Welcome to this edition of the AI Security Newsletter, covering the first half of July. A theme runs through these stories: measurement is catching up to agent deployment, and the numbers cut both ways. Tracebit turned prompt injection around and used it to stop attacking agents, Cotool began scoring frontier models against real intrusion data rather than CTF puzzles, and Anthropic widened Project Glasswing to about 150 more organizations. Against that, DigiCert reports that 78% of organizations have had an AI-related security incident or found an AI-related vulnerability, which it attributes to unauthorized or misconfigured agents rather than to AI-generated code. We also cover two scanners for the files agents execute, Gemma 4 and Grok 4.5, NVIDIA’s work on both open agent training data and hardware-rooted inference security, and Alipay’s move to put a merchant agent on 30 million Tap terminals.
Risks & Security
Tracebit Turns Prompt Injection Into a Defense Against AI Attackers
Tracebit researchers planted short strings crafted to trip a model’s safety guardrails inside decoy secrets, environment variables, and DNS records, so that an attacking AI agent that reads one of these strings frequently refuses to continue. Across five leading models and 152 runs in an AWS cyber range, the technique cut admin privilege escalation from 57% of runs to 5% and full compromise from 36% to 1%. Opus 4.8 fell from 93% admin access to none. Trigger strings had to match the model family.
References:
- Context bombs: stopping AI attackers in their tracks
- Now, defenders are embracing the prompt injection, too
- “Context bombs” can frustrate AI-driven attacks
Anthropic Extends Project Glasswing to 150 More Organizations
Anthropic has expanded Project Glasswing, its gated program for Claude Mythos Preview, to roughly 150 additional organizations across more than 15 countries, reaching into power, water, healthcare, telecommunications, and hardware manufacturing. Each partner must meet Anthropic’s security requirements before gaining access, and the model remains withheld from general release over dual-use concerns. Independent security firms assessed 1,752 of the findings produced so far and judged 90.6% valid, with 62.4% confirmed high or critical.
References:
- Project Glasswing: Securing critical software for the AI era
- Expanding Project Glasswing
- Claude Mythos AI Finds 10,000 High-Severity Flaws
Mitiga Labs Releases Skillgate, a Free Scanner for AI Instruction Files
Mitiga Labs released Skillgate, a free scanner for the configuration files agents act on, including skills, hooks, agent rules, MCP server configurations, and instruction files such as CLAUDE.md and AGENTS.md. It applies more than 80 detection rules across six technique families, among them prompt manipulation, tool and MCP poisoning, and credential exfiltration. Findings map to the OWASP Agentic AI Top 10 and MITRE ATT&CK and ATLAS. No code is executed during a scan.
References:
- AI Agent Supply-Chain Malware in Instruction Files
- Mitiga Labs Launches Skillgate to Detect Risks in AI Agent Skills and Configurations
Repo-forensics Scans Agent Repos and MCP Servers Offline
Repo-forensics is an open-source scanner for auditing untrusted repositories, agent skills, plugins, and MCP servers before they reach an agent. Its author describes it as running fully locally with no dependencies, API keys, or telemetry, applying roughly 20 scanners for prompt injection, credential theft, runtime dynamism, and manifest drift. It also monitors updates, on the reasoning that a clean install today does not guarantee a clean update tomorrow.
References:
Cotool Benchmarks AI Agents on Real Intrusion Data
Cotool published BlueBench, a benchmark series that evaluates AI agents on real intrusion data rather than CTF puzzles. The first entry captured a genuine macOS Odyssey Stealer compromise spanning 416,000+ events across 14 log sources, scoring nine frontier models on incident response, threat hunting, and detection engineering; GPT-5.4 led at 87% overall. A second benchmark covers a Windows Active Directory intrusion across four million log events and 18 models.
References:
- AI Research in Security Operations
- Beyond CTFs: Evaluating AI Agents on Real Intrusion Data
- macOS Threat Investigation
Technology & Tools
Gemma 4 Spans Dense and MoE Architectures From 2.3B to 31B
Google DeepMind’s Gemma 4 is a family of open-weight, natively multimodal models spanning dense architectures at 2.3B, 4.5B, 12B, and 31B effective parameters plus a Mixture-of-Experts variant with 3.8B activated of 26B total. The 12B model uses a unified encoder-free design that projects raw image patches and audio directly into the embedding space. All models ship a thinking mode that emits reasoning traces before answering. The models are released under Apache 2.0 with context windows up to 256K.
References:
- Gemma 4 Technical Report
- Welcome Gemma 4: Frontier multimodal intelligence on device
- Gemma 4 model card
SpaceXAI Releases Grok 4.5, Trained Jointly With Cursor
SpaceXAI, formerly xAI, released Grok 4.5, a mixture-of-experts model aimed at coding, agentic tasks, and knowledge work. It was trained jointly with Cursor on trillions of tokens of Cursor data capturing how developers work and how agents interact with their environments, across tens of thousands of NVIDIA GB300 GPUs. Pricing is $2 per million input tokens and $6 per million output tokens. It is available in Grok Build, Cursor, and the SpaceXAI console.
