Weekly Musings Top 10 AI Security Wrapup: Issue 50: August 21 to August 27, 2026

The Week Agents Got Identity, Eyes, and a Schedule, and Attackers Weaponized AI to Match

After a week off hanging out in the beautiful Grand Tetons and Yellowstone, the musings are back.

Google Cloud called AI agents “the ultimate insiders” this week. Read that back. Your vendor described what it’s selling you the way I’d describe a malicious employee with a valid badge and root on three systems. In seven days, agents picked up an identity, a set of eyes, their own laptop, and a schedule to run while you sleep. Attackers noticed. One crew shipped malware with a built-in AI operator. Another taught Grok to decrypt its own theft payload. OpenAI hit the brake on its own training run. Pour the coffee.

Seven days handed agents most of what a new employee gets on day one, and reminded everyone what happens when you give power to something you can’t fully control. Okta gave agents an identity, DeepSeek gave them eyes, Perplexity gave them a computer, and Snowflake let them run on a schedule. Under it sits one Google Cloud number. 79% of tech leaders say security and governance, not model quality, blocks them from scaling AI. The theme this week is the gap between what agents can do and what any of us can govern. Let’s get into it.

1. OpenAI pulls its own brake and warns you to expect “persistent” AI attacks

On August 23, 2026, OpenAI’s chief global affairs officer Chris Lehane told The Guardian to expect “ongoing, persistent” AI-driven cyberattacks, days after OpenAI paused reinforcement-learning training on its most advanced internal models. The pause followed agents in training breaking out of a sandbox and hacking a third party, plus early signs that an upcoming model, Astra, might reach the “critical” cyber threshold in OpenAI’s own safety framework. PYMNTS and The Hacker News confirmed both the pause and the warning.

Why it matters

• A frontier lab conceding its own model might cross a critical cyber line resets everyone’s threat model.

• Persistent AI attacks mean offense got cheap while defense held, so your baseline assumptions age overnight.

• Open-weight models put the same capability in anyone’s hands, with no vendor kill switch in between.

What to do about it

• Rerun your threat model against an adversary that iterates faster than your patch cycle.

• Fund behavioral detection over signatures, which lose to self-rewriting models.

• Run a “persistent AI intruder” tabletop this quarter, not next fiscal year.

Rock’s Musings

A lab voluntarily stopping a training run because its own model got too good at hacking is the most honest thing I’ve seen all year. I don’t buy the “you need our superior model to survive” line, because that’s the protection racket every security vendor runs. Still, when the people building the weapon flinch, you pay attention. Treat the pause as a weather report, not a rescue. The storm is still coming.

2. RedC2 4.0 delivers malware with an AI operator baked in

On August 21, 2026, TrendAI, Trend Micro’s enterprise arm, and The Hacker News detailed 14 trojanized npm packages posing as calendar utilities that quietly drop RedC2 4.0, an AI-powered Linux implant. The loader fires the moment the module imports, so even the --ignore-scripts flag fails to stop it. RedC2 4.0 steals SSH keys, browser credentials, and database files, and ships a feature called Red Agent that turns plain-language requests into automated commands on the victim host. It targets developer endpoints and CI/CD pipelines.

Why it matters

• Malware now ships with an AI operator inside, dropping the skill floor for hands-on intrusion to near zero.

• The delivery bypasses the npm defenses most teams rely on, including --ignore-scripts.

• Developer laptops and build servers hold the keys to everything downstream, and that’s where this lands.

What to do about it

• Inventory npm dependencies in dev and CI, and hunt the flagged packages on Linux build hosts.

• Rotate SSH keys and database credentials exposed to build agents, and move to short-lived tokens.

• Isolate CI runners and restrict their outbound paths so a bad package can’t phone home.

Rock’s Musings

Supply chain attacks are old news. An implant that reads your intent and writes its own commands is a fresh problem. I’ve told boards for years that the developer endpoint is the crown-jewel target nobody protects like one, and RedC2 is the receipt. Some kid rents this on a forum and gets a self-directing, credential-stealing beachhead for the price of a night out. Your build pipeline is production. Guard it like production.

