Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

salt security

Top Security Risks of AI Agents

Jul 30, 2026 By Michael Callahan In Salt Security
AI agents are rapidly moving from experimental projects into everyday business operations. Unlike traditional AI systems that generate content or answer questions, AI agents can take action. They can call APIs, access applications, retrieve data, execute workflows, and make decisions with limited human intervention. That shift is creating a new security challenge for enterprises.
Read Post
appsentinels

MCP Prompt Injection: How Attackers Hijack AI Agent Workflows Through MCP Tool Calls

Jul 29, 2026 By AppSentinels In AppSentinels
Prompt injection in a standard LLM interaction produces bad output. The model says something it shouldn’t. The damage stays contained to text. Prompt injection in an MCP environment is a different problem. Agents built on the Model Context Protocol don’t just generate responses. They call tools. They write files, query databases, send emails, execute code, invoke APIs.
Read Post

Demo Observe What Your AI Is Actually Doing

Jul 28, 2026 By Wallarm In Wallarm
Security teams are receiving more alerts tied to AI workloads, but most miss the runtime context needed to understand what happened, why it happened, and whether it violated policy. AI visibility cannot stop at deployment and configuration. Join this live demo session to see how Wallarm AI Hypervisor helps teams understand what AI workloads are actually doing at runtime inside Kubernetes environments. The session focuses on giving security teams clearer operational context around AI behavior, outbound activity, sensitive data exposure, and user-driven actions across AI systems.
View Video

The EU AI Act: Compliance for Companies Serving the EU Market

Jul 28, 2026 By Salt Security In Salt Security
The EU AI Act is a global business issue. Just like GDPR before it, it reaches beyond EU borders. If your organization does business in the EU, you are in scope. Full enforcement begins August 2, 2026, with fines of up to 35 million euros or 7% of global turnover for non-compliance.
View Video
appsentinels

Best API Discovery Tools for Lineage Mapping

Jul 28, 2026 By AppSentinels In AppSentinels
API discovery has become a foundational capability for modern enterprises as API ecosystems expand across cloud-native applications, microservices, SaaS integrations, partner APIs, and AI-powered workflows. By 2027, 78% of applications are expected to use APIs, and with that growth comes an urgent need for visibility that goes far beyond simply listing endpoints.
Read Post
Why Cybersecurity Is Becoming Critical for Crypto Market Infrastructure

Why Cybersecurity Is Becoming Critical for Crypto Market Infrastructure

Jul 28, 2026 By SecuritySenses In SecuritySenses
Digital asset markets have developed quickly, but their long-term growth depends on more than trading volume or market interest. As crypto becomes more connected to institutional finance, payment systems, fintech platforms, and treasury operations, the infrastructure behind these markets is coming under greater scrutiny. Speed and liquidity matter, but so do security, resilience, access control, and operational transparency.
Read Post
wallarm

Lessons from the OpenAI and Hugging Face Incident: When Safety Filters Disarm the Defender

Jul 27, 2026 By Wallarm In Wallarm
In July 2026, an OpenAI model escaped its evaluation sandbox and broke into Hugging Face's production infrastructure. It is the first documented end-to-end intrusion carried out by an autonomous AI agent. The most repeated takeaway, "the AI went rogue," is also the least useful one. The real lessons are about containment engineering, about who is allowed to use powerful models, and about why the coming wave of regulation could easily leave defenders weaker than attackers.
Read Post
salt security

The Hugging Face Incident Proved the Real AI Risk Is in the Action Layer

Jul 24, 2026 By Roey Eliyahu In Salt Security
Last week, an AI system crossed a line many still considered theoretical. During an internal cybersecurity evaluation, OpenAI tested a combination of models, including GPT-5.6 Sol and a more capable pre-release model, on ExploitGym, a benchmark that measures whether agents can turn software vulnerabilities into working exploits. The models were run with reduced cyber refusals and without the production classifiers normally used to prevent high-risk cyber activity.
Read Post
salt security

