scrutiny of AI security risks | 78.6% | Salt Security 1H 2026 |
| Production releases delayed due to securing APIs exposed to autonomous systems | 47% | Salt Security 1H 2026 |
| Orgs with formal security policies for agentic AI (500+ employees deploying agents) | 21% (= 100% − 79% lacking) | EMA Agentic AI Governance Study (Dec 2025) |
| Orgs that continuously monitor agent-to-agent (A2A) interactions | 17% | EMA / industry aggregate (Dec 2025) |
| Orgs with a tested AI-specific incident response plan | 20% | EMA / industry aggregate (Dec 2025) |
| Security leaders with high confidence their identity systems handle agent identities | 18% | Strata / industry aggregate (2026) |
| Non-human accounts created directly inside applications, unseen by IAM | 67% | Orchid Security Identity Gap Snapshot (May 19, 2026) |
Maturity distribution (CyberSecFeed 5-level model): Level 0 (Unaware) 34%, Level 1 (Initial) 28%, Level 2 (Developing) 23%, Level 3 (Managed) 12%, Level 4 (Optimized) 3%.
The velocity paradox: EY describes the structural mismatch where 73% of orgs deploy AI tools while only 7% govern them in real time. Gartner forecasts 40% of enterprise applications will feature task-specific AI agents by 2026, but only 6% of organizations have an advanced AI security strategy. Organizations with formal GenAI governance policies reduce data leakage incidents by up to 46% compared to those without controls, suggesting the gap is both measurable and remediable. A CSA/Google Cloud study (December 2025) found governance maturity is the strongest predictor of AI readiness — organizations with comprehensive policies are nearly twice as likely to report early agentic AI adoption (46%) compared to those with partial guidelines (25%).
The authenticated-rogue-agent problem: Salt Security's 1H 2026 State of AI and API Security report (327 security professionals, April 8, 2026) reframes the runtime gap in identity terms. 92% of organizations still lack the advanced security maturity needed to defend agentic environments; 48.9% are effectively blind to non-human traffic and 48.3% cannot reliably tell legitimate AI agents apart from malicious bots, yet 99% of attack attempts Salt Labs observed in this period originated from authenticated sources — which now increasingly means rogue agents operating with valid credentials, no rate limiting, and no behavioral guardrails. 78.6% of security leaders report increased executive scrutiny of AI security risks, only 23.5% find their legacy security tools effective against agent-driven threats, and 47% of organizations have already delayed a production release over agent-exposed API security. Combined with the EMA December 2025 finding that 79% of organizations with 500+ employees deploying agentic AI lack formal security policies, only 17% continuously monitor agent-to-agent (A2A) interactions, and only 20% have a tested AI incident-response plan, the operational picture is consistent: agent identity, agent-to-agent traffic, and agent-driven API surface are the under-instrumented frontier for AD.1, AD.2, AD.9, AD.17, AD.18, and AD.19.
Community Notes
Discussion about control inventory completeness and organization.
Related Pages
- C10-02 Authentication & Authorization — digs into the MCP authentication and authorization controls that anchor AD.1 and AD.2.
- Appendix A: Glossary — keeps terminology for ATLAS, MCP, control overlays, and agentic security patterns consistent across the wiki.
- C02-01 Prompt Injection Defense — provides the detailed prompt and tool-injection background behind AD.6 and AD.10.
- C03-02 Model Validation & Testing — connects the inventory to validation gates for model, agent, MCP, and release workflows behind AD.13.
