Agent Security

What Is an Agent Scanner for GitHub AI Agent Detection? An agent scanner for GitHub AI agent detection is a security tool that scans repositories to identify, inventory, and assess the security posture of autonomous AI agents, their skills, MCP server configurations, and tool permissions. These scanners emerged rapidly in 2026 after the ClawHavoc campaign planted over 1,200 malicious skills into agent marketplaces, and the market has since grown to over 95 open-source tools on GitHub. They serve as the first line of defense for organizations adopting AI agents at scale, enabling teams to detect shadow AI, enforce compliance with regulations like the EU AI Act, and prevent supply-chain attacks on agent ecosystems. ...

If you’re building AI agents with Microsoft’s Semantic Kernel, stop and check your version right now. Two critical vulnerabilities — CVE-2026-26030 (CVSS 9.9) and CVE-2026-25592 (CVSS 9.9) — turn prompt injection from a content-quality annoyance into a full host compromise primitive. I’ve spent the last few weeks digging into both exploits, and the implications go far beyond Semantic Kernel itself. Here’s the uncomfortable truth: AI models are not security boundaries. Every parameter an LLM can influence when calling a tool is attacker-controlled input. If your framework passes that input to eval(), a file write function, or a shell command without validation, you’ve built a remote code execution vector that only needs a cleverly crafted prompt to trigger. ...

Every Claude Code release from v2.0.24 (October 20, 2025) through v2.1.89 (March 31, 2026) shipped a network sandbox that was trivially bypassable with a single null byte. If you ran Claude Code with a wildcard allowlist like *.google.com, any code executing inside the sandbox — whether through prompt injection, a malicious dependency, or a compromised repo — could reach any host on the internet by sending a SOCKS5 hostname like attacker-host.com\x00.google.com. The JavaScript allowlist filter saw the trailing .google.com and approved the connection; the OS resolver truncated at the null byte and dialed attacker-host.com. This is a parser-differential vulnerability in its purest form, and as of June 2026, it still has no CVE assigned to Claude Code itself. ...