Z.ai’s GLM-5.2 is a cheap, MIT-licensed, long-horizon coding agent anyone can self-host with no provider-side refusal, logging, or kill switch. Paired with fresh AISI research on autonomous container-sandbox escape, the lesson is blunt: the model was never your control point. Your runtime hardening is.
An out-of-bounds read in Ollama’s model quantization path leaks process heap, and the data leaves through Ollama’s own /api/push. The detection problem isn’t the read, it’s that the box almost certainly isn’t logging anything.
An attacker with app-management rights doesn’t need another password. They add their own secret to a trusted service principal and authenticate as the app, outside MFA and outside Conditional Access. Here is what the audit event looks like, what the first round of tuning has to fix, and where the cleanest preventive control hides behind a SKU you probably didn’t buy.
GTG-1002 showed an AI agent running recon through exfiltration at machine speed across roughly 30 targets. A blue-team analysis of the behavioral tells, the identity and SIEM signals that expose autonomous operations, how to break the adversary’s loop, and where defensive AI agents help versus where the human-in-the-loop line stays.
Indirect prompt injection is hard to catch in the prompt and easy to miss in the model output. The reliable detection surface is the outbound fetch the rendered answer triggers — here is how to instrument it and where the false positives come from.
An MCP server you approved last week can mutate its tool descriptions tonight, and most clients won’t tell you. Here’s how the rug pull works, what to log, and what the detection actually looks like before the false positives bury it.
Two separate disclosures against Anthropic’s Claude Code GitHub Action show how a single opened issue can walk out with OIDC tokens and an unscrubbed API key. Neither got a CVE, which is its own problem.
CVE-2026-49975 chains the 2016 HPACK Bomb with an HTTP/2 flow-control stall into a remote, unauthenticated memory-exhaustion DoS that takes down default nginx, Apache, IIS, Envoy, and Pingora configs from a single home connection. An OpenAI Codex agent found it by reading the code.
Stanford fabricated and measured a memory-on-logic 3D chip in a US foundry; Huawei announced a logic-folding design method and a new scaling law with no independent audit yet. Same wall, opposite evidence bars.
A defender’s view of indirect prompt injection in MCP-connected and tool-calling LLM agents — what the telemetry actually looks like, where detections originate noise, and how to map containment to 800-53.
