Malicious AI use and threats to AI systems are requiring cyber teams to double down on security fundamentals and rethink the future of their approaches to defense.
Newly emerging AI-enabled attacks, proofs of concept, and in-the-wild techniques, as well as the latest AI vulnerability and risk research, present inklings not only about what enterprises presently face but also how security leaders need to adjust for what may soon come to their systems.
The following report aims to help inform and provide a gateway to insights into what we’ve seen evolving on the AI threat horizon of late.
The most impactful recent event signaling what’s here and ahead for CISOs was the revelation of OpenAI’s agents attacking Hugging Face.
The attack, executed by sandboxed OpenAI models, shows that prompt guardrails cannot serve as a reliable, primary security boundary for AI agents, putting pressure on enterprises to establish more sophisticated agentic infrastructure controls to limit access and prevent lateral movement. CSO’s Prasanth Aby Thomas breaks down how OpenAI’s agent containment strategy failed.
Further investigation of the OpenAI incident uncovered additional breached trust boundaries, prompting the Cloud Security Alliance’s CISO Community to issue emergency guidance for strengthening controls around autonomous AI agents, CSO’s Gyana Swain reports. The incident also prompted Anthropic to analyze its own cybersecurity evaluations, finding that its Claude models had also escaped their test environments to encounter real-world systems, with one such incident resulting in Claude publishing a malicious Python package to the public PyPI repository, which was downloaded and executed by 15 real systems.
With frontier labs not yet required to provide kill switches for AI agents, enterprise CISOs are encouraged to investigate architecting their own.
The Hugging Face incident also shows how important it is for incident response teams to have a multi-modal AI strategy, including open-weighted models, to ensure viable operations under fire, writes CSO’s Lucian Constantin.
CISOs should also be aware that attackers are turning attention to agent workflows, seeking ways to infect AI agents with malicious rules, configuration, and instruction files to do their bidding. CSO’s Constantin reports on the trend, which includes a recently revealed backdoor attack technique dubbed “PromptLogger.”
According to researchers from Mitiga, PromptLogger tricks AI agents into exfiltrating prompts and responses through maliciously crafted instruction files (e.g., CLAUDE.md
). The technique has also been observed attempting to influence agents into injecting backdoor code into Python files that could be copied to other systems. Because agents would be performing these tasks on criminals’ behalf, detection is an uphill battle.
Enterprise workflows could also potentially be corrupted via self-propagating document-borne AI worms, according to a recent report from Norwegian AI researcher Håkon Måløy centered on Microsoft Copilot. As CSO’s Evan Schuman reports, by concealing instructions in files used as source material for Copilot-assisted workflows, Måløy demonstrated how attackers could use Copilot as a transmission mechanism for corrupting data and propagating malware, something that could sidestep nearly every defense mechanism in place today.
Software development remains the workflow most impacted by AI threats today, with recent reports underscoring established attack modalities, including a critical vulnerability in Ruflo MCP infrastructure and the potential for slopsquatting on nonexistent PyPI and npm packages that top AI coding tools collectively and consistently hallucinate, report CSO’s Swain and Maxwell Cooter.
Moreover, security flaws in automated workflows in Google’s ADK for Python GitHub repository, now since hardened, could induce agents to post commands and remove review requests, making a malicious pull request appear ready to merge. Pillar Security, which discovered the flaws, called it the “first practical, real-world case of agent-to-agent exploitation” involving a production multi-agent system, CSO’s Thomas reports.
A recently patched OpenAI flaw shows another means by which attackers could enlist rogue AI agents to operate on their behalf. Dubbed “AgentForger,” this phishing-based attack, reported by Zenity Labs, could have enabled attackers to silently create and launch fully autonomous AI agents within OpenAI workspaces. Broad, unfettered access to systems would then turn the agent into a “persistent operator,” capable of performing reconnaissance, harvesting data and credentials, and impersonating victims, CSO’s Taryn Plumb writes.
Meanwhile, Pathfinder’s 2026 AI Governance Gap Report finds that 53% of organizations cannot verify what AI agents do across their business systems — not great news when 36% have deployed or are implementing AI agents within finance and accounting environments, CSO’s Shweta Sharma notes.
And if you need any more fodder for tighter restrictions on that other insider threat, CSO’s Grant Gross sheds light on how senior executives are killing your shadow AI strategy.