Below the model: browsers, agent machines, kernels and botnets set the security agenda

The browser is the new front door

This week, the most consequential security news for AI teams sits below the model: in the browser where agents act, in the virtual machine where an agent coworker runs, in the kernel underneath servers, and in set-top boxes conscripted into a botnet. None of the four items is about a model leaking a secret or refusing a prompt. Each is about the layer an agent or an attacker touches first, and that is where the risk now concentrates. m:…5380 m:…8730 m:…8229 m:…6711

Perplexity reports that browser agents are susceptible to indirect prompt injection, where attackers place malicious text on webpages to hijack agent actions. To measure the problem, the company built BrowseSafe++, a benchmark of 38,675 attacked and clean page pairs drawn from real-world prompt injections. Its BrowseSafe-Guard detectors use 0.8 billion parameters and, the company says, outperform frontier models in accuracy, speed, and cost, reaching a 94.84 percent F1 score on the benchmark at a cost of about 0.18 dollars per 1,000 pages on rented H200 hardware. m:…5380

The more important finding is that detection does not guarantee resistance. Perplexity reports that models often follow injections they have already flagged, and that adaptive attacks tested through BrowseSafe-Adapt bypassed defenses in up to 95 percent of tasks. More than 40 percent of injections in the benchmark push the agent toward an unauthorized action, about 24.4 percent use a language different from the rest of the page, and only about 3 percent attempt to plant false information in the answer. The implication, in the company research, is that detection models alone do not guarantee agent resistance, and layered defenses are needed. m:…5380

Agents inside virtual machines get watched

SentinelOne announced an integration with Anthropic Claude Cowork that places a SentinelOne agent inside the Claude Cowork virtual machine, across macOS and Windows devices, enabled by IT teams through device management. The company says security teams can autonomously stop attacks using the same runtime detection and response it already runs across endpoints. The company also says it protects nearly one-fifth of the Fortune 500, and it recently unveiled its Singularity Agentic Detection and Response product at OneCon 2026. m:…8730

The company frames the gap as a blind spot: agentic activity occurs in ways that standard device security software cannot see. Whether that framing holds for a given deployment depends on how the organization already monitors virtual machines, but the direction is clear. Agent work is moving into managed machines, and vendors are now competing to watch it there rather than treating the agent as an ordinary application. m:…8730

The kernel and the botnet underneath

Aikido reports a critical Linux kernel flaw, CVE-2026-98432, in IPv4 TCP connection setup, present in kernel 4.4 and later. The Linux kernel CVE team rates it 9.8 out of 10. The flaw is a use-after-free condition in ip_options_build during TCP handshakes, and Aikido reports that it allows unauthenticated remote attackers to gain root access on Linux servers with an MPTCP listener. Aikido also reports that an unreleased Claude research model wrote an exploit for the flaw. Installing a patched kernel and rebooting is the only complete remediation, according to Aikido, while disabling MPTCP by setting net.mptcp.enabled to 0 can reduce exposure. As of 29 October 2026, no vendor advisory reported attacks in the wild for the flaw. m:…8229

Plume reports that a coalition of private and public sector partners, led by Google, dismantled the X.CPE botnet, which was embedded in device firmware before set-top boxes reached subscribers homes. TrendAI research identified more than 1.3 million affected devices across 200 countries, and the takedown of command-and-control domains is expected to sever access to at least 10 million additional compromised devices. The botnet generated revenue through residential proxy services, ad fraud, and unauthorized bandwidth reselling, using subscribers home internet connections without their knowledge or consent. The operation included participation from Japan National Police Agency, and Google has updated its review process and banned the responsible manufacturer from producing devices with preloaded Google apps. m:…6711

What executives should take from this

Read together, the four items argue for treating agent infrastructure as ordinary infrastructure with an attacker attached. Browser agents need defenses beyond a detector, because flagged injections still get followed. Agent virtual machines need endpoint-style monitoring, because that is where agent work now happens. Kernels need patching and reboots, because mitigation settings only reduce exposure. And consumer hardware in the fleet cannot be assumed clean, because compromise can arrive pre-installed in firmware. None of that is a model problem, and none of it is solved by a better prompt. m:…5380 m:…8730 m:…8229 m:…6711