Signal criticality: High
What happened: The Hacker News published "Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code". Manifold Security has disclosed eight security flaws across seven command-line AI coding agents in which a repository's own Git configuration names a command that the agent runs on the developer's machine, four of them still unpatched at publication. The command executes as the user, outside the agent's sandbox and without an approval prompt, and exploitation requires the repository to arrive The report describes a concrete compromise, exposure, or abuse pattern with direct defensive implications.
Key takeaways:
Original source: https://thehackernews.com/2026/09/malicious-git-configs-can-make-claude.html
Signal criticality: High
What happened: Help Net Security reported that strong identity governance can make it significantly more difficult for an attacker (AI or human) to turn a compromised account into a larger incident. Mirko Zorz , Director of Content, Help Net Security September 2, 2026 Share National Life Group CISO expects more vulnerabilities in six months than in thirty years In this Help Net Security interview, Becky Palmer is VP and CISO at National Life Group , answers five questions about defending against AI-driven attacks.
Key takeaways:
Original source: https://www.helpnetsecurity.com/2026/09/02/becky-palmer-national-life-group-ai-driven-cyber-threats/
Signal criticality: High
What happened: The Decoder AI reported that astra reproduced these reported errors much less often, with the biggest gains showing up at low latency settings and lower reasoning levels. External testing by security firm Gray Swan, using 1,810 curated attacks from their IPI Arena , found that with 15 attempts per scenario, Astra was cracked at least once 8.5 percent of the time. Anthropic previously reported only a two percent attack success rate based on the easier Q1 test alone, and GPT-5.6 Sol scored just 20 percent there too.
Key takeaways:
Original source: https://the-decoder.com/openais-gpt-6-astra-hallucinates-less-but-remains-vulnerable-to-hidden-prompt-injections/
Signal criticality: High
What happened: Microsoft Security Blog published "ASCII smuggling crosses over from AI prompt injection to phishing evasion". Invisible Unicode characters popularized for hiding instructions from AI models are now being used to obfuscate words before email filters parse them The article focuses on a concrete model, prompt, data, or integration risk with operational security implications. The practical question is what permissions, connected data, or follow-on actions this signal can influence in a real deployed workflow.
Key takeaways:
Original source: https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/
The strongest signal today is that AI security is being decided in the surrounding control layer — permissions, connectors, deterministic workflow design, response speed, and the infrastructure that still underpins trust. That is a more durable framing than generic agent hype, and it is the one worth carrying forward.