Agent Security

PromptShield is a prompt injection scanner that audits repositories for malicious instructions and hidden Unicode before AI agents ever consume them. It statically scans agent instruction files, detects zero-width character attacks and taint patterns, and maps findings to the OWASP Agentic Top 10 (2026) so teams can block supply-chain and prompt-injection risk in CI/CD. What Is PromptShield and Why Repo Scanning Matters PromptShield belongs to a fast-growing category of tools built to answer one uncomfortable question: can you trust the instructions your AI agent is about to read? As coding agents like Claude Code, Codex, and Cursor become the default way teams ship software, the files those agents read — READMEs, AGENTS.md files, MCP configurations, and skill definitions — have become a new attack surface. ...

What Is an Agent Scanner for GitHub AI Agent Detection? An agent scanner for GitHub AI agent detection is a security tool that scans repositories to identify, inventory, and assess the security posture of autonomous AI agents, their skills, MCP server configurations, and tool permissions. These scanners emerged rapidly in 2026 after the ClawHavoc campaign planted over 1,200 malicious skills into agent marketplaces, and the market has since grown to over 95 open-source tools on GitHub. They serve as the first line of defense for organizations adopting AI agents at scale, enabling teams to detect shadow AI, enforce compliance with regulations like the EU AI Act, and prevent supply-chain attacks on agent ecosystems. ...

If you’re building AI agents with Microsoft’s Semantic Kernel, stop and check your version right now. Two critical vulnerabilities — CVE-2026-26030 (CVSS 9.9) and CVE-2026-25592 (CVSS 9.9) — turn prompt injection from a content-quality annoyance into a full host compromise primitive. I’ve spent the last few weeks digging into both exploits, and the implications go far beyond Semantic Kernel itself. Here’s the uncomfortable truth: AI models are not security boundaries. Every parameter an LLM can influence when calling a tool is attacker-controlled input. If your framework passes that input to eval(), a file write function, or a shell command without validation, you’ve built a remote code execution vector that only needs a cleverly crafted prompt to trigger. ...

Every Claude Code release from v2.0.24 (October 20, 2025) through v2.1.89 (March 31, 2026) shipped a network sandbox that was trivially bypassable with a single null byte. If you ran Claude Code with a wildcard allowlist like *.google.com, any code executing inside the sandbox — whether through prompt injection, a malicious dependency, or a compromised repo — could reach any host on the internet by sending a SOCKS5 hostname like attacker-host.com\x00.google.com. The JavaScript allowlist filter saw the trailing .google.com and approved the connection; the OS resolver truncated at the null byte and dialed attacker-host.com. This is a parser-differential vulnerability in its purest form, and as of June 2026, it still has no CVE assigned to Claude Code itself. ...