AI Sec Watch

NewCore, an Israeli cybersecurity startup, has emerged from stealth mode with $66 million in funding to build an identity platform designed for the era of agentic AI (AI systems that can take autonomous actions). The platform uses Secure Split Key (SSK), a technique that prevents a specific class of attacks on SAML (Security Assertion Markup Language, a system for managing authentication) infrastructure, and includes features like hardware-bound credentials and continuous identity discovery to protect human, machine, and AI agent identities.

NewCore, a new cybersecurity startup, has raised $66 million to help companies manage AI agents as workplace participants by giving them digital identities with proper authentication and access controls. As companies increasingly deploy AI agents alongside human employees, NewCore argues that traditional identity platforms (systems that verify who users are and what they can access) are outdated and designed only for humans, not software workers. NewCore's platform treats AI agents as first-class identities with their own permissions and access controls, using a 'split-key' architecture (dividing credentials between the customer and the platform to prevent a single point of failure) to secure them.

SearchLeak is a critical vulnerability in Microsoft 365 Copilot Enterprise that allowed attackers to steal sensitive data like emails, passwords, and documents through a single malicious link. The attack worked by chaining three separate flaws together: parameter-to-prompt injection (tricking the AI by hiding instructions in a URL parameter), an HTML rendering race condition (exploiting a moment when HTML isn't yet protected), and a server-side request forgery in Bing (making Bing unknowingly help retrieve stolen data). Microsoft fixed this vulnerability and assigned it CVE-2026-42824 with a critical severity rating.

Langflow, an open-source platform for building AI applications, has a path traversal vulnerability (CVE-2026-5027, rated 8.8 CVSS, a measure of how severe a vulnerability is) that allows attackers to write files to any location on a system and potentially execute remote code. The flaw is particularly dangerous because Langflow has login disabled by default, letting unauthenticated users exploit it with a single request, and attackers are actively using public exploit code to attack the approximately 7,000 internet-exposed instances.

Anthropic stopped all access to its Fable 5 and Mythos 5 AI models after receiving an export control directive (a government order restricting who can use certain technology) that prevents foreign nationals from using these systems. The shutdown was triggered by US regulations that treat advanced AI as technology that needs restricted access.

Researchers discovered that attackers can exploit AI agent guardrails (safety systems that check AI behavior) by inserting malicious content into documents, causing the security mechanisms to enter extended thinking loops that dramatically slow down or crash shared AI systems. This reasoning-extension DoS (denial-of-service, a type of attack that makes systems unavailable) attack targets the safety layer itself rather than trying to jailbreak the AI model, and it works across multiple AI frameworks and different LLM families. Unlike traditional attacks that try to produce unsafe outputs, this technique compromises availability by exhausting computational resources, with some systems experiencing slowdowns of up to 148 times normal speed.

Sovereign cloud (cloud infrastructure located in a specific country or region to comply with data residency laws) alone does not guarantee the control that enterprises expect over their AI workloads, despite regulatory pressure in Europe and increasing scrutiny in the US. The real control point lies in identity governance (managing who can access what resources and under what circumstances) and related infrastructure layers like encryption key management, access logging, and workload identity management, not just where data is physically stored.

AI agents (software systems that can read data, process external content, and take actions) now commonly have all three dangerous capabilities together, making them vulnerable to prompt injection (tricky instructions hidden in data that trick the AI into doing harmful things). Security experts like Meta recommend the 'Rule of Two,' which limits agents to only two of these three capabilities per session and requires human approval if all three are needed, but this framework has limitations and doesn't fully solve the problem.

AI agents operate at machine speed across multiple systems, making traditional security models that grant access once at login insufficient for protecting modern infrastructure. CrowdStrike's Continuous Identity approach continuously evaluates identity, device, threat, and business context to grant, adjust, or revoke access in real time, with specific features for AI agents including verification based on SPIFFE standards (an identity framework), removal of standing privileges (permissions that remain active indefinitely), and immediate revocation when risk conditions change.