Atlas/escalation · approval

Human approver

People asked to approve, review, or intervene, and the load placed on them.

8 attacks and incidents20 defense records6 findings0 measured defense findings

Attacks and incidents

Sep 16, 2026

Mandiant case: hijacked AI coding-assistant session led to poisoned package and worm across ~100 repos

AttackIncidentMandiant

Aug 4, 2026

UK AISI reports 19 unsanctioned real-world agent actions during internet-enabled cyber range testing

AttackIncidentUK AI Security Institute, Anthropic, OpenAI

Feb 25, 2026

Check Point: Claude Code project files could run commands and leak API keys before trust prompt

AttackVulnerability disclosureCheck Point Research, Anthropic

Aug 12, 2025

GitHub Copilot agent could be prompt-injected into disabling its own approvals (CVE-2025-53773)

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Microsoft, GitHub

Aug 6, 2025

SafeBreach shows Google Calendar invites can hijack Gemini for Workspace agents

AttackVulnerability disclosureSafeBreach, Tel Aviv University, Technion

Aug 5, 2025

MCPoison: Cursor trusted approved MCP configs even after their commands changed (CVE-2025-54136)

AttackVulnerability disclosureCheck Point Research, Cursor

Jul 28, 2025

Tracebit shows Gemini CLI could silently run attacker commands when reading untrusted code

AttackVulnerability disclosureTracebit, Google

Jul 20, 2025

Replit coding agent deletes a user's production database during a declared code freeze

AttackIncidentReplit, Jason Lemkin (SaaStr)

Defense research

Sep 5, 2026

Year-long SOC fieldwork finds analysts reused an agentic AI companion's output in over 90% of tickets

DefensePaperUniversity of South Florida

May 22, 2026

Glasswing update: over 10,000 high-severity bugs found, but only 75 of 530 disclosed OSS bugs patched

DefenseProgramAnthropic, Cloudflare, Mozilla

May 18, 2026

Maintainers report AI-generated vulnerability reports overwhelming kernel and bounty triage

DefenseIncidentLinux kernel maintainers, curl project, GitHub

Mar 6, 2026

OpenAI relaunches Aardvark as Codex Security, reporting 1.2M commits scanned and 14 CVEs

DefenseTool releaseOpenAI, OpenSSH, GnuTLS

Feb 20, 2026

Anthropic releases Claude Code Security in limited preview to scan code and propose patches

DefenseTool releaseAnthropic

Feb 5, 2026

Anthropic reports over 500 human-validated high-severity open-source vulnerabilities found with Claude Opus 4.6

DefensePaperAnthropic, Ghostscript, OpenSC

Jan 28, 2026

OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration

DefenseTool releaseOpenAI

Nov 17, 2025

Microsoft RCT finds phishing triage agent raised analysts' true positives per minute up to 6.5x

DefensePaperMicrosoft

Nov 7, 2025

OpenAI describes its layered approach to prompt injection as a frontier security challenge

DefenseFrameworkOpenAI

Oct 31, 2025

Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact

DefenseFrameworkMeta

Oct 30, 2025

OpenAI announces Aardvark, a GPT-5 agent that finds, validates and proposes patches for vulnerabilities

DefenseTool releaseOpenAI

Oct 20, 2025

Anthropic adds OS-level filesystem and network sandboxing to Claude Code and open-sources the runtime

DefenseTool releaseAnthropic

Oct 6, 2025

Google DeepMind introduces CodeMender, an agent that patches and hardens code, with 72 upstreamed fixes

DefenseTool releaseGoogle DeepMind, Google

Aug 25, 2025

Anthropic publishes prompt injection red-team rates for its Claude in Chrome browser agent pilot

DefenseEvaluation reportAnthropic

Aug 4, 2025

Google reports Big Sleep found and reproduced 20 vulnerabilities in open-source projects

DefenseVulnerability disclosureGoogle, Google DeepMind, Google Project Zero

Mar 24, 2025

Microsoft announces Security Copilot agents for phishing triage, alert triage and remediation

DefenseTool releaseMicrosoft, OneTrust, Aviatrix

Jan 31, 2024

Google reports Gemini-based pipeline fixed 15% of sanitizer bugs found in its unit tests

DefensePaperGoogle

Dec 12, 2023

Redwood Research introduces AI control protocols for safety despite intentional subversion

DefensePaperRedwood Research

Dec 5, 2023

Microsoft randomized controlled trial measures Security Copilot effect on analyst speed and accuracy

DefensePaperMicrosoft

June 2023

CETaS and CSET report maps barriers to deploying reinforcement-learning cyber defence agents

DefensePaperCETaS (Alan Turing Institute), CSET (Georgetown University)

Findings

Sep 5, 2026

In a SOC studied for over a year, analysts reused an agentic assistant's output in the closing reports of over 90% of tickets during a four-month deployment.

Reportedobserved1 evidence record

Jul 28, 2025

Approval gates in coding agents do not always show, or even ask about, what the agent is actually about to do.

Corroboratedmeasured2 evidence records

Dec 5, 2023

Controlled trials run by Microsoft report that its security assistants make analysts faster and more accurate.

Reportedreported2 evidence records1 linked finding

Jul 22, 2025

Limits that agents are only told about, or that block one tool while others remain available, do not reliably stop them: a declared code freeze and an ignore-file setting were both bypassed.

Corroboratedobserved2 evidence records1 linked finding

Apr 1, 2025

Approving an agent's tools or configuration once is not enough, because they can change after approval or be changed by the agent itself.

Corroboratedmeasured4 evidence records

Oct 20, 2025

Operating-system sandboxing can cut the number of approval prompts a coding agent needs without widening what injected instructions can reach.

Reportedreported1 evidence record

Capability, policy, and guidance

Jun 3, 2026

Frontier Model Forum issue brief catalogs emerging security practices for AI agents

PolicyGuidanceFrontier Model Forum

May 15, 2026

UK NCSC advises incremental agentic AI adoption with minimal, expiring permissions

PolicyGuidanceUK National Cyber Security Centre

May 1, 2026

CISA, ASD's ACSC and international partners publish joint guidance on careful adoption of agentic AI

PolicyGuidanceCISA, NSA, Australian Signals Directorate (ACSC)

Jan 8, 2026

NIST CAISI requests public input on security considerations for AI agent systems

PolicyProgramUS Center for AI Standards and Innovation, NIST

Dec 3, 2025

CISA, ASD and partners issue principles for securely integrating AI, including agents, into OT

PolicyGuidanceCISA, Australian Signals Directorate (ACSC), NSA Artificial Intelligence Security Center

Sep 29, 2025

California SB 53 requires frontier AI frameworks covering autonomous cyberattack risk and incident reporting

PolicyRegulationState of California

Jul 16, 2025

Coalition for Secure AI publishes Principles for Secure-by-Design Agentic Systems

PolicyFrameworkCoalition for Secure AI, OASIS Open

Nov 22, 2024

Frontier Model Forum issue brief maps defensive uses of frontier AI in cybersecurity

PolicyGuidanceFrontier Model Forum

Attacks and incidents

Defense research

Findings

Capability, policy, and guidance

Related research openings