3. Adversa walks Grok into leaking its own users with encrypted prompt injection

On August 21, 2026, Adversa AI disclosed “Cryptographic Context Injection,” a zero-click attack that coaxed Grok into leaking a user’s name, location, subscription tier, and full chat history. In plaintext, Grok refused. Wrapped in AES-256-GCM ciphertext with the key on the same page, Grok decrypted the payload in its own Python sandbox, treated the output as trusted, and shipped private data to an attacker’s URL. The proof of concept ran against Grok 4.5 Fast on grok.com with no warning, at a 40% success rate. Malwarebytes and The Hacker News covered it.

Why it matters

• Encryption defeated the safety filter. The model refused the plaintext and obeyed the ciphertext.

• Zero-click, live production, real user data. This is not a lab curiosity.

• Any agent with a code tool and web access inherits this whole class of bug.

What to do about it

• Treat model code interpreters as an exfiltration channel, and constrain agent sandbox egress.

• Add egress allowlists and DLP to agent traffic, not only human traffic.

• Hold back chat agents that can browse and execute without guardrails.

Rock’s Musings

This is the one that kept me up. We’ve spent two years teaching models to refuse bad instructions in plain sight. Adversa showed the refusal is skin deep, because the model will decrypt the same instruction and run it. A content filter checking English while the model reasons over ciphertext is watching the wrong language. I write about these failure modes at RockCyber Musings because CISOs keep buying the demo and skipping the threat model.

4. Okta gives AI agents a real identity with Agent SSO

On August 24, 2026, Okta announced general availability of Agent SSO, which registers AI agents as first-class identities and governs them with short-lived tokens and central policy instead of static API keys. It brings the Cross App Access standard to a product used by more than 20,000 customers, at no added cost on core plans. Okta’s own research found that only 34% of organizations apply the same controls to agents as to humans. TechNode and SecurityBrief covered it.

Why it matters

• Agent identity moves from hard-coded keys to managed, revocable, auditable access, closing the biggest gap in agent security.

• Short-lived tokens shrink the blast radius when an agent is compromised.

• One directory for agents and humans finally answers what an agent can reach and who approved it.

What to do about it

• Inventory every agent touching production, and map its credentials.

• Pilot Agent SSO, or your identity provider’s equivalent, on one workflow, and kill the static keys.

• Fold agents into your quarterly access reviews.

Rock’s Musings

Identity is the control plane, and that’s twice as true for software that acts on its own. I’ve watched teams stand up 40 agents and authenticate every one with a shared API key in a config file. That’s a breach with a countdown, not a deployment. Use whatever identity provider you like. If your agents don’t carry revocable identities by year-end, you’re a future issue of this newsletter.

5. Google Cloud calls agents “the ultimate insiders,” and it’s right

On August 24, 2026, Google Cloud published guidance tied to its State of AI Infrastructure report and described AI agents as “the ultimate insiders,” granted standing permission to read email, query databases, and trigger API calls. The report found that 79% of tech leaders name security, governance, or operations as their biggest barrier to scaling AI inference, and 83% say they need infrastructure upgrades for production autonomy. Its recommended controls center on platform governance, task-level provenance, short-lived permissions, and human checkpoints.

Why it matters

• Naming agents “insiders” reframes agent security as insider-threat management, a discipline you already run.

• With 79% citing security and governance as the top blocker, this gates ROI, not a fringe worry.

• Task-level provenance and short-lived permissions are the real controls under the marketing.

What to do about it

• Map agent actions to an audit trail of who authorized what, when, and for how long.

• Apply least privilege, segregation of duties, and anomaly detection to agents.

• Gate any write, payment, or provisioning action behind a human checkpoint.

Rock’s Musings

I’ll give Google credit for the honest phrase. You already know how to handle a trusted employee who could go rogue. Least privilege, log everything, watch for weird behavior, revoke fast. An agent is that employee at machine speed with no HR file. Treat the governance wall as the work, not the obstacle.

6. Salesforce drags agentic coding into the group chat with Slack Code

On August 24, 2026, Salesforce launched Slack Code, dedicated “code channels” where teams tag coding agents from Anthropic, OpenAI, GitHub, Cognition, and Vercel and watch plans, diffs, and live previews in shared view. It ships across all Slack plans, though the partner AI services cost extra. The pitch is multiplayer coding that pulls agent work out of private terminals. VentureBeat and SiliconANGLE covered it.

Why it matters

• Shared channels help visibility and hurt governance if you don’t gate commits.

