A fact-based update for security and risk professionals, focused on how AI is reshaping the threat landscape and the defensive stack.

🔐 Core Security Intelligence (AI-Focused)

1) Radware details “ZombieAgent,” a zero-click indirect prompt injection class that can persist via agent memory

What’s new
Radware published a threat alert describing “ZombieAgent,” a class of zero-click indirect prompt injection attacks where hidden instructions embedded in untrusted content (email, documents, web pages) can drive service-side agent actions. The alert emphasizes the risk of memory manipulation, where malicious logic can be implanted so the agent behaves like a persistent insider, potentially exfiltrating data and propagating to other targets.

Source:
ZombieAgent: The Agentic Revolution Comes with Malicious Gifts

Why it matters
Agentic AI expands the attack surface beyond prompts to include the content an agent reads and the tools it can invoke. If execution happens inside the provider’s infrastructure, classic enterprise controls (endpoint telemetry, proxies, network DLP) may have limited visibility, which raises the premium on permission scoping, input handling, and auditing.

How this could be abused
An attacker can seed malicious instructions in seemingly benign content that a user later asks the agent to process (for example, “summarize this email thread” or “review this document”). If the agent has access to sensitive repositories or mailboxes, the injected instructions can steer it to extract and leak data, and if memory is influenced, the behavior can persist across future sessions.

Defenses

• Constrain agent permissions by default. Treat agents as privileged non-human identities with least-privilege scopes per tool and per dataset. Separate “read” from “act” capabilities so content ingestion does not automatically imply execution rights.
• Sanitize and normalize untrusted inputs. Convert inbound HTML and rich documents into safe text representations before agents process them, and strip hidden content and scripting-like constructs. Make content transformation a required control for high-risk sources like inbound email and external documents.
• Instrument agent actions end-to-end. Log tool calls, data retrieval, external requests, and memory writes, then alert on behavior that deviates from user intent (bulk reads, repeated extraction patterns, link-following bursts). Ensure your incident response team can reconstruct what the agent accessed and why.

Expert insight
The strategic shift is simple: agents turn “content” into “code-like influence.” If you do not control what the agent can read, what it can do, and how it records memory, you should assume prompt injection becomes an operational risk rather than a theoretical one.

2) IBM’s coding agent “Bob” shown to be susceptible to prompt injection that can lead to malware execution

What’s new
The Register reported on IBM’s coding agent “Bob,” highlighting research that demonstrates how prompt injection can bypass guardrails and cause unsafe command execution behavior in development workflows.

Source:
IBM’s AI agent Bob easily duped to run malware

Why it matters
Coding agents sit in high-trust contexts: repositories, build systems, package managers, and developer endpoints. If an agent can be influenced to run unsafe commands or introduce malicious changes, it becomes a supply chain accelerant with a short path to production impact.

How this could be abused
An attacker can embed malicious instructions in code comments, issues, documentation, or dependency metadata that the agent is asked to “review” or “fix.” The agent may then propose or execute risky actions such as pulling hostile dependencies, running curl | sh patterns, modifying CI scripts, or weakening security checks.

Defenses

• Require explicit human approval for execution paths. Enforce a “propose-only” mode for agents in most environments, with separate, audited approval steps before any command execution or pipeline change. Align this to privileged access management concepts for non-human actors.
• Lock down what the agent can touch. Limit filesystem access, network egress, and credential exposure on developer workstations and CI runners. Use allowlisted tooling and disable direct shell execution unless the workflow is tightly controlled.
• Add guardrails at the pipeline layer, not only the agent layer. Use signed commits, mandatory code review for CI changes, dependency pinning, and build isolation to prevent a single influenced suggestion from becoming a production compromise.

Expert insight
Agent safety is not just prompt filtering. The control plane is permissioning, change control, and build hygiene, because those are the layers that decide whether a bad suggestion becomes an executed action.

3) Unit 42 says criminals are likely “vibe coding” malware, with defenders benefiting from detectable mistakes

What’s new
The Register reported commentary from Palo Alto Networks Unit 42 indicating that malware development may increasingly involve AI-assisted “vibe coding.” The piece notes that AI-generated artifacts can include mistakes, which may create detection opportunities.

Source:
Are criminals vibe coding malware? All signs point to yes

Why it matters
AI reduces time-to-capability for lower-skilled actors and can increase the volume of commodity threats. Even if the output is imperfect, scale changes defender workload and can stress response processes, especially for phishing, loader variants, and “good-enough” automation.

How this could be abused
Attackers can iterate quickly on malware variants, scripts, and lures, then test and refine against common defenses. They can also use AI to generate credible social engineering pretexts and tailor payload delivery chains per victim environment.

Defenses

• Hunt for AI-era “fingerprints,” but do not overfit. Use detection engineering to find recurring template artifacts, odd phrasing in ransom notes, and structural similarities in scripts, while assuming adversaries will improve quickly. Treat this as a short-lived advantage.
• Increase friction at common execution points. Tighten application allowlisting, script control, and macro policies, and validate that EDR is blocking common living-off-the-land abuse. The goal is to prevent rapid iteration from translating into rapid success.
• Operationalize fast containment. Since volume may rise, ensure your triage, isolation, and credential reset workflows are efficient and tested. Speed is the primary counter to scaled adversary experimentation.