References
- Gambit Security: A Single Operator, Two AI Platforms, Nine Government Agencies — Full Technical Report (April 2026)
- NIST AI Risk Management Framework 1.0
- NIST IR 8596: Cybersecurity Framework Profile for AI (Draft, December 2025)
- NIST SP 800-53 Control Overlays for Securing AI Systems (COSAiS)
- NIST COSAiS Use Cases: Single-Agent, Multi-Agent, and AI Developer Overlays
- ISO/IEC 42001:2023: AI Management Systems Requirements
- MITRE ATLAS — Adversarial Threat Landscape for AI Systems
- MITRE ATLAS Grows through Collaboration with CTID and Industry (May 2026)
- MITRE SAFE-AI Framework (Full Report)
- CSA AI Controls Matrix (AICM)
- CSA State of AI Security and Governance (December 2025)
- OWASP Top 10 for Large Language Model Applications (2025)
- OWASP LLM08:2025 — Vector and Embedding Weaknesses
- OWASP LLM04:2025 — Data and Model Poisoning
- OWASP AI Maturity Assessment (AIMA, v1.0 August 2025)
- OWASP Application Security Verification Standard (ASVS)
- NIST SP 800-218A: Secure Software Development Practices for Generative AI
- EU AI Act — Article 10 (Data and Data Governance)
- EU AI Act — Article 15 (Robustness & Cybersecurity)
- EU AI Act — Annex IV (Technical Documentation)
- EU General-Purpose AI Code of Practice — Safety and Security Chapter
- OpenSSF Model Signing (OMS) Specification (June 2025)
- Gravitee State of AI Agent Security 2026 Report
- Microsoft Cyber Pulse: AI Security Report
- Lakera GenAI Security Readiness Report 2025
- OWASP Top 10 for Agentic Applications (2026)
- OWASP AI Exchange
- Microsoft Zero Trust for AI (March 2026)
- EY Survey: Autonomous AI Adoption Surges as Oversight Falls Behind (February 2026)
- Qualys TotalAI: MCP Servers as Shadow IT (March 2026)
- Straiker: Agentic AI Security Platform
- MITRE ATLAS OpenClaw Investigation (February 2026)
- MITRE ATLAS OpenClaw Investigation Report (PDF)
- Zenity Labs: Contributions to MITRE ATLAS First 2026 Release
- F5 AI Guardrails and AI Red Team (January 2026)
- Varonis Atlas: AI Security Platform (March 2026)
- Cybersecurity Insiders: AI Risk and Readiness Report 2026
- Capsule Security Launches with $7M to Secure AI Agents at Runtime (SiliconANGLE, April 15, 2026)
- CrowdStrike Establishes the Endpoint as the Epicenter for AI Security (March 2026)
- Kong AI Gateway 3.14: Agent-to-Agent Traffic and Kong Agent Gateway (April 14, 2026)
- Kong Agent Gateway: Complete AI Gateway for Agent-to-Agent Communication (April 2026)
- Citrix NetScaler MCP Gateway Capabilities (July 9, 2026)
- Operant Endpoint Protector for Shadow AI, Coding Agents, and MCP (May 2026)
- Salt Agentic Security Platform for LLMs, MCP Servers, and APIs (March 2026)
- Kong MCP Gateway Overview
- LiteLLM Security Update: Suspected Supply Chain Incident (March 24, 2026)
- OX Security MCP Supply Chain Advisory: RCE Vulnerabilities Across the AI Ecosystem (April 2026)
- MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers (AAAI 2026)
- PoisonedRAG: Knowledge Corruption Attacks against RAG (USENIX Security 2025)
- ALGEN: Few-Shot Embedding Inversion via Alignment and Generation (arXiv 2502.11308)
- Stanford Audit: Auditing Prompt Caching in Language Model APIs (arXiv 2502.07776)
- KV-Cache Timing Side Channels in Multi-Tenant LLM Serving (arXiv 2508.08438)
- Anthropic: A Small Number of Samples Can Poison LLMs of Any Size (October 2025)
- Alan Turing Institute: LLMs May Be More Vulnerable to Data Poisoning Than We Thought
- Carlini et al.: Poisoning Web-Scale Training Datasets Is Practical (arXiv 2302.10149)
- Data Provenance Initiative: A Large-Scale Audit of Dataset Licensing and Attribution (arXiv 2310.16787)
