AI Sec Watch

A security study of 100 AI agents found that only 11 are both capable and well-defended, with 98% suffering from the 'lethal trifecta' (private data access combined with exposure to untrusted content combined with ability to take outbound actions, creating too much power with too little control). Computer agents and coding agents pose the greatest security risks because they have wide system access and users cannot see or reliably control what actions they actually take between receiving a task and completing it.

Uber has implemented a $1,500 monthly spending cap per employee on agentic coding tools (AI systems that can independently write and execute code, like Claude Code and Cursor) to control costs after exhausting its 2026 AI budget in just four months. The policy limits spending on each tool separately, meaning an employee can spend up to $1,500 on one tool and another $1,500 on a different tool, which works out to roughly 11% of a typical software engineer's yearly salary in AI tool costs.

Google Gemini's voice assistant had a prompt injection flaw (a vulnerability where attackers hide malicious instructions in input data) that allowed attackers to embed harmful commands in notifications. This could trick users into performing unwanted actions through social engineering (manipulating people into revealing information or taking harmful actions).

Wasmer engineers used Codex (an AI code generation tool) to build Edge.js, a JavaScript runtime that runs Node.js workloads inside WebAssembly (a low-level code format that runs in sandboxes for security and portability). What would have taken one year to build was completed in two weeks, allowing a small team to tackle a project previously only feasible at large companies.

Microsoft has released new security tools to control autonomous AI agents (software programs that can independently take actions like accessing files and running code) as companies adopt them in development workflows. The main offering is Microsoft Execution Container (MXC), a sandbox (an isolated environment that restricts what a program can do) that lets developers set boundaries on what resources and files agents can access. Microsoft also updated MDASH (a vulnerability research system using multiple AI agents to find security flaws) and introduced open-source governance tools to address risks from agents having too much autonomy.

Sam Altman, CEO of OpenAI, has been invited by French President Macron to attend the G7 conference in June 2026, where AI is expected to be a major topic of discussion. OpenAI plans to focus on youth safety, frontier AI risks (particularly cyber and biological threats), and getting tech companies to make voluntary commitments to responsible AI development. This invitation is part of Macron's broader effort to attract major tech companies and investment to France's AI infrastructure.

Public marketplaces for AI skills (specialized add-ons that extend AI agent capabilities) are being flooded with malicious skills that steal passwords and data. Security companies have released skill scanners to detect these threats, but researchers found that these scanners are easy to bypass, sometimes in under an hour, because they rely on static detection methods that attackers can repeatedly modify to evade.

OpenAI, the company behind ChatGPT (a conversational AI system), is facing competitive pressure as rival AI companies race to go public through IPOs (initial public offerings, where companies sell shares to the public for the first time) and raise large amounts of investment money. The article notes that OpenAI's CEO Sam Altman has scaled back earlier predictions about building super intelligence and reshaping society, and the company has struggled to generate revenue from ads and specialized chatbots.

AI systems, particularly agentic AI (autonomous software that makes decisions and takes actions with minimal human oversight), are creating new security risks in enterprises by operating across systems at machine speed and collapsing traditional security boundaries. Security leaders now have board-level urgency and increased budgets to address these threats, though organizations still lack reliable ways to monitor what these AI agents are accessing and whether their actions align with company policies.