OpenAI hacked HuggingFace; a symlink trick made six coding agents show an approval dialog for a file that was not the file being written, and more.

The first ransomware run entirely by AI broke into a company, spread, and repaired its own mistakes mid-attack with no human at the keyboard.

The cycle input filtering died: Meta’s agent breach, OWASP’s agentic stocktake, and OpenAI shipping a kill-switch instead of a filter.

Anthropic’s Project Glasswing surfaced 10,000+ critical vulnerabilities in a single month.

One approval. Three AI coding agents. Indefinite execution. The trust model in today’s agent platforms has no expiration — and the vendors call it intended.

Anthropic’s MCP protocol has unsafe defaults by design. One prompt-injection payload hijacks Claude Code, Gemini CLI, and Copilot Agent.

Two weeks ago, the question was whether AI-accelerated offensive capability would outpace defensive capacity. Claude Mythos answered it.

NIST proves all frontier models hackable. LiteLLM supply chain hit. Memory attacks emerge. RSAC 2026.

AI agent worms go live, prompt injection proven unsolvable at model level, and enterprise breaches hit critical mass.

The AI Security Digest (Feb 19 – Mar 5, 2026) highlights a rapid rise in attacks targeting AI agent ecosystems rather than the models themselves.

1,184 malicious skills on ClawHub. Data leaking through inter-agent channels at 68.9%. NIST declaring AI agents a new security category.

MCP under siege with 23–41% attack amplification, CrowdStrike names a new attack class targeting agent reasoning, and 4,500+ AI assistants found exposed.

Agentic AI declared the #1 enterprise threat, NIST moves on agent security standards, and Anthropic proves production-viable jailbreak defence.

OWASP’s agentic AI Top 10 is out, OpenAI admits prompt injection may never be solved, and a polite email wipes Google Drive.