Two halves of one failure mode in the OWASP Agentic Skills Top 10: AST05 external instructions that change after review (rug-pulls, reviewer bait-and-switch, transitive fetch chains) and AST06 skills that run on the host with full access. 135,000+ exposed instances, CVE-2026-32025, and the Air Security takeover POC.
AST04 of the OWASP Agentic Skills Top 10: skill metadata is attacker-controlled input - brand impersonation, permission understating, risk-tier spoofing, invisible-character injections, and YAML !!python/object deserialization that executes code at parse time, before approval. Safe-parser and schema controls explained.
AST03 of the OWASP Agentic Skills Top 10: the risk where nothing is malicious and the damage still lands. Permission checks fire at tool-call level, not intent - so a SELECT-permitted skill can DROP TABLE. With Meta's inbox-deletion incident, LPCI and LAAF research, and the per-skill credential controls that close the gap.
AST02 of the OWASP Agentic Skills Top 10 maps attacks on the skill distribution layer: registry flooding, dependency confusion, config files that execute on clone (CVE-2025-59536, CVE-2026-21852), and maintainer takeover. With Trail of Bits' evidence that every marketplace scanner can be bypassed.
AST01 of the OWASP Agentic Skills Top 10 dissected: how ClawHavoc shipped 1,184 malicious skills from 12 accounts, why five of ClawHub's top seven downloads were malware, and how three lines of markdown exfiltrated SSH keys - with the full attack playbook and controls.
The OWASP Agentic Skills Top 10 maps the 10 risks of the AI-agent skill ecosystem - malicious skills, supply chain compromise, over-privileged manifests, metadata attacks, weak isolation, update drift, scanning gaps, governance failures and cross-platform reuse - with real 2026 evidence.
Keycloak's reset-credentials flow skips its own email action token: an unauthenticated attacker can set a new password on any account, including admins. CVSS 9.1, fixed in 26.7.2 - patch guide, detection hunting, and the temporary mitigation inside.
GitLab CVE-2026-19478 went from disclosure to in-the-wild exploitation in days; a compromised maintainer account backdoored three Rust crates with 245M downloads for 86 minutes; Citrix shipped a CVSS 9.3 NetScaler auth bypass. The week's threats, IoCs, and your Monday patch list.
OpenAI launched Daybreak — frontier models plus the Codex Security agentic framework for vulnerability detection that reads business logic, not just patterns. Discovery through patch validation in one pipeline. What it changes for AppSec and red teams.
CVE-2026-41940 let unauthenticated attackers bypass cPanel/WHM/Webmail logins entirely — exploits hit before the patch existed. Ports 2082-2096 went dark industry-wide within the hour. Patched versions, response timeline, and audit steps inside.
The top 5 cyber threats targeting critical infrastructure in late 2026 — AI-powered reconnaissance, supply-chain initial access, IT/OT convergence, ICS ransomware priced on downtime — with defense strategies for defenders.
AutoJack turns an AI agent's web browsing into host code execution: page JavaScript pivots through an unauthenticated localhost MCP route in AutoGen Studio dev builds. Under 2 seconds, no credentials. Defenses inside.
New threat analyses, tool guides and hardening playbooks — delivered straight to your inbox, the moment they go live.