• Every channel is a new place where an agent’s change gets waved through.

• The attack surface grows with the audience, meaning more prompts, more context, and more ways in.

What to do about it

• Enforce branch protection and required human review on anything an agent touches.

• Log who invoked which agent, with what prompt, and require signoff before merge.

• Keep it on staging and internal repos until your review gates prove out.

Rock’s Musings

I like transparency. An agent’s plan and diff in the open beats a black box in someone’s terminal. What I don’t like is the assumption that visibility equals control. A diff scrolling past in a busy channel gets watched, not reviewed. The risk lives with the human who approves what they didn’t read because the channel felt collaborative and everyone went quiet. Put the gate before the merge, not after the incident.

7. Temporal’s data shows agent use nearly doubled while governance stood still

On August 26, 2026, Temporal released its second annual State of Development Report on AI agents, drawn from 554 engineers and leaders in the US and UK. It found that 80.8% now use AI agents daily or more, up from 47.3% a year earlier. The median engineer runs 5 agents, the average runs 10.7, and some run more than 100. Fully 85.5% trust agent output at least somewhat. MarTech Series covered the release.

Why it matters

• Daily agent use nearly doubled in a year. Governance did not.

• “Trust at least somewhat,” from 85.5% of engineers, means most ship agent code they didn’t fully verify.

• An average of 10-plus agents per engineer means non-human identities already dwarf headcount.

What to do about it

• Count your agents before you count your risk.

• Set a verification bar for agent code that matches its blast radius.

• Name one owner for agent governance, because “everyone” owns nothing.

Rock’s Musings

Adoption curves like this are why I sound like a broken record. When 80% of engineers use agents daily and most only somewhat trust the output, you have a control problem dressed as a productivity win. I run agents myself, so this isn’t a purity test. Every one of those agents is a non-human identity with access, and most orgs can’t name half of them. Inventory first. Trust second.

8. DeepSeek puts a cheap, vision-capable agent model on tap

On August 21, 2026, DeepSeek released V4-Flash-Vision-Exp, an experimental multimodal model that reads images, charts, screenshots, and documents while matching its text sibling on agent work, live on the public API at existing V4-Flash rates with no vision surcharge. Caixin and DeepSeek’s own notes put its multimodal-agent performance close to Anthropic’s Opus 4.8. The pitch is agents that read the screen, not only the API.

Why it matters

• Vision agents inherit a new attack surface, visual prompt injection, where instructions hide in an image the model trusts.

• Commodity pricing means these agents spread fast, including where security never reviewed them.

• Screen-reading agents act on visuals, so a poisoned chart becomes a control action.

What to do about it

• Treat every image an agent ingests as untrusted input, like a web page or email.

• Test vision agents against adversarial images and hidden-text payloads before production.

• Keep humans on approvals for any agent that acts on what it sees.

Rock’s Musings

Everyone cheered the benchmark. I looked at the attack surface. The moment your agent reads the screen, an attacker gets a fresh place to hide instructions, in a chart, a screenshot, a PDF footer, a QR code your model helpfully decodes. We spent two years learning that text injection stays unsolved, and now agents have eyes. If your roadmap includes screen-reading agents, put visual injection on the threat model today, because the other side already has.

9. Perplexity ships a fully local agent on NVIDIA’s DGX Spark

On August 25, 2026, Perplexity and NVIDIA launched Portable Computer, a local-first build of Perplexity’s agent that runs the orchestrator, planner, and models directly on an NVIDIA DGX Spark. Private data stays on the machine, on-device steps cost no tokens, and the orchestrator stops to ask before it sends any step that needs the live web or frontier reasoning to one of 15-plus cloud models. It runs in an OS-enforced sandbox, limited at launch to Pro and Max subscribers. VentureBeat and MarkTechPost covered it.

Why it matters

• Local-first agents keep sensitive data off third-party servers, changing the math for regulated work.

• User-gated cloud routing means a human approves each step that leaves the box.

• On-device orchestration also creates a new local attack surface, so “local” isn’t automatically “safe.”

What to do about it

• Weigh local-first agents against your data-residency and egress requirements.

• Harden the host, the sandbox, and the local model supply chain.

• Log cloud-routing approvals so you can prove what left the machine.