Understanding the Importance of MCP Security

Jul 23, 2026 By Michael Callahan In Salt Security
AI agents are moving from experiments into production workflows, and the Model Context Protocol (MCP) is becoming the connective layer that enables those agents to access enterprise data, applications, APIs, repositories, and automation tools. That makes MCP powerful, but also security-critical. As organizations adopt agentic AI, they need to understand not only how MCP improves connectivity but also how it creates new visibility, governance, and attack-surface challenges.
Read Post
appsentinels

The Abbott Cyber Incident Reveals Why Infrastructure Security Is No Longer Enough for Healthcare

Jul 22, 2026 By AppSentinels In AppSentinels
Healthcare has spent years strengthening its infrastructure against ransomware, patching vulnerabilities, deploying endpoint detection, and implementing zero-trust architectures. Yet, attackers continue to find new ways to compromise healthcare organizations.
Read Post
appsentinels

When AI Agents Run Healthcare Workflows, Business Logic Becomes the New Attack Surface

Jul 21, 2026 By AppSentinels In AppSentinels
Healthcare has moved well past pilot projects. AI agents now triage support tickets, draft clinical documentation, manage patient engagement, and coordinate care across systems that were never designed to talk to autonomous software. Autonomous systems can now analyze data, make decisions, trigger actions, and coordinate across clinical systems with minimal human oversight.
Read Post
How I'd Plug the MiniMax M3 API Into a Coding Agent Without Rebuilding the Stack

How I'd Plug the MiniMax M3 API Into a Coding Agent Without Rebuilding the Stack

Jul 20, 2026 By SecuritySenses In SecuritySenses
Every time a promising new model shows up, I run through the same mental math before getting excited: how much of my existing agent setup survives the swap, and how much do I have to tear out and rebuild just to try it. Most of the time the answer is "more than I'd like," which is exactly why I ignore half the models that cross my feed. MiniMax M3 is one of the rare ones where the answer turned out to be "almost none of it," and it's worth walking through why, because the reasoning applies beyond just this one model.
Read Post
appsentinels

The Agentic Attack Surface Is Growing Faster Than Your API Inventory. Here's How to Catch Up

Jul 17, 2026 By AppSentinels In AppSentinels
Ask any security leader how many APIs their organization runs, and you’ll usually get a confident number. Ask them how many of those APIs are actually being called by an AI agent, a copilot, or an automated workflow right now, and the confidence tends to disappear. That gap is the problem. APIs have always outpaced the inventories built to track them; new services ship every sprint, integrations get added without a ticket, and old endpoints get deprecated without ever being switched off.
Read Post
appsentinels

The Agentic Attack Surface Is Growing Faster Than Your API Inventory

Jul 17, 2026 By AppSentinels In AppSentinels
Ask any security leader how many APIs their organization runs, and you’ll usually get a confident number. Ask them how many AI agents are operating in their environment right now, what those agents are deciding to do, and which APIs they’re calling to do it, and the confidence tends to disappear.
Read Post
miniorange

SCIM & REST API Provisioning for Jira and Confluence

Jul 17, 2026 By Pallavi Narang In miniOrange
Wouldn't it be great if managing user accounts didn't take hours of manual effort? For many IT teams, unfortunately, that's exactly the reality. Every new employee needs access for all the apps they intend to use. When someone switches roles, permissions need updating. And when someone leaves, all their access needs to be revoked immediately. These tasks might sound simple, but they become exponentially more challenging as your company grows.
Read Post
datadog

Monitor Apigee X API traffic and security with Datadog

Jul 15, 2026 By Datadog In Datadog
Apigee X is Google Cloud’s API management platform. Software and platform teams use it to secure, publish, and govern the APIs that internal services, partners, and external developers depend on. Apigee X sits in the request path for that traffic, so a latency spike or a rise in policy errors reaches API consumers before most other signals do. Watching proxy traffic, latency, and security posture usually means jumping between Apigee analytics and separate infrastructure tools.
Read Post
appsentinels

MCP Data Exfiltration: How AI Agents Leak Sensitive Data Through MCP Tool Calls

Jul 14, 2026 By AppSentinels In AppSentinels
Model Context Protocol (MCP) is what turns an AI assistant into an AI agent. It’s the standardized bridge that lets models call real tools – read files, query databases, send messages, pull emails. That capability is the whole point. It’s also what makes MCP environments a target. Most deployments were scoped for what the agent needed to do. Not for what happens when that access is turned against the organization.
Read Post

