A fact-based update for security and risk professionals, focused on how AI is reshaping the threat landscape and the defensive stack.

🔐 Core Security Intelligence

1) Google patches Gemini Enterprise flaw that could leak corporate data

What’s new
Google has patched a zero-click vulnerability in Gemini Enterprise that could have led to corporate data leaks inside large language model–powered workflows. The flaw affected how Gemini Enterprise handled certain interactions in enterprise environments, creating an opportunity for sensitive data exposure before the issue was fixed.

Source:
Google Fixes Gemini Enterprise Flaw That Exposed Corporate Data

Why it matters
Many organizations are wiring Gemini Enterprise into document repositories, knowledge bases, and internal SaaS apps. A zero-click flaw in that layer means data can be exposed even when users do nothing obviously risky. This is exactly the kind of control-plane weakness that can silently undermine otherwise well-secured environments, especially where Gemini is used as a front door into multiple systems of record.

Defenses

• Verify the patch is in place and review access scopes. Confirm your Gemini Enterprise tenants and any related integrations are fully updated, then review which connectors, data sources, and scopes you have enabled. If Gemini can see everything, so can an attacker who abuses similar flaws.
• Audit recent high-sensitivity interactions. Where possible, review logs for unusual access to sensitive repositories via Gemini or associated connectors, especially around the time window before and after Google’s fix. Treat unexplained spikes in access as potential incident leads.
• Treat AI orchestration layers as sensitive infrastructure. Make sure Gemini configuration, identity bindings, and connectors are governed through change control, approvals, and periodic review, not left as “set and forget” features owned only by application teams.

Expert insight
GenAI integrations are increasingly acting like new identity and data-aggregation tiers. A flaw there is closer to an IdP or API gateway issue than a simple application bug, and security programs should give it the same level of scrutiny and incident-readiness.

2) Study: 80% of LLM application risks evade traditional code scanners

What’s new
DryRun Security released findings showing that more than 80% of large language model application risks go undetected by traditional AppSec scanners. By testing implementations against the OWASP Top 10 for LLM Application Risks, the team concluded that legacy SAST tools largely miss vulnerabilities such as prompt injection, insecure tool use, and agentic failure modes. They also released a whitepaper and checklist aimed at securing real-world LLM applications.

Source:
DryRun Security Finds Over 80% of Large Language Model Application Risks Go Undetected by Traditional Code Scanners

Why it matters
Most organizations are still relying on their existing AppSec stack to sign off on GenAI features. If those tools cannot see orchestration code, prompt construction, tool-calling patterns, or agent behavior, then they are effectively blind to the places where LLM-specific failures actually occur. This creates a dangerous illusion of coverage: pipelines pass, dashboards are green, but model-driven logic remains untested.

Defenses

• Map where LLM logic lives in your stack. Identify all the places where prompts are built, tools are wired, and model outputs drive decisions. These code paths often sit in glue code, feature flags, and microservices that AppSec has not historically prioritized. Understanding that topology is the first step in closing the gap.
• Introduce LLM-aware security testing in CI/CD. Add AI-native scanners or targeted tests that know how to reason about prompt injection, tool misuse, data leakage via responses, and agent behavior. Treat these as first-class checks in your pipelines, not as occasional experiments.
• Align to OWASP LLM and agentic guidance. Use the OWASP LLM and agentic Top 10 lists as control catalogs, mapping each risk to concrete tests and mitigations in your environment. This aligns engineering, security, and architecture teams on what “good” looks like for GenAI features.

Expert insight
The message is blunt: GenAI security will not be solved by running yesterday’s scanners harder. LLM features change the threat model, so they demand a corresponding shift in how we test, sign off, and continuously monitor those systems.

3) Cisco releases open-source A2A Scanner to secure AI agent networks

What’s new
Cisco introduced the A2A Scanner, an open-source security framework designed to protect autonomous agent networks that use an Agent-to-Agent (A2A) protocol. The scanner validates agent identities, inspects communications, and uses multiple detection engines to catch threats such as trusted-agent spoofing, indirect prompt injection in streams, capability inflation, and agent-driven denial-of-service patterns.

