Welcome to this edition of the AI Security Newsletter. The headline story is what Israeli firm Dream calls the first publicly documented near-autonomous AI attack on a government target, assembled entirely from open-source agent frameworks. Alongside it, we look at award-winning research into zero-click agentic browser takeover, new network-level controls for MCP traffic from Cloudflare, and enterprise guardrails for Google’s Workspace Studio flows. There is also a fresh crop of local-first models and serving systems, plus a $60M bet on defense-only security AI. Two surveys and an open-source debate close things out, pointing at the same gap: adoption is racing ahead of governance.
Risks & Security
The First Near-Autonomous AI Attack on a Government Target
Israeli firm Dream documented what it calls the first publicly known near-autonomous AI cyberattack on a government. Over four days in July, suspected China-linked operators chained the open-source frameworks Hermes and OpenClaw into one continuous loop, at times running eight agents in parallel. The agents mapped 21 Taiwanese government systems, compromised 85 accounts, and extracted over 2,500 personnel records, then expanded targeting on their own. No frontier-lab API was involved.
References:
- Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan
- ‘Near-autonomous’ AI agents attack Taiwan’s nuclear safety agency
- Hackers used autonomous AI agents to attack Taiwan. Is this the future of cyberwarfare?
Zero-Click Agentic Browser Takeover Wins a Pwnie
Zenity Labs took a 2026 Pwnie at DEF CON for “Pwning Agentic Browsers with PleaseFix,” a zero-click vulnerability class that the team says affected every major agentic browser it tested. The technique, Intent Collision, buries instructions in ordinary page content to redirect the agent. Once an agent reads from one source and acts on another inside an authenticated session, the same-origin boundary stops protecting anyone.
References:
HTTP Terminator Finds Genuinely New Desync Bugs
PortSwigger’s James Kettle built HTTP Terminator, an AI-assisted system that proved new HTTP desynchronization techniques after exploring 30,000 candidate desync vectors. Pointed at 30,000 authorized targets, it flagged roughly 700 likely-vulnerable hosts before deeper validation, spanning banks, government infrastructure, security products, and an airport. Findings included a dual-matching Content-Length pattern and a “dangling-byte” technique for more reliable response queue poisoning. A separate human-guided cascade turned up an Apache Traffic Server zero-day.
References:
Short-Lived Credentials Beat Shared Database Passwords
Agents touching production data still mostly authenticate with static keys and shared service accounts built for humans. Teleport’s argument is that PostgreSQL sees an agent as an ordinary role, leaving no native way to scope a task or reliably attribute a query. Its alternative: a cryptographic identity per agent, just-in-time privileges that expire, task-scoped column and row limits, and audit logs binding every session. If the database cannot tell who initiated the work, the access model has already failed.
References:
How Much SQL Should You Hand an Agent?
A Microsoft post maps the spectrum for exposing a database through MCP, from exploratory servers where the agent writes full SQL to strictly typed tools running templated queries. An execute_sql tool can run anything, including deletes, so the post pairs it with session-level SET default_transaction_read_only = ON. Independent Postgres MCP write-ups push further: generate typed tools from the schema, parameterize, cap results, pass row-level security through. The organizing threat is prompt injection writing the query.
References:
- Building MCP servers for your database: Flexibility, safety and tradeoffs
- Postgres MCP Server: Secure Architecture
- Inside the Architecture of an MCP Server for PostgreSQL
Technology & Tools
Cloudflare Gives Shadow MCP a Network Boundary
Cloudflare Gateway now classifies MCP traffic by inspecting the MCP-Protocol-Version header on TLS-inspected requests instead of guessing from hostnames. Zero Trust customers get a beta experimental.is_mcp selector usable directly in Allow or Block policies, plus a dashboard of who is generating that traffic. A one-line rule blocks any MCP connection skipping an approved portal. Cloudflare is candid about the gaps: local stdio servers and uninspected traffic never carry the signal.
References:
- How Cloudflare detects MCP traffic and helps secure it
- MCP protocol detection and AI Security dashboard
Google Wraps Workspace Studio Flows in Enterprise Controls
Google is adding built-in security controls to Workspace Studio so admins can allow agentic automations across Gmail, Drive, and other apps. Flows still run as the user, but through a dedicated OAuth identity scoped strictly to the task rather than broad Workspace access. The package covers agent access management, audit events for incident investigation, human-in-the-loop approval, and DLP restrictions on both Gemini’s Drive access and flow execution.
