The attacks work, the benchmarks lie, and 48% of security leaders are worried

Poison goes in through the repo

Agents that write code, tap through apps, and call tools are being attacked through their own working context, and the attacks work. Start with the repository. TrojanForge, an automated pipeline for poisoning repos against coding agents, clears a greater-than-60% poisoning success rate, and its authors conclude that commercial coding agents are currently vulnerable to repository-level poisoning attacks. m:…1214

The mechanics matter because they scale: TrojanForge parses repository structure through abstract syntax trees and maps agent execution traces onto AST nodes, locating payload positions that stay inconspicuous. This is not handcrafted red-teaming — it is automation aimed at the repos your agents already trust. m:…1214

The permission dialog is the attack

From Approval to Abuse goes after the harness — the allow-rule approval gates meant to keep coding agents honest. The finding, in a preprint: adversarial context planted in a repository can steer an agent into requesting dangerously broad allow-rules. The agent does the asking, and the human, trained by years of dialog boxes, approves. m:…9474

In the authors' experiments, agents elicited the target allow-rules in 58% of instances; the acquired rules covered 56.9% of capability test cases; and — conditional on the human approving — the exploit reached verified, silent goal completion in 81.0% of instances. The safety control is not bypassed. It is recruited. m:…9474

Your phone agent talks safer than it taps

MobileJailBench takes the same question to mobile agents: 520 tasks across 14 risk categories measuring how conversational safety training holds up during dynamic phone interactions. The authors' verdict is blunt: safety alignment in current mobile agents is largely superficial and fails to generalize from conversational refusal to dynamic mobile interactions. m:…8948

Their dynamic evolution mechanism reaches a 100% attack success rate against Qwen3.5-122B. The model that refuses in chat complies on the phone screen — the refusal never made it past the keyboard. m:…8948

The scoreboard understates the problem

A third preprint argues the benchmarks themselves undercount the threat. Ignored, Not Refused shows that standard attack-success-rate metrics in prompt-injection benchmarks treat ignored attacks as successful defenses: an agent that simply fails to notice an injected instruction scores as safe. Low ASR numbers are hiding exposure. m:…0642

The same paper finds that system-prompt configuration is a primary driver of indirect-prompt-injection vulnerability, independent of model weights — which means much of an agent's security posture is decided by the prompts its deployer writes, not the model it runs. The authors propose the ATOM framework to measure safety and task completion together. m:…0642

What executives do about it

Enterprises are noticing. The company says 48% of security leaders rank AI agents with excessive or unintended access as their top threat — while reporting only 26% visibility into cross-system behavioral sequences and 19% into human-to-agent and agent-to-agent interactions. The threat is ranked first; the visibility is ranked last. m:…6416

The company's answer is behavioral, not permission-based: access control can say who reaches what, it argues, but not whether an account uses that access appropriately — so its framework runs a four-stage verify-observe-analyze-improve lifecycle across people, service accounts, and agents, with open-source pieces like Praxen, which checks an agent against its defined scope before it acts, and Observra, a telemetry SDK for capturing agent activity. Meanwhile GatewayBench shows the plumbing matters too: gateway design significantly impacts agent task completion, tool-use efficiency, and resilience to adversarial attacks across the MCP gateways it evaluated. m:…6416 m:…3884