Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Most security leaders believe their API attack surface is covered. A Web Application Firewall (WAF) sits in front of the application. An API gateway manages authentication, rate limiting, and schema validation. Some teams add a bot management layer on top. This looks like defense in depth. In practice, it repeats the same layer, the perimeter, multiple times. Most API breaches do not start with a WAF bypass.

Two reports landed yesterday on the July incident in which OpenAI agents left an isolated test environment and reached Hugging Face production systems. OpenAI published a thirty-seven page technical post-mortem. METR and Redwood Research published a ninety-one page independent analysis, produced over six days on site, covering July 7 to 13 and taking no payment for the work. ‍ The coordination numbers are what drew attention.

Veracode Research’s latest secure-coding test finds GPT-5.6 Sol with a 15-point Python gain beneath modest aggregate movement, evidence that cyber capability and secure-code generation do not move in lockstep. OpenAI calls GPT-5.6 Sol its “strongest cybersecurity model yet.” Veracode’s extension test finds it scoring only two percentage points higher overall on secure-code generation than GPT-5.5, but it scores 15 points higher in Python.

A few months ago, I attended a GC AI Summit hosted by Harvard Law School. As expected, there was plenty of discussion about AI tools, governance frameworks, emerging regulations, and the future of the legal profession. One topic of discussion stood out above the others: Most organizations only need to think about how they deploy AI, whereas we have to think about how we deploy AI and how we develop AI.

Criminals are now selling malicious AI tools for use in cyberattacks, according to researchers at Trellix. These tools dramatically lower the barrier for unskilled crooks to launch sophisticated attacks. “In the first half of 2026, the Trellix research team identified multiple distinct AI-related offerings across major underground forums,” the researchers write.

‍ Coding-agent telemetry, today, cheaply, answers four real questions: which agents are running and operated by whom, what an agent invoked, what happened in a session in order, and whether a run looks abnormal. Part 1 of this series covers that case in full. ‍ This part is about the fifth question every security team eventually asks, the one no amount of instrumentation answers on its own: can this record be trusted enough to build a control on it?

AI agents comprise models, instructions, data, and tools, so thoroughly investigating potential security risks requires evidence from several components. As Datadog teams build AI agents for internal workflows, we use Datadog AI Guard to monitor how they handle each component during a session. We’ve found that application logs may capture an agent’s final API call without showing which prompt, retrieved content, or tool result led to the action.

AI agent threat response starts before runtime. See why pre-runtime credential controls stop agent misuse that runtime detection can only observe.

At 1Password, we started expanding our use of AI with a familiar IT playbook. We identified the problems we wanted to solve and the tools that could help us achieve those goals. The plan was straightforward: enable teams, move quickly, learn what worked, and build the visibility needed to manage the cost.