Welcome to this edition of the AI Security Newsletter. A theme runs through almost everything this week: the agent harness is now the security boundary. Researchers used one to break four SAML implementations and to run a bug bounty report end to end, OWASP published a Top 10 for the skills those agents load, and MCP’s new roadmap and auth guidance grapple with what happens when agents move from a local subprocess to a multi-tenant cloud. On the other side, ThreatDown showed that one of the criminal AI market’s most popular tools is mostly a rented frontier model with the guardrails torn off, while Microsoft proposed making that removal worthless rather than impossible. We close with Stripe’s multibillion-dollar bet on agent telemetry and a sharp argument about who national AI cyber policy is actually protecting.
Risks & Security
Criminal AI Storefront ‘Kriminal’ Runs on Rented Frontier Models
ThreatDown research published August 19 found that Kriminal, one of the criminal AI market’s most popular tools, owns almost nothing it sells. It markets itself as answering anything with no filters and no guardrails, offering social engineering, offensive security, OSINT, and crypto tracing — while running on jailbroken access to legitimate frontier models including Grok. Access starts at $12.99 a month. It isn’t hidden on the dark web; Google indexes it.
References:
- How Grok unknowingly powers cybercrime — ThreatDown
- Criminal AI tool Kriminal is mostly just Grok with a jailbreak — SiliconANGLE
- Uncensored AI Service Tied to Grok — SecureWorld
OWASP Publishes the Agentic Skills Top 10
OWASP finalized the Agentic Skills Top 10, documenting the ten most critical security risks in agentic AI skills, alongside a Universal Agentic Skill Format v1.0 template. It spans OpenClaw, Claude Code, Cursor, Codex, and VS Code. Malicious skills and supply-chain compromise take the top two slots. The framing treats skills as the execution layer that gives agents real-world impact — defining not just what an agent can reach, but what it will do.
References:
- OWASP Agentic Skills Top 10
- The Top 10 Risks — Visual Overview
- OWASP Project Proposal: Agentic Skills Top 10
A Claude Harness Broke Four SAML Implementations
Eric Chiang, CTO of Oblique Security, built a multi-agent harness driven by Claude Opus and used it to find full authentication bypasses in four separate SAML implementations, including Authentik (CVE-2026-57580). He applied to Anthropic’s Cyber Verification Program to lift account guardrails, fed the model prior vulnerability research, and worked through implementations over roughly a month of spare time. The harness, exploits, and disclosure timeline are published.
References:
- Hacking SAML with Claude Code — oblique.security
- Four SAML implementations fell to a Claude harness — Promtime
- Claude AI Finds Authentication Bypass Flaws in Multiple SAML Implementations — GBHackers
Inside an AI-Run Bug Bounty Report
Anshuman Bhartiya documents a vulnerability he submitted to Mozilla’s HackerOne program in May that was handled almost entirely by AI on his side. A custom harness monitoring source code changes found the bug. Claude then wrote the report, built the reproduction environment, generated the demonstration GIF, and answered the triage questions that followed. It’s a concrete account of an end-to-end automated workflow, not a description of what one might eventually do.
References:
Remote MCP Changes the Trust Model
MCP is moving from local standard I/O into multi-tenant cloud deployments, and that shift changes who vouches for the caller. A local STDIO server inherits the trust of the session that spawned it; a remote server over streamable HTTP inherits nothing. Guidance is OAuth 2.1, layered on RFC 9728, RFC 8414, and RFC 7591. After the token validates, every invocation still needs an authorization check against identity, role, tool, and arguments.
References:
- Understanding Authorization in MCP
- OAuth 2.1 for Remote MCP Servers (2026) — MCP.Directory
- How Authorization Works Across the Model Context Protocol — DeepInspect
- Remote MCP, OAuth, and Enterprise Auth — Nick Gustafson
Fool’s Gold Makes Safety Removal Worthless
Mark Russinovich of Microsoft Azure published a paper proposing a defense that starts from a concession: safety alignment in open-weight models is trivially removable, since abliteration can project the refusal direction out of the weights in minutes. Rather than keeping guardrails attached, decoy hardening poisons the payoff — a stripped model answers dangerous questions confidently and incorrectly instead of refusing. The attack still succeeds; what it yields is worthless.