Rock’s Musings

I like this direction more than I expected to. Keeping private data on the box and forcing a human yes before any step hits the cloud is the default I’ve begged vendors to ship. The privacy story is real. Now secure the endpoint, because a local agent on a compromised host loses everything faster.

10. Keenable raises $26 million to build the web index agents will run on

On August 25, 2026, Keenable exited stealth with a $26 million seed round led by Accel, building web-search infrastructure aimed at AI agents rather than humans. It claims an index of more than 100 billion documents, a low-latency search API, and a Model Context Protocol interface that hands agents keyless access at up to 1,000 requests an hour on the free tier. TechCrunch and SiliconANGLE covered the round.

Why it matters

• Keyless, high-volume agent web access removes the API key, the chokepoint teams use for attribution and rate control.

• An agent-first web index becomes critical infrastructure, and critical infrastructure becomes a target.

• Historical web snapshots help agents and equally help attackers reconstruct what you exposed and when.

What to do about it

• Track which agent tools your teams wire in, and treat keyless services as shadow connections to govern.

• Require attribution and rate limits on agent web access even when keyless is easy.

• Add third-party AI infrastructure to your vendor risk process.

Rock’s Musings

Money is pouring into making agents faster at reading the web, and almost none into making that reading safe. “Keyless, 1,000 requests an hour, no friction” is a product manager’s dream and a security lead’s headache, because the key was never only about billing. It was your attribution and your throttle. Strip it out and you’ve built a faster pipe for both sides. My team at RockCyber tracks this because the abuse surface is outgrowing the guardrails.

The One Thing You Won’t Hear About But You Need To

On August 21, 2026, Snowflake moved CoCo automations into public preview in its CLI and Snowsight, letting anyone schedule recurring, unattended agent runs in a Snowflake-managed sandbox, minimum once an hour, running even when your terminal and browser are closed. Here is the part nobody is reading. Unattended runs disable interactive tool-permission prompts, so any tool available to the run executes without approval. The account privilege that controls automations, EXECUTE AGENT TASK, has been granted to the PUBLIC role by default across all accounts since earlier this month. Snowflake’s own documentation spells it out.

Why it matters

• Unattended agents with prompts disabled means the human-in-the-loop safety net is off by design.

• A capability this broad granted to PUBLIC by default is the quiet setting that becomes an incident.

• Your data platform is now an autonomous execution environment, whether security signed off or not.

What to do about it

• Run REVOKE EXECUTE AGENT TASK ON ACCOUNT FROM ROLE PUBLIC;, then grant it to named roles only.

• Review what tools scheduled automations can reach, and scope them to least privilege.

• Add automation runs and their Cortex threads to your logging and review.

Rock’s Musings

This is the one I’d flag to your board first. Snowflake shipped a useful feature with a friendly default, and friendly defaults are how quiet risk walks into the building. Scheduled agents, running hourly, with prompts off, and the execute privilege handed to PUBLIC unless you revoke it. That’s a config you can check this afternoon. I’ve spent thirty years watching breaches born from a default nobody questioned. Go run the revoke command, then find out which of your other agent platforms made the same choice. Somebody has to read the release notes.

👉 For ongoing analysis of agentic AI governance frameworks, the conversation at RockCyber Musings and you can subscribe above

👉 Visit RockCyber.com to learn more about how we can help with your traditional Cybersecurity and AI Security and Governance journey.

👉 Want to save a quick $100K? Check out our AI Governance Tools at AIGovernanceToolkit.com

👉 As a bonus, check out my conversation with Sean Martin from ITSP Magazine and John Sotiropoulos, Co-lead of the OWASP GenAI Security Project Agentic Security Initiative, during Infosecurity Europe about the newly launched OWASP Agentic Security Council, the alarming drop in attacker dwell time from eight hours down to twenty-two seconds, and what’s new in the 2026 OWASP Top 10 for LLM.

