AI Security Newsletter No.90 (11-04-2026)

, ,
, , ,

Welcome to this edition of the AI Security Newsletter. This week, attackers’ AI moved inside the intrusion: Google and Mandiant report threat actors running open-source agentic pentest frameworks in real breaches. Meanwhile, Causal Security’s autonomous agent found four flaws in particle accelerator control software in under four hours. Google’s Gemini 4 Carbon posts leading cyber benchmark scores, but only vetted defenders get it first. We also look at new ways to watch, sandbox and govern agents, from Agentmetry and Google’s Agent Compute Engine to ServiceNow’s Control Tower Alliance, and at what governance really costs.

Risks & Security

Attackers Bring Agentic Offensive Frameworks Into Real Intrusions

Google Threat Intelligence Group and Mandiant report that since late August 2026, multiple threat actors have used open-source agentic pentest frameworks such as ARTEX, Hexstrike, CAIRN and PentAGI in real intrusions. ARTEX splits the attack across six sub-agents; with stolen credentials it swept 11 cloud resource types in eight seconds, then ran Kerberoasting and directory replication. The upside for defenders: the automation is noisy, leaving repeated errors and conspicuous logs.

References:

Autonomous Agent Finds Four EPICS Base Flaws in Under Four Hours

Causal Security’s Cipher found four unauthenticated, network-reachable memory-safety bugs in EPICS Base, which runs control systems at particle accelerators and fusion labs, in 3 hours 49 minutes. The worst, CVE-2026-114595 (CVSS 9.8), is an integer overflow that CISA says could enable remote code execution, though Causal demonstrated only a crash. CISA published its advisory on October 27, the same day EPICS Base 7.0.11 shipped the fixes.

References:

Teaching Qwen Why: Anthropic’s Alignment Training Replicates on Open Models

Second Look Research replicated Anthropic’s “Teaching Claude Why” on Qwen 2.5 32B and 72B base models. Training on fictional stories of AIs behaving admirably, or on conversations guiding users through ethical dilemmas, reduced misalignment on Anthropic’s Agentic Misalignment evaluation. Both methods worked on the first try with modest data and generalized to unseen scenarios. The code, data and LoRA adapters are public.

References:

Technology & Tools

Gemini 4 Carbon Leads Cyber Benchmarks, but Vetted Defenders Get It First

Google announced Gemini 4 Carbon on October 28, reporting 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching, plus more than double Gemini 4 Argon’s success rate at writing secure code. Access starts with vetted defenders in Google’s Fairwind program, which requires background checks, phishing-resistant MFA and use limited to internal security, incident response and penetration testing teams. Google has not given a date for broader release.

References:

Agentmetry: An Open-Source Flight Recorder for AI Coding Agents

Agentmetry records every tool call made by coding agents such as Claude Code, Cursor, Codex and Copilot, using their own hooks and an MCP proxy. It keeps a local, hash-chained log and runs sequence rules tagged with MITRE ATT&CK, so a credential read followed by network egress raises one critical alert. It can block calls your policy forbids and forward events to Splunk, Elastic, Google SecOps or Sentinel. The project is in public alpha.

References:

Google Gives Every Agent Its Own Sandbox With Agent Compute Engine

At AGNTCon + MCPCon, Google Cloud introduced Agent Compute Engine, which gives each AI agent a hardware-isolated microVM with no credentials stored inside the sandbox. It already powers the Gemini agent and enters preview in the coming months. Google is also extending agent governance, including Agent Gateway, Registry, Identity and OpenTelemetry observability, to more runtimes, with controls for local coding agents like Claude Code on managed devices coming to preview.

References:

BLA Hardens Software Against AI Reverse-Engineering Agents

BLA (Blind LLM Agents) is an open-source CLI and MCP server that modifies shipped JavaScript, Electron, WebAssembly, Python and native binaries to frustrate LLM-driven reverse-engineering agents, without changing runtime behavior. It plants decoys, pushes artifacts past the analyzer’s resource budgets and leaves it with ambiguous evidence. The project’s own benchmarks claim token costs for AI reconstruction rise 162x to 2,532x.

References:

Vulnerator AI Runs an Autonomous OODA-Loop Pentest Over MCP

Vulnerator AI is an open-source project in which Nous Research’s Hermes agent drives an Observe-Orient-Decide-Act pentest loop, running nmap, nuclei, ffuf, sqlmap and other tools on a Kali container through an MCP server. A newer MCP front door lets Claude Code or Cursor start, steer and stop runs. By design there are no built-in scope, consent or audit gates, so keeping tests in scope is entirely the operator’s job.

References:

GitHub Copilot Fusion Routes and Orchestrates Models per Task

GitHub Copilot Fusion became generally available on October 28. Instead of picking a model, users select Fusion and Copilot chooses the models, execution pattern and reasoning effort for each request, such as drafting with one model and reviewing with another. It combines Project HydraFusion’s multi-model orchestration, which matched or beat an Opus 5 baseline at lower estimated cost in offline evaluations, with Copilot’s auto model selection.

References:

Business & Products

ServiceNow Launches the Control Tower Alliance for AI Governance

On October 28, ServiceNow launched the Control Tower Alliance with 11 founding members, including Anthropic, OpenAI, AWS, NVIDIA, Cisco and Okta. Members build on ServiceNow’s Super Intelligence Control Tower, share standards for agent identity and safety guardrails, and must pass ServiceNow certification before being listed. Named contributions include an Okta agent kill switch, NVIDIA OpenShell runtime boundaries, Cisco AI Defense integration and Kong API enforcement.

References:

CrowdStrike and Dell Bundle AI Security Into the Dell AI Factory

CrowdStrike and Dell announced on November 2 that customers can buy CrowdStrike security alongside Dell AI infrastructure, aligned with NVIDIA’s AI Factory reference architecture. The bundle includes Falcon Guardian, which monitors AI agent activity and protects against prompt injection and sensitive data exposure at runtime, plus Falcon Cloud Security and Falcon Next-Gen SIEM. Dell’s managed detection and response service will also run the CrowdStrike tools.

References:

Opinions & Analysis

Governance Becomes a Hidden Line in AI’s Total Cost of Ownership

As AI agents reach production, approvals, testing, audit trails and human review add work across IT, security, legal, risk and data teams. Governance is not the largest AI cost, since tokens and licenses rank higher, but it is a growing share of total cost, and when bolted on late it can add months to a rollout. IBM research found that organizations building control into their AI architectures deploy 16 times more agents while spending four times less.

References:

Digital.ai: AI Has Collapsed the Cost of Attacking Apps

Digital.ai’s 2026 Application Security Threat Report found that 87% of monitored client-facing apps were attacked in 2026, up from 55% in 2022, with the first hostile contact arriving under two hours after app store publication. iOS apps now face 97% of Android’s attack rate, up from half in 2023. The report credits AI with cutting the skill, time and cost needed to reverse-engineer and exploit apps.

References:

Lessons From Building Microsoft Copilot Cowork With Agents

Microsoft took Copilot Cowork from an empty repository to worldwide availability in about four and a half months, with agents writing most of the code. Every change needs a Markdown spec covering its purpose, success measure and what must not break. Automated checks and agent reviewers examine each change, and humans focus on risky ones. In the product, the model runs in a container with no user credentials, while a trusted host handles identity, approvals and audit.

References:

Discover more from Mindful Machines

Subscribe to get the latest posts sent to your email.

Leave a Reply

Discover more from Mindful Machines

Subscribe now to keep reading and get access to the full archive.

Continue reading