The AI Security Brief — Edition 1 · Intelligent Resilience

Bi-weekly intelligence for CISOs, governance leads, and AI practitioners who need to stay ahead of the threat — not just aware of it.

This fortnight in AI security

The conversation has moved. Evidence emerging from the RSA Conference period suggests we are no longer in theoretical territory — early cases indicate AI systems are being actively targeted in production environments, and the attack surface is expanding faster than most security teams have modelled. This edition covers four developments that matter: a cluster of agentic AI vulnerabilities disclosed before RSA, a critical enforcement deadline now four months away, a new OWASP framework that should be on every practitioner's desk, and a statistic that will sharpen any board conversation you need to have.

This edition's framing: Security teams are still defending interfaces. Attackers are now targeting decision-making loops. The shift from prompt risk to agentic execution risk is the defining change in this threat landscape.

Story 1

Early evidence of agentic AI exploitation in the wild — and an attack surface larger than most teams have modelled

The RSA Conference period produced a cluster of serious vulnerability disclosures that, taken together, suggest a step-change in adversarial AI sophistication is underway.

Five signals from the past fortnight — grouped by attack category — form a coherent and concerning picture.

Framework vulnerabilities: Testing of OpenClaw across 47 adversarial scenarios (reported by Adversa AI) found sandbox escapes at a rate exposing a default defence effectiveness of just 17%. Four CVEs in CrewAI — a widely used open-source multi-agent framework — were found to allow attackers to chain prompt injection into remote code execution, server-side request forgery, and file read.

Platform vulnerabilities: A command injection flaw in OpenAI Codex (reported by BeyondTrust) enables GitHub OAuth token theft via unsanitised branch name parameters. Unit 42 identified CVE-2026-0628, a high-severity vulnerability in Chrome's Gemini Live panel allowing malicious extensions to hijack the AI assistant and access camera and microphone.

In-the-wild activity: Early reports — still being independently verified — describe autonomous agent activity exploiting GitHub Actions workflows to achieve remote code execution using poisoned Go init() functions.

Typical agentic exploit path · Observed in recent CrewAI vulnerabilities

Prompt Injection → Agent Hijack → SSRF / File Read → Remote Code Execution

What this means in practice: If your clients are running agentic AI — and increasingly they are — their security architecture almost certainly hasn't caught up. The threat model for an autonomous agent that can browse the web, execute code, and call external APIs is categorically different from a chatbot. Standard application security controls are insufficient. Any AI security engagement should now include an agentic AI threat assessment as a default scope item.

Story 2

97% of enterprises expect a major AI agent security incident within the year

A vendor-backed survey (primary source not disclosed; reported by Security Boulevard, April 2026) found that 97% of enterprise leaders expect a material AI-agent-driven security or fraud incident within the next 12 months. Nearly half expect one within six months. Separately, data from Reco's 2025 breach review identifies malware hidden in public model and code repositories as the most commonly cited source of AI-related breaches — a supply chain risk category for which most organisations currently have no specific controls.

What this means in practice: This statistic is a useful anchor for any board or CISO conversation. The framing shifts from "should we invest in AI security?" to "what do we have in place when this happens?" It also signals where to start: AI supply chain risk — the models, libraries, and repositories your systems depend on — is an underexamined exposure for most organisations.

Story 3

OWASP publishes the Top 10 for Agentic Applications — the framework your clients will start asking about

OWASP has released the Top 10 for Agentic Applications 2026, developed with over 100 industry experts. It maps the critical security risks specific to autonomous AI systems — a materially different set of threats from the LLM Top 10. The Cloud Security Alliance simultaneously launched an initiative focused on "Securing the Agentic Control Plane."

This matters because OWASP provides the shared vocabulary that procurement teams, auditors, and CISOs use when scoping security requirements. The LLM Top 10 is already appearing in RFPs and security questionnaires. The Agentic Top 10 will follow within 12 months.

What this means in practice: Read the Agentic Top 10 now, before your clients ask about it. Map it to any AI red-team methodology you're developing. The organisations that can speak fluently to both the LLM and Agentic OWASP frameworks will be significantly ahead of the advisory market.

The Governance Corner

August 2026 — the EU AI Act deadline that organisations are underestimating

The August 2, 2026 enforcement date is now four months away, and the gap between awareness and readiness remains wide.

What becomes enforceable on that date: High-Risk AI system requirements become fully applicable. The European Commission begins formal enforcement. Every EU Member State must have designated its national competent authorities. Transparency obligations — including labelling of AI-generated content — kick in. The GPAI Code of Practice on Transparency of AI-Generated Content is expected to be finalised in May–June 2026, meaning the practical implementation guidance will arrive with very little runway before it becomes mandatory.

The compliance gap to flag to clients: Most organisations know the deadline exists. Fewer have actually assessed whether their AI systems fall into the High-Risk category under Annex III of the Act, and even fewer have started the conformity assessment process. For any client operating AI systems in hiring, credit, education, critical infrastructure, or biometric identification, the August date carries real liability.

A practical entry point: an AI Act scoping exercise that determines risk classification, identifies applicable obligations, and maps those to an ISO 42001 gap analysis. The two exercises share 80% of their evidence base.

Worth reading this fortnight

Priority action for CISOs this fortnight

Map your clients' AI systems against the EU AI Act's Annex III High-Risk categories. Most organisations haven't done this yet. August 2026 is four months away — and the conformity assessment process takes longer than people expect. Start with a scoping exercise. Everything else follows from that.