References:
- Fool’s Gold: Defensive Deception Against Safety-Removal Attacks on Open-Weight Models (arXiv)
- Fool’s Gold: A Defense That Makes Stripped Models Lie — AI Insiders
- A Defence That Makes Stripped Models Confidently Wrong Instead of Refusing
Technology & Tools
The New MCP Roadmap
MCP core maintainers published an updated roadmap on August 22 covering the next specification release and beyond. It reorganizes work into five priority areas, up from four in March, which had centered on transport evolution and scalability. Newly promoted priorities include progressive discovery for tool catalogs and standardized agent identity; three items the previous roadmap parked “on the horizon” are now priorities in their own right.
References:
- The New MCP Roadmap — Model Context Protocol Blog
- Roadmap — modelcontextprotocol.io
- The New MCP Roadmap: Progressive Discovery and Agent Auth
Agent Lightning v1.0 Trains Agents Inside Their Own Harness
Microsoft, with collaborators from Fudan, Zhejiang, and Edinburgh, released Agent Lightning v1.0, a reinforcement learning framework for LLM agents in roughly 3,500 lines of code. The goal is harnessed agentic RL: training an agent while it keeps running in its own production harness, with existing code, tools, and environments unchanged. That makes RL reproducible across arbitrary harnesses and surfaces problems a purpose-built training environment would hide.
References:
- Agent Lightning v1.0: Towards Harnessed Agentic RL — Hugging Face
- Microsoft releases Agent Lightning v1.0 — Neurohive
- Agent Lightning v1.0 — AI/TLDR
Detection Skills: An Open Standard for the Agentic SOC
Vega introduced Detection Skills, an open standard built on Anthropic’s Agent Skills format that turns static detections into agentic workflows. It targets everything after the match: triage, investigation, and tuning written as reusable skills attached to a detection, rather than living in an analyst’s head or a runbook nobody opens. It’s live at detectionskills.io and open to any defender.
References:
- Detection Skills Overview
- Vega Introduces Detection Skills
- Vega Introduces Detection Skills — Business Insider Markets
BetterWright: A Policy-Guarded Browser for Agents
BetterWright is a token-efficient browser built for AI agents, distributed as an npm package. It gives an agent one persistent, policy-guarded session to return to turn after turn instead of a fresh context each time. Drive it as a skill, over MCP, or through a JS API — or hand it whole tasks. The policy guard is the notable part: an enforcement boundary around what an autonomous agent may do in a live browser.
References:
Rome Scales the Environment, Not the Model
Rome OS positions itself as an agentic operating system: a guardrailed environment where humans and agents collaborate on persistent workflows and apps. The bet is that most AI progress has come from scaling models, and the other axis — the environment an agent works within, its tools, workflows, memory, and interfaces — is underexploited. Inside it, agents build their own harnesses and write their own SOPs under human guidance.
References:
Business & Products
Stripe’s OpenRouter Acquisition Is an AI Security Play
Stripe agreed on August 19 to acquire OpenRouter, the gateway routing traffic across 400+ models from 80+ providers for customers including NVIDIA and Zoom. Reporting puts the deal in the $7–8 billion range. Analysts argue the value isn’t routing or billing but the corpus: 10+ trillion tokens a day, producing execution traces, tool-call graphs, and failure modes — the largest cross-model record of how agents behave in production.
References:
- Stripe agrees to acquire OpenRouter — Stripe Newsroom
- You Probably Don’t Get Why Stripe Bought OpenRouter — AMP Public
- Stripe’s OpenRouter Deal Could Create AI’s Ledger — Forbes
Anthropic Widens Defender Access to Claude Mythos 5
As of August 21, Claude Security scans run on Claude Mythos 5, the model that previously reached only vetted defenders through Project Glasswing. Scans connect to a GitHub repository, trace data flows across files, and return findings. Anthropic also announced a $3.5M open source security fund and plans to expand its Cyber Verification Program. Defenders get what the model finds through controlled surfaces, not the model itself.
References:
- Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders
- Anthropic Expands Mythos 5 Access to More Defenders — SecurityWeek
- Anthropic Brings Claude Mythos 5 to Claude Security — MarkTechPost
Opinions & Analysis
The Case for a Coherent National AI Cybersecurity Policy
Joshua Saxe argues US AI cybersecurity policy is built on a capability-centric frame — measuring the dual-use potential of individual models — that overweights what AI does for attackers and discounts what it does for defenders. His alternative is ecosystem-centric. Cheap security agents will automate much of the kill chain adversaries now run by hand, and those same agents are indispensable to defense. Restricting defender access to the strongest US models, he writes, is a self-inflicted wound.
References:
Leave a comment