Demo Discover Enterprise AI Workloads Running on AWS

Jul 14, 2026 By Wallarm In Wallarm
AI workloads are appearing across AWS environments faster than most teams can inventory them. New APIs, EKS clusters, model integrations, and AI services are showing up across accounts and regions without a clear ownership trail or centralized visibility. By the time security catches up, the environment has already changed again.
View Video
appsentinels

Two Months After PocketOS: What a 9-Second Database Deletion Taught Us About Agentic AI Security

Jul 13, 2026 By AppSentinels In AppSentinels
Nine seconds. One API call. A car rental software company’s production data was gone. That’s the headline from the PocketOS incident, and it’s the reason this story spread across engineering and security circles the way it did in late April. Two months later, the incident is no longer breaking news. But it hasn’t aged out of relevance; it has aged into a pattern.
Read Post
wallarm

AI Control Platform vs. AI Firewall vs. AI Gateway: Clearing Up The Terminology

Jul 13, 2026 By Wallarm In Wallarm
Editor's note: This article was originally published by Tim Erlin on LinkedIn. It has been republished here with the author's permission. It seems like every security vendor now sells "AI security." The WAF companies, the API gateway companies, the cloud platforms, the proxy startups: all of them have an AI story, and most of them have attached one of three labels to it. AI gateway. AI firewall. AI control platform. The terms often get used as if they're interchangeable, but they are not.
Read Post

AI Governance on AWS: Discover, Observe, and Control AI in Production

Jul 13, 2026 By Wallarm In Wallarm
AI adoption within AWS environments is accelerating faster than most security and governance programs. AI agents, APIs, MCP servers, and model integrations are entering production across cloud environments, often without centralized visibility or runtime controls. In this webinar, you’ll see how teams can discover AI workloads across AWS accounts, understand what AI systems are actually doing at runtime, enforce policy in real time, and generate continuous governance evidence without slowing engineering teams down. The session focuses on practical operational capabilities for AI systems already running in production.
View Video
appsentinels

MCP Supply Chain Security: How Malicious MCP Servers Are Infiltrating Enterprise AI Environments

Jul 9, 2026 By AppSentinels In AppSentinels
Every enterprise deploying AI agents is building on a foundation of third-party MCP servers they don’t control, can’t verify, and barely track. The security conversation keeps focusing on the model – prompt injection, jailbreaks, hallucinations. That’s the wrong place to look. We’ve covered why that framing falls short elsewhere too – see System Prompts Are Not Security Boundaries. Business Logic Graphs Are.
Read Post
appsentinels

The Four Attack Patterns Traditional Security Tools Miss at FIFA-Scale Events

Jul 6, 2026 By AppSentinels In AppSentinels
Every major tournament cycle, ticketing platforms brace for a traffic spike. Most security teams plan for volume. The attack data tells a different story: the traffic that does the most damage isn’t the loudest traffic. It’s the traffic that looks like a real fan, on a real device, doing something a real fan would plausibly do, just millions of times, in a pattern no single fan ever would.
Read Post
appsentinels

OWASP Top 10 for Agentic Applications 2026: What It Means for Enterprise AI Security

Jul 2, 2026 By AppSentinels In AppSentinels
OWASP, the Open Worldwide Application Security Project, has published Top 10 lists for over two decades to help security teams prioritize the risks that matter most. The original OWASP Top 10 for web applications became the industry’s default checklist for application security. When large language models moved into production, OWASP followed with the Top 10 for LLM Applications, addressing risks like prompt injection and sensitive information disclosure in single-turn model responses.
Read Post
appsentinels

ServiceNow, Then PeopleSoft: Why the Same Endpoint Failure Keeps Repeating

Jul 1, 2026 By AppSentinels In AppSentinels
Three weeks ago, it was ServiceNow: an endpoint that never asked who was calling, exposing customer data to anyone who asked. This time it’s Oracle PeopleSoft, exploited at scale by the threat actor ShinyHunters. Two platforms, two different vendors, the same root failure: an endpoint that skipped the one question it existed to ask. That’s not a coincidence you write off as bad luck at two companies.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.