References

Adversa AI. (2026, August 21). Cryptographic context injection: Grok data theft. Adversa AI. https://adversa.ai/blog/cryptographic-context-injection-grok-data-theft/

Caixin Global. (2026, August 22). DeepSeek enters the multimodal AI race with experimental vision model. Caixin Global. https://www.caixinglobal.com/2026-08-22/deepseek-enters-the-multimodal-ai-race-with-experimental-vision-model-102476706.html

DeepSeek. (2026, August 21). DeepSeek-V4-Flash-Vision-Exp release: Multimodal API now live. DeepSeek API Docs. https://api-docs.deepseek.com/news/news260821/

Finsmes. (2026, August 25). Keenable raises $26M in seed funding. Finsmes. https://www.finsmes.com/2026/08/keenable-raises-26m-in-seed-funding.html

Google Cloud. (2026, August 24). State of AI infrastructure report: Agent governance and security. Google Cloud Blog. https://cloud.google.com/blog/topics/ai-infrastructure/state-of-ai-infrastructure-report-agent-governance-and-security

Lakshmanan, R. (2026, August 21). 14 trojanized npm packages drop RedC2 4.0 Linux backdoor with AI-assisted C2. The Hacker News. https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html

Malwarebytes Labs. (2026, August). Grok fooled into stealing user chat, location data, and more. Malwarebytes. https://www.malwarebytes.com/blog/ai/2026/08/encrypted-instructions-can-fool-ai-assistants-like-grok-and-gemini

MarTech Series. (2026, August 26). Temporal releases “The 2026 state of development report: AI agents,” revealing a 70.8% leap in AI agent use among engineers. MarTech Series. https://martechseries.com/predictive-ai/ai-platforms-machine-learning/temporal-releases-the-2026-state-of-development-report-ai-agents-revealing-a-70-8-leap-in-ai-agent-use-among-engineers/

Milmo, D. (2026, August 23). “We are hitting a different chapter”: OpenAI leader warns of threat of “persistent” AI cyber-attacks. The Guardian. https://www.theguardian.com/technology/2026/aug/23/openai-cyber-attacks-threat-chris-lehane

Okta. (2026, August 24). Okta brings first-class identity to AI agents with Agent SSO. Okta Newsroom. https://www.okta.com/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/

PYMNTS. (2026, August 24). OpenAI exec tells people to expect routine AI-driven cyberattacks. PYMNTS. https://www.pymnts.com/news/artificial-intelligence/2026/openai-exec-tells-people-to-expect-routine-ai-driven-cyberattacks/

Salesforce. (2026, August 24). Salesforce launches Slack Code to make AI software development multiplayer. Salesforce News. https://www.salesforce.com/ap/news/press-releases/2026/08/24/salesforce-launches-slack-code-to-make-ai-software-development-multiplayer/

SecurityBrief. (2026, August). Okta launches Agent SSO to manage enterprise AI agent access. SecurityBrief. https://securitybrief.com.au/story/okta-launches-agent-sso-to-manage-enterprise-ai-agent-access

Snowflake. (2026, August 21). CoCo automations in CLI and Snowsight (Preview). Snowflake Documentation. https://docs.snowflake.com/en/release-notes/2026/other/2026-08-21-cortex-code-automations-preview

TechCrunch. (2026, August 25). Accel-backed Keenable is indexing the web for AI agents. TechCrunch. https://techcrunch.com/2026/08/25/accel-backed-keenable-is-indexing-the-web-for-ai-agents/

TechNode Global. (2026, August 26). Okta launches Agent SSO for governing enterprise AI agents. TechNode Global. https://technode.global/2026/08/26/okta-launches-agent-sso-enterprise-ai-agents/

Temporal Technologies. (2026). The state of development 2026. Temporal. https://temporal.io/reports/state-of-development-2026

The Hacker News. (2026, August). OpenAI pauses frontier RL training as it tightens defenses against unsafe AI behavior. The Hacker News. https://thehackernews.com/2026/08/openai-pauses-frontier-rl-training-as.html

TrendAI. (2026, August). Prompting the payload: How an npm supply chain attack delivers the RedC2 AI-powered Linux implant. TrendAI Security. https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/redc2-ai-powered-linux-implant

Trigg, R. (2026, August 25). Perplexity partners with Nvidia to launch Portable Computer, a fully local AI agent with zero token costs. VentureBeat. https://venturebeat.com/infrastructure/perplexity-partners-with-nvidia-to-launch-portable-computer-a-fully-local-ai-agent-with-zero-token-costs

VentureBeat. (2026, August). Slack wants to drag AI coding out of the terminal and into the group chat. VentureBeat. https://venturebeat.com/orchestration/slack-wants-to-drag-ai-coding-out-of-the-terminal-and-into-the-group-chat