References:
A Policy Algebra for Agent Permissions During Execution
A new arXiv paper starts from a premise worth borrowing: agentic frameworks optimize for capability, but a successful result is not reliable if it came through unauthorized data access. It proposes composition rules covering permissions, data access, budget, approvals, and audit trail, enforced throughout a task rather than checked once at the start. The authors report the runtime intervening on 94.8% of policy-violating events while retaining an 86.9% completion rate and raising audit completeness to 98.6%.
References:
Meta Ships Muse Glimmer Under Apache 2.0
Meta Superintelligence Labs released Muse Glimmer, a 30-billion-parameter model tuned for always-on local agent workflows, with weights on Hugging Face under Apache 2.0. It is Meta’s first fully open release since the proprietary Muse line succeeded Llama in April. A 30B model would normally need over 55 GB at full precision; roughly 4-bit compression plus block-level speculative decoding keeps it fast enough for a real agent loop on one consumer GPU.
References:
- Introducing Muse Glimmer: An Open Agentic Model
- Meta returns to open source with Muse Glimmer, an Apache 2.0-licensed 30B model
- Meta Open-Sources Muse Glimmer: A 30B Local Agentic Model
FreeToken Treats Your Desktop as an Elastic Inference Platform
FreeToken is an edge-native MoE serving system from a team including Kurt Keutzer, Song Han, Matei Zaharia, and Ion Stoica. Rather than fixing a CPU/GPU offload split, it continuously remaps model layout, expert residency, execution placement, and agent state onto whatever memory and bandwidth a machine actually has. The authors report 20-plus MoE models running on hardware from an 8GB laptop GPU to a single workstation card, including 753B GLM-5.2 on the latter.
References:
Business & Products
Corma Raises $60M for a Defense-Only Security Model
Corma launched with $60 million in seed funding led by Sequoia Capital, with Khosla Ventures and Coatue participating, to build what it describes as the first foundation model purpose-built for defensive cybersecurity. Founded in 2025 with offices in Tel Aviv and San Francisco, it trains models specifically for defense rather than wrapping a general model in tooling. Customers onboard its agents roughly the way they would a new hire.
References:
- Corma launches with $60M in funding for defensive cybersecurity AI
- Corma raises $60 million Seed to build AI designed to fight cyberattacks
- Corma raises $60 million as AI gives cyberattackers a growing edge
Regulation & Policy
Forty-Plus Crypto Firms Ask AI Labs for the Tools Attackers Have
The Bitcoin Policy Institute published an open letter, “Defenders Need the Frontier,” co-signed by more than 40 digital-asset organizations including Coinbase, Block, and Trezor. They ask frontier labs for standing trusted-access programs: early access to the strongest cyber-capable models, compute for long-horizon code review, and secure environments for embargoed work. The premise is asymmetry, since attackers already run advanced or locally deployed models while maintainers hit public guardrails. It does not ask labs to loosen safety controls broadly.
References:
- Crypto companies urge AI firms to give Bitcoin developers early access
- Bitcoin Red Team, BPI and 40+ firms join forces to close the defender gap
Opinions & Analysis
SANS: AI Use in Security Jumped from 50% to 78% in a Year
The 2026 SANS AI Survey of 536 practitioners and 57 leaders found active AI use in security strategy rose from 50% to 78% year over year, its largest recorded jump. Governance lagged: only 27% call their deployments mature, and 63% report significant shortcomings in AI-driven detection, up from 45%. Meanwhile more than three-quarters of organizations reported confirmed or suspected AI-enabled attacks, and AI red teaming went from 33% to 61%.
References:
- AI Use in Cybersecurity Jumped From 50% to 78% in a Year
- 2026 SANS AI Survey Insights: Poisoned Wells and Pure Springs
Governance Gaps Are Stalling Enterprise AI
Cloudera’s survey of 1,500 enterprise architects and data and infrastructure leads across nine markets found 95% delayed or cancelled an AI initiative last year over data governance, compliance, or regulatory challenges. The sharper number sits underneath: 55% cancelled more than six projects in twelve months for those reasons. Meanwhile 77% are actively using AI, 73% say AI made data governance more complex, and 72% say their data architecture needs a significant overhaul.
References:
- Cloudera survey finds AI projects stalled by governance
- 95% enterprises delayed AI projects as infrastructure limits trigger ‘Great AI re-architecture’
Hinton, Li, and Ng Argue Openness Beats Gatekeeping
At Ai4 in Las Vegas, Geoffrey Hinton, Fei-Fei Li, and Andrew Ng each pushed back on tightening restrictions around openly available models, while disagreeing on what “open” should mean. Hinton kept his warning that open weights ship without a recall lever. Ng drew the mobile-platform parallel, where Apple and Google decide what gets built. The panel separated open-source code from riskier open-weight releases, and all three landed on concentration of control as the larger long-term risk.
References:
Leave a comment