Expert insight
The near-term risk is not that AI produces “perfect” malware. It is that it produces more malware. Your security program should assume higher attempt volume and invest in automation and containment discipline accordingly.

4) OpenAI launches ChatGPT Health with a segregated privacy model for sensitive health conversations

What’s new
OpenAI announced “ChatGPT Health,” a dedicated space for health-related conversations with enhanced privacy controls. OpenAI states that Health operates as a separate space, and that conversations in Health are not used to train foundation models.

Source:
Introducing ChatGPT Health

Why it matters
This is a notable pattern for AI security and privacy engineering: segmentation of sensitive-use workflows, distinct data handling, and explicit training boundaries. For risk teams, it is also a reminder that new AI features often expand data ingestion paths, increasing the importance of governance and user education.

How this could be abused
Attackers may pivot to targeting health-adjacent accounts and devices knowing that users may centralize sensitive records and wellness data in one workflow. Separately, organizations may see employees using health-focused tools on managed devices, increasing the likelihood of sensitive data appearing in logs, screenshots, or shared channels.

Defenses

• Update acceptable-use guidance for sensitive AI workflows. Provide clear direction on when employees may use consumer AI features and what data is prohibited on corporate devices. Align this to privacy and data classification so controls match your risk posture.
• Reduce data exposure through device and browser controls. Enforce managed browser policies, limit risky extensions, and apply endpoint protections that reduce clipboard and screen-capture leakage. Treat health-related data as high sensitivity where it touches corporate endpoints.
• Clarify retention, legal, and audit implications. Ensure teams understand what can be deleted, what may be retained, and what may be subject to lawful requests. Governance is a control, not an afterthought, when user behavior changes.

Expert insight
Feature segmentation is a strong design signal, but security teams still need operational controls around endpoint risk and user behavior. The model provider’s privacy posture does not neutralize compromise of the user’s device or browser.

🧭 Adjacent Cybersecurity Developments (Context for AI Risk)

5) CISA adds two vulnerabilities to the KEV catalog based on evidence of active exploitation

What’s new
CISA issued an alert that two vulnerabilities were added to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation, with required remediation timelines for federal agencies and strong patch guidance for everyone else.

Source:
CISA Adds Two Known Exploited Vulnerabilities to Catalog

Why it matters
AI services rarely fail in isolation. Identity systems, management planes, and exposed enterprise apps are still the most common entry points, and exploitation here can lead directly to compromise of AI datasets, agent credentials, and adjacent cloud resources.

Defenses

• Treat KEV as a board-level operational metric. Maintain a living view of internet-facing exposure and remediation status, and use KEV as a forcing function for patch priority. Where patching is slow, require compensating controls and documented risk acceptance.
• Validate containment assumptions for AI workloads. Ensure exploited assets cannot reach AI data stores, model hosting, or orchestration layers. Segmentation and egress controls should assume breach, not ideal behavior.
• Add compromise checks to patching workflows. For KEV items, pair remediation with targeted hunting for IOC patterns and suspicious access. Patch completion without compromise assessment is an incomplete control when exploitation is active.

Expert insight
KEV is the practical intersection of “what matters” and “what is happening.” If you are defending AI systems, KEV hygiene is a foundational control because attackers will use the easiest door, not the most novel one.

6) Coolify discloses multiple critical flaws that could enable auth bypass and remote code execution on self-hosted instances

What’s new
The Hacker News reported on disclosures affecting Coolify, an open-source self-hosting platform, where multiple critical vulnerabilities could result in authentication bypass and remote code execution on self-hosted deployments.

Source:
Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances

Why it matters
Self-hosting platforms often sit close to the same assets AI teams depend on: containers, secrets, internal dashboards, and deployment automation. A compromise in the self-hosting layer can become a pivot point into AI workloads, data pipelines, and CI/CD.

Defenses

• Patch fast, then verify. Apply updates promptly and confirm the vulnerable components are actually upgraded across environments. Follow up with access log review and integrity checks to ensure the platform was not already abused.
• Reduce blast radius with secrets hygiene. Rotate exposed credentials, move secrets into a vault-backed workflow, and eliminate static tokens where possible. Treat platform compromise as “assume secrets touched” unless proven otherwise.
• Harden self-hosting platforms like production control planes. Restrict administrative interfaces, require strong authentication, limit network exposure, and add monitoring for admin actions. These platforms are not “dev tools”; they are operational infrastructure.

Expert insight
The AI era is increasing the number of internal services that look like “developer conveniences” but behave like control planes. Anything that deploys, hosts, or brokers access should be governed like production infrastructure.

📊 At-a-Glance Summary

Categories: Cybersecurity News

Tags: Agentic AI, AI Security, DevSecOps, KEV, Non-Human Identities, Prompt Injection, Supply Chain, Vulnerability Management