- lakeFS: Data Version Control with DVC
- Provable Watermarking for Data Poisoning Attacks (arXiv 2510.09210)
- OpenAI: Upgrading the Moderation API with a New Multimodal Moderation Model
- Meta Llama Guard 4 (12B Multimodal Safeguard Model)
- Amazon Bedrock Guardrails: Image Content Filters Now Generally Available (March 2025)
- Azure AI Content Safety
- The State of Multilingual LLM Safety Research / PolyGuard (arXiv 2505.24119)
- Zscaler AI Guardrails and NeMo Guardrails Integration
- Zscaler 2026 AI Security Report
- sigstore/model-transparency — Supply chain security for ML
- OpenSSF Model Signing Specification (Repo)
- NVIDIA: Confidential Computing on H100 GPUs for Secure and Trustworthy AI
- Noma Security: Runtime Guardrails for Microsoft Copilot Studio
- Microsoft Agent 365 Now Generally Available (May 1, 2026)
- Microsoft Entra Agent ID — Identity for AI Agents
- When Prompts Become Shells: RCE Vulnerabilities in AI Agent Frameworks (Microsoft, May 7, 2026)
- AutoJack: How a Single Page Can RCE the Host Running an AI Agent (Microsoft, June 18, 2026)
- CVE-2026-25592 — Microsoft Semantic Kernel .NET SDK Sandbox Escape
- Anthropic: Detecting and Preventing Distillation Attacks (February 23, 2026)
- Anthropic: Donating MCP to the Agentic AI Foundation
- Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF)
- CSA Catastrophic Risk Annex: Next-Gen AI Security Controls (April 29, 2026)
- CSAI Foundation: Securing the Agentic Control Plane (April 29, 2026)
- Cisco Announces Intent to Acquire Astrix Security (May 4, 2026)
- Astrix Security: Four-Method AI Agent Discovery at RSAC 2026
- 1Password Launches Unified Access for AI Agent Security (March 2026)
- 1Password Extends OpenAI Collaboration with Codex MCP Server (May 20, 2026)
- Check Point Integrates AI Defense Plane with Google Cloud (Late June 2026)
- SandboxAQ Adds Runtime Guardrails and MCP Risk Analysis to AQtive Guard (March 23, 2026)
- Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems (February 2026)
- Microsoft Defense at AI Speed: Multi-Model Agentic Security System (May 12, 2026)
- Shadow AI Risks: 31% of Users Get No Employer Training (Help Net Security, May 1, 2026)
- EU AI Act Article 55 — Obligations for GPAI Providers with Systemic Risk
- ISO/IEC 27090 — Cybersecurity Guidance for AI Systems (FDIS)
- OX Security: The Mother of All AI Supply Chains — Systemic MCP Vulnerability (April 15, 2026)
- PointGuard AI: Microsoft MCP Server CVE-2026-26118 — AI Tool Hijacking (March 10, 2026)
- Comment and Control: Prompt Injection to Credential Theft in Claude Code, Gemini CLI, and GitHub Copilot Agent (Aonan Guan)
- VentureBeat: Three AI coding agents leaked secrets through a single prompt injection (April 2026)
- Permiso Security Brings Identity Runtime Attribution to AI Agents (May 14, 2026)
- Akeyless Launches Runtime Authority for AI Agents — Intent-Aware Security
- Microsoft Open Source: Introducing the Agent Governance Toolkit (April 2, 2026)
- Google Cloud: Introducing Gemini Enterprise Agent Platform (April 22, 2026)
- Google Cloud: Agent Runtime Documentation (Gemini Enterprise Agent Platform)
- Backslash Security: Anthropic's Shared Responsibility Security Model for AI Agents (April 2026)
- The Hacker News: OpenAI Launches Daybreak for AI-Powered Vulnerability Detection and Patch Validation (May 2026)
- MCP Security 2026: 30 CVEs in 60 Days — What Went Wrong (March 2026 retrospective)
- DoControl: 2026 Non-Human Identities (NHI) Report
- The Hacker News: 2026 — The Year of AI-Assisted Attacks
- Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain (April 2026)
- Infosecurity Magazine: Systemic Flaw in MCP Protocol Could Expose 150 Million Downloads
