The new agent security tests do not ask if the agent works. They ask if it can be tricked

Poison the library

MIRAGE operates as a black-box and query-agnostic poisoning pipeline for RAG systems, which means the attacker does not need to see the model or know the question. MIRAGE utilizes persona-driven query synthesis to approximate latent user search distributions, and employs an adversarial variant of Test-Time Preference Optimization (TPO) to maximize persuasion in poisoned RAG outputs. MIRAGE exhibits high transferability across diverse retriever-LLM configurations. m:…9220

The threat model is the point. A RAG system trusts its corpus, and the corpus is the attack surface. An attacker who can slip poisoned documents into the retrieval set does not need to trick the model. The model will do the tricking itself, by retrieving the poisoned document and presenting it as evidence. The defense is not a better model. It is a corpus you can trust, and a retrieval layer that treats its own sources with suspicion. m:…9220

Evade the endpoint

BypassGym provides a systematic framework for testing whether AI agents can generate functional, EDR-evading code, and the findings are uncomfortable. AI agents can generate and compile loaders that successfully evade EDR systems, and DeepSeek-V4.1 Flash achieved 17/18 successful evasion runs in the BypassGym benchmark. Bitdefender demonstrated higher efficacy in blocking AI-generated payloads compared to other tested EDRs, which is the good news in the result. m:…9214

The result matters because the model doing the evading is lightweight. A frontier model evading endpoint defenses would be concerning. A smaller, cheaper model doing it 17 times out of 18 means the capability is not gated by access to the best models. It is available to anyone who can run the benchmark's recipe, and the benchmark exists precisely so defenders can measure it rather than guess. m:…9214

Judge the judge

RAS-Eval addresses a different problem: the evaluator itself. LLM-as-a-Judge and Agent-as-a-Judge methods are vulnerable to hallucination and perturbation, leading to unreliable security verdicts. RAS-Eval uses LTL specifications to derive deterministic verdicts, eliminating evaluator-side uncertainty, and detects transient violations that are overwritten or not captured in textual logs by monitoring environment states throughout execution. m:…9208

The insight is that a security violation that lasts a second and then gets overwritten is still a violation, and a log-based judge will miss it. Monitoring the environment state throughout execution, rather than reading the log after the fact, is the difference between catching the violation and reading a clean report about a dirty run. Formal specifications are the tool for that, because they do not hallucinate. m:…9208

Treat the output as untrusted

OWASP published the Agentic Applications V2 guide on November 10, 2026, and its central move is a change of posture. OWASP V2 treats agent outputs as untrusted proposals requiring external validation and authorization, and the surrounding system must enforce policy even when the model follows a malicious instruction or makes an unsafe decision. V2 introduces security hooks across 18 lifecycle points, including tool calls, memory operations, delegation, and skill activation, and policy at enforcement points can allow, deny, modify, escalate, or defer an action, while errors and timeouts must fail closed. m:…5270

The guide also names the composition problem. The Lethal Trifecta and Rule of Two manage risks when sensitive data, untrusted content, and external communication intersect, and V2's effective-scope model combines user permission, agent capability, and bound intent, with consented scope added where applicable. In multi-agent systems, delegated authority should narrow at each hop to keep downstream agents bound to the original task. V2 treats repository instructions and configuration as supply chain risks, alongside tools and MCP integrations, and Security contributed to the development of the guide, including the OWASP Agent Control Standard (ACS) to standardize runtime hooks for policy enforcement. m:…5270

The pieces fit together. MIRAGE shows the corpus can be poisoned. BypassGym shows the agent can be taught to evade. RAS-Eval shows the judge can be fooled. OWASP says the answer is not to trust any of them, but to put the policy outside the model and enforce it at the moment of action. The agent proposes. The system disposes. That is the new security posture, and the benchmarks exist to measure whether it holds. m:…9220 m:…9214 m:…9208 m:…5270