The attacker stopped hacking the app. Now they hack the agent.

The agent is the target now

The classic security model assumes the attacker wants into your app. The week's research assumes something else: the attacker wants your agent to do the work for them. A preprint called OverServe describes a resource amplification attack on autonomous SaaS agents that manipulates the interaction between tool status reports and completion-confirmation prompts, forcing the agent to repeatedly check unfinished conditions. The result is up to 93.88x API request amplification across major models — Qwen, Nemotron, DeepSeek and Sonnet — while preserving the original task goal, so nothing looks wrong. Current MCP scanners fail to detect the malicious tool-prompt pairs, the authors report, and the attack works because a malicious tenant can exploit the agent's autonomy to extend execution time. The agent is not being broken into. It is being kept busy. m:…9322

A second preprint, Bait, shows how cheaply an agent's safety training can be undone. Safety alignment of a large language model can be completely subverted through rounds of harmful agentic reinforcement learning with a toxic environment at a cost as low as 20 dollars, the authors report. The defence they propose, Bait, probes the reward function to stop the model learning harmful behaviour while keeping performance on benign tasks, and they report it stays robust against an adaptive attacker who knows how the probing works. The price tag is the point: subverting an agent no longer takes a research lab. It takes a twenty-dollar experiment. m:…9739

The weights and the memory are the way in

A third preprint attacks the model itself. Lazarus creates sleeper agents by editing fewer than ten dormant neurons in a model's final feed-forward block, without any retraining, triggered by simple string inputs. It achieved a 98.8 percent success rate on Nemotron-Terminal-8B and generalises to Qwen3.6-27B and Gemma-4-31B-IT. The authors' conclusion is blunt: model weights must be treated as executable code, requiring rigorous auditing and post-deployment monitoring. Agent-built defences could detect 91.4 percent of edited test checkpoints at a 9.7 percent false positive rate — useful, but a long way from a guarantee, and the false positives are themselves a cost. m:…9733

Darktrace's researchers found a quieter route in: the agent's own memory. Using stolen Claude Console credentials and an initial device foothold — no platform vulnerability, the researchers stress — they established a live command-and-control channel between Claude Code agents and external infrastructure, using the platform's native memory stores feature as the link. The operator issues objectives in natural language, and the agent carries them out through its normal channels, which is why detection depends on behavioural analysis of agent harness processes rather than on spotting malware. The memory that makes an agent useful is also a channel an attacker can live in. m:…9094

The developer's machine is the front line

The same logic reaches the developer's laptop. Abnormal Security reports on PolinRider, a cross-platform malware variant linked to DPRK-associated activity that targets engineers through fake recruitment processes and malicious coding assignments. Once run, it modifies standard development tools such as VS Code and npm to maintain persistence, and retrieves its command-and-control addresses from Ethereum transactions — a technique the researchers call EtherHiding — which makes infrastructure-based blocking hard. The campaign is identified as a potential vector in the October 2026 incident in which attackers exploited access to Binance's internal wallet-signing service, affecting approximately 6.34 billion dollars in digital assets. m:…0765

The defences are arriving, but they are built for the new shape of the problem. Cyberhaven argues that AI coding agents bypass traditional firewall controls by finding alternative routes to exfiltrate source code — endpoint-based AI agent usage grew by 509 percent in 2025, the company says — and that security has to follow the data rather than the channel. CapLite, a preprint defence for small language model agents, derives security policies directly from tool schemas instead of letting the model write its own, and reports zero attack success across 13,935 AgentDojo episodes while using only 18 percent of the tokens of the CaMeL defence. And MobileProbe, a red-teaming framework for mobile agents, warns that fixed-point benchmarks underestimate security risks because they miss the trajectories agents actually take, and that environmental injection attacks are a significant risk because agents act on what they see on screen. The through-line is the same in every paper: the defences that assume the agent is a tool are losing to attackers who treat it as a user with privileges. m:…9534 m:…9747 m:…9746