Source:
Securing AI Agents with Cisco’s Open-Source A2A Scanner

Why it matters
As organizations move from single chatbots to fleets of collaborating agents, the attack surface shifts from single prompts to entire agent meshes. Malicious or misconfigured agents can impersonate trusted peers, escalate privileges across the network, or trap others in costly loops. Traditional API security tools were not designed to understand agent cards, A2A protocols, or the semantics of multi-agent workflows, which is exactly what Cisco is targeting here.

Defenses

• Treat agent registries like high-value identity systems. Enforce strict validation and governance for any agent that enters your registry, including metadata quality, declared capabilities, and alignment with your least-privilege principles. Do not allow “experimental” agents to quietly join production meshes.
• Monitor agent-to-agent traffic as a first-class telemetry source. Instrument your A2A layer for spoofing attempts, abnormal privilege requests, loops, and anomalous sequences of calls between agents. Feed this into your SOC the same way you treat unusual lateral movement or API abuse.
• Pilot A2A security controls alongside AI platform rollouts. When you roll out new agent frameworks, include security instrumentation and tools like A2A Scanner from day one, instead of backfilling defenses after agents have already become business critical.

Expert insight
Agent networks are starting to look like a new microservice fabric, but with opaque policies and emergent behaviors. Building an “agent zero trust” posture now will pay dividends as these systems scale and become intertwined with core business workflows.

4) OWASP GenAI Security Project releases Top 10 risks for agentic AI

What’s new
The OWASP GenAI Security Project announced the “OWASP Top 10 for Agentic Applications,” a new risk list focused on autonomous AI agents. The effort synthesizes contributions from over 100 industry participants and highlights threats such as Agent Behavior Hijacking, Tool Misuse and Exploitation, and Identity and Privilege Abuse. The release comes with additional resources including a reference application, an agentic CTF, governance guides, and threat-model-based mitigation documents.

Source:
OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security

Why it matters
Agentic AI introduces distinct risks that do not map cleanly to traditional web or API vulnerabilities. Agents can plan, act, and coordinate across tools and environments, which means issues like prompt injection, tool misuse, and privilege abuse manifest in new ways. A widely recognized Top 10 list gives security and engineering teams a shared language and baseline, similar to the impact the original OWASP Top 10 had on web application security.

Defenses

• Adopt the agentic Top 10 as a design checklist. When building or buying agent-based systems, explicitly review architectures, threat models, and test plans against the OWASP agentic risks. Make this part of the sign-off process, not just a reference document.
• Tie risks to concrete controls and monitoring. For each agentic risk category, define which controls you will use (policy engines, sandboxing, explicit approvals, constrained tools) and what telemetry you will capture to detect failures in production. This bridges the gap between theory and operations.
• Use OWASP’s reference resources for training and exercises. Leverage the CTFs, reference apps, and threat-model documents to run internal workshops and red team exercises focused on agentic systems. This helps teams build intuition about how these failures appear in real life.

Expert insight
We are now seeing the beginnings of a structured body of knowledge for agentic AI security. Organizations that align early with these community-driven standards will have an advantage when regulators, auditors, and customers start asking how agent risks are handled in practice.

⚠️ Updates & Follow-ups

Chrome’s agentic AI security: Google adds a $20K bug bounty on top of layered defenses

What’s new
Following the rollout of its layered security architecture for AI-powered browsing in Chrome, Google has launched a bug bounty program offering up to $20,000 for successful exploits against the new protections. The program focuses on indirect prompt injection and other attacks that could trick Chrome’s Gemini-based agents into taking unauthorized actions or leaking sensitive data.

Source:
Google Offers $20K Bounty for Chrome AI Security Breach

Why it matters
We previously covered Google’s use of a separate “User Alignment Critic” model, origin-gating, and real-time threat detection to constrain agent behavior. Adding financial incentives for researchers to break those controls signals that Google expects creative bypasses and wants them surfaced quickly. For defenders, this is a reminder that even sophisticated layered defenses need continuous external pressure testing.

Action for security teams
If your organization plans to allow or pilot agentic browsing, track the outcomes of this bounty closely and incorporate any disclosed weaknesses into your own risk assessments and compensating controls. Do not assume that vendor-side defenses remove the need for local governance, network controls, and usage restrictions around sensitive workflows.

📊 At-a-Glance Summary

Categories: Cybersecurity News

Tags: Agentic AI, AI Security, AppSec, Bug Bounty, Chrome, Enterprise AI, Gemini, LLM Security, OWASP