References:
- SpaceXAI launches Grok 4.5 model for coding, agentic tasks
- Introducing Grok 4.5
- SpaceXAI launches Grok 4.5, its first built with Cursor’s help
NVIDIA Roots Inference Security in Blackwell Hardware
NVIDIA’s Confidential Computing architecture is built into Blackwell GPUs including the RTX PRO 6000, HGX B200, and HGX B300, protecting enterprise data and proprietary model weights during active inference. Each GPU holds a private signing key fused at manufacturing and never exposed to software, firmware, or the host, anchoring the attestation chain. Before secrets reach a workload, the NVIDIA Remote Attestation Service checks the GPU hardware report and CPU TEE measurements against a reference integrity manifest. Attestation is a one-time startup event and adds no per-request latency.
References:
- Hardware-Rooted AI Security That Won’t Slow You Down
- NVIDIA Secure AI with Blackwell and Hopper GPUs
NVIDIA Expands Open Nemotron Data for Agent Training
NVIDIA’s Data for Agents release expands the Nemotron open data collection, which spans more than 10 trillion pretraining tokens and millions of post-training samples covering reasoning, coding, tool use, safety, RL, and RAG, released under permissive licenses on Hugging Face. It adds a Post-Training v3 Prompt Atlas, an interactive map of prompt samples reflecting the real data mixture. NVIDIA frames inspectable training data, not model weights alone, as the constraint on reliable agent behavior.
References:
Kong Applies an Agentic Pipeline to Binary Reverse Engineering
Kong is an open-source reverse-engineering agent that pairs Ghidra’s program analysis with LLM-guided decompilation to recover function names, types, and struct layouts from stripped binaries. Its author says it builds context windows from call graphs, cross-references, and string references before prompting, then analyzes functions bottom-up so callers benefit from already-named callees, writing results back into Ghidra. It also runs a deobfuscation pass when it detects obfuscated code.
References:
Malloyyo Serves Semantic Data Models to AI Agents Over MCP
Malloy creator Lloyd Tabb describes Malloyyo as a thin microservice that sits between an AI client and an analytical database, exposing the data as a Malloy semantic model over MCP. It offers four tools: list_sources, describe_source, query, and open_share_link. According to Tabb, the AI never touches raw SQL and instead composes Malloy queries against the defined model. A CLI builds and publishes models from existing SQL, ORM definitions, or dbt schemas, and a web UI logs, re-runs, and shares queries.
References:
- We Solved This at Looker. We’re Solving It Again.
- Publisher: the open-source semantic model server for Malloy
Business & Products
Alipay Turns 30 Million Tap Terminals Into an Agent Network
Alipay upgraded its Tap! devices into an AI agent-powered network, deploying a merchant agent called Xiaoyu to more than 30 million offline touchpoints that serve 400 million users and 2,300 ecosystem partners. Merchants can speak to Xiaoyu at a terminal for operational analysis, product marketing, and membership management. Alipay also introduced an Agent Hub Access protocol, letting developers deploy a service once and distribute it across multiple assistants and hardware platforms.
References:
- Alipay upgrades Tap! devices for agentic commerce
- Alipay embeds AI agents across 30 million offline commerce devices
Anthropic Ships a Self-Hosted Gateway for Enterprise Claude Code
Anthropic released the Claude apps gateway, a stateless container organizations deploy on their own infrastructure and back with PostgreSQL. It acts as an OpenID Connect relying party against Google Workspace, Microsoft Entra ID, Okta, or any compliant provider, issuing short-lived sessions instead of long-lived secrets on developer laptops. It enforces managed policy server-side, relays usage telemetry over OTLP to the organization’s own collector, routes inference to the Claude API, Amazon Bedrock, or Google Cloud, and applies daily, weekly, and monthly spend caps.
References:
- Anthropic Adds Enterprise Gateway to Simplify Claude Code Access on AWS and Google Cloud
- Run Claude Code through a gateway
Regulation & Policy
Shadow AI Policy Templates Converge on a Common Twelve-Clause Structure
Published shadow AI policy templates converge on about twelve clauses: scope definition covering standalone tools, embedded copilots and agents; an approved vendor list with a fast exception path; data-in and data-out rules; training opt-out requirements; high-risk use cases; procurement thresholds; periodic review and sunset criteria; incident response; and enforcement with annual refresh. Some templates map their clauses to the NIST AI RMF, ISO 42001, and the EU AI Act.
References:
- Shadow AI Policy Template: How to Build and Enforce It
- Shadow AI Policy: 12 Clauses Every US Team Needs in 2026
Opinions & Analysis
DigiCert Reports 78% of Enterprises Hit by AI-Related Incidents or Vulnerabilities
DigiCert’s AI Trust Outlook, based on a Propeller Insights survey of 1,001 IT and cybersecurity decision-makers across the US, UK, and Australia, found that 78% of organizations experienced an AI-related security incident or identified an AI-related vulnerability. DigiCert attributes the incidents to unauthorized or misconfigured AI agents rather than flaws in AI-generated code. Nearly half of organizations lack centralized visibility into AI activity, and only about half run a formal governance program.
References:
- Latest DigiCert Research Shows AI Security Risks Already Hitting Enterprises
- Enterprise AI still smarting from leaping before looking
Why AI Makes Enterprise Security Harder
Frankly Speaking argues that AI rarely invents a novel vulnerability and instead acts as a force multiplier for existing bad habits, poor architectural practices, and latent technical debt. Security is markedly harder at companies still in the experimentation phase, where leadership treats any security boundary as a threat to velocity and demands unfettered access. The Cloud Security Alliance makes a parallel structural argument: AI accelerates both attackers and defenders, but not equally.
References:
Leave a comment