A minor but meaningful fix to the OWASP AI Agent Security Cheat Sheet landed on June 27, 2026. Pull request #2255 (13 additions, 5 deletions) corrects Python examples that throw NameError on copy-paste: it adds missing import json and import re to the Output Validation section, replaces an undefined generate_uuid() call with str(uuid.uuid4()) in the Multi-Agent Security section, and documents that CircuitBreaker depends on the pybreaker library while correcting its constructor from failure_threshold/ recovery_timeout to the actual fail_max/ reset_timeout API. For practitioners building AI agent security wrappers, runnable examples in authoritative guidance are load-bearing: broken snippets get copied into prototypes and often stay there, replacing correct patterns with ad hoc workarounds that can introduce new vulnerabilities.
Skill cascading attacks evade agent scanners across 213 test cases on Claude Code, Codex