- Rapid7: CVE-2026-33032 — Nginx UI Missing MCP Authentication
- The Hacker News: Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
- Picus Security: CVE-2026-33032 (MCPwn) — How a Missing Middleware Call in nginx-ui Hands Attackers Full Web Server Takeover
- CIS Controls v8.1 Model Context Protocol Companion Guide
- CIS, Astrix, and Cequence Release New AI Security Companion Guides (April 20, 2026)
- ServiceNow Moves to Govern Every AI Agent in the Enterprise (Knowledge 2026)
- Salt Security: The Era of Agentic Security Is Here — Key Findings from the 1H 2026 State of AI and API Security Report
- Salt Security 1H 2026 Press Release: As AI Agents Outpace Security, Most Organizations Face an Unsecured API Surge
- Sweet Security Launches Sweet Attack — Agentic AI Red Teaming for Live Production Environments (May 13, 2026)
- SecurityWeek: Sweet Security Launches Agentic AI Red Teaming to Counter the 'Mythos Moment'
- SentinelOne Unveils New AI Security Offerings at RSAC 2026 — Prompt AI Agent Security, Prompt AI Red Teaming, Agentic Auto Investigation
- Databricks Announces Lakewatch — New, Open, Agentic SIEM (RSAC 2026)
- Databricks Lakewatch Press Release — Open, Agentic SIEM with Adobe and Dropbox as Launch Customers
- Orchid Security: Identity Gap Snapshot 2026 — Two-Thirds of Nonhuman Accounts Are Unseen and Unmanaged (May 19, 2026)
- Strata: The AI Agent Identity Crisis — A 2026 Guide
- NSA: Security Design Considerations for AI-Driven Automation Leveraging MCP (May 20, 2026)
- NSA CSI: Model Context Protocol Security (PDF)
- Sysdig: CVE-2026-44338 — PraisonAI Authentication Bypass Exploited in Under 4 Hours
- Akamai: One Is a Fluke, 3 Is a Pattern — MCP Back-End Vulnerabilities (May 13, 2026)
- VIPER-MCP: Automated Discovery of Taint-Style Vulnerabilities in Real-World MCP Servers (arXiv, May 20, 2026)
- Adversa AI: Top MCP Security Resources — June 2026 Roundup
- Adversa AI: Top Agentic AI Security Resources — June 2026 (SymJack, TrustFall)
- Tenet Security: Agentjacking — One Fake Bug Report Hijacked a $250B Company's AI Agent (June 2026)
- The Hacker News: Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code (June 12, 2026)
- CSA Research Note: Agentjacking — MCP / Sentry Injection (June 12, 2026)
- Qualys: Microsoft and Adobe Patch Tuesday June 2026 Security Update Review
- Microsoft Build 2026: Securing Code, Agents, and Models Across the Development Lifecycle (June 2, 2026)
- Windows Platform Security for AI Agents — Microsoft Execution Containers SDK (June 2, 2026)
- OpenAI: Introducing Lockdown Mode and Elevated Risk Labels in ChatGPT (June 2026)
- NVIDIA NeMo Guardrails v0.22.0 Release Notes (May 22, 2026)
- NVIDIA garak v0.15.1 Release Notes (June 5, 2026)
- OWASP GenAI: AI Security Solutions Landscape for Agentic AI (Q2 2026)
- OWASP GenAI: AI Security Solutions Landscape for AI and Agentic Red Teaming (Q2 2026)
- OWASP GenAI: State of Agentic AI Security and Governance (v2.01, June 2026)
- Help Net Security: Prompt Injection Still Drives Most Agentic AI Security Failures in Production (June 11, 2026)
- European Commission: AI Act Enforcement Gets Independent Expert Support (June 1, 2026)
- Global Policy Watch: EU AI Act Update — Timeline Relief, Targeted Simplification, and New Prohibitions (June 2026)
- European Parliament Legislative Train: Digital Omnibus on AI (Plenary Adoption, June 16, 2026)
- Cisco Unveils Agentic Platform for Operating and Defending Critical IT Infrastructure (Cisco Live US, June 2, 2026)
- MITRE ATLAS Data Releases (v2026.05, ATLAS Data v6.0.0)
- MCP Specification 2026-07-28 Release Candidate