Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

AI agents are moving into production fast. They read email, call tools, query databases, and trigger business processes, often chaining those steps in ways no single team designed. Building them has never been easier. Securing what happens after an agent is manipulated is the hard part. That is the gap Salt and AWS will tackle together on Tuesday, November 10, at 9:00 am PT (12:00 pm ET) in a live session: AWS + Salt: Build Fast, Stay Secure with Agentic AI. Save your seat →

Security teams have never been better at finding problems. Discovery is broader, detection is sharper, and the volume of findings keeps climbing. But a finding is not a fix. When teams identify a risky AI agent, an exposed MCP server, or an active attack against an API, what happens next usually looks the same: someone triages it, someone opens a ticket, and someone on another team eventually makes the change. Until then, the risk stays exactly where it was.

India’s largest bank confirmed a data loss incident in a 21 October 2026 filing with the BSE and NSE. The alert came five days earlier, on 16 October, through SBI’s threat intelligence channels, which its filing names alongside the Defence Cyber Agency, and from CERT-In. Both flagged suspected customer data on the dark web.

PCI DSS 4.0.1 is the first major standard to name API business logic as an attack type you must address. Requirement 6.2.4 lists attacks on business logic, including attempts to abuse or bypass application features through the manipulation of APIs, alongside injection and access control flaws. The timing matters. All requirements, including the ones that were future-dated, have been mandatory since 31 March 2025. Your next assessment will test controls that were optional a year ago. The reason is simple.

Brookings and the World Economic Forum say agent governance must be continuous, scoped in advance, evidenced, and monitored at runtime. We think that bar is correct, and that most organizations are nowhere near it. Most of what companies call AI agent governance today is paperwork. A review board approves the use case. A policy document says agents must follow least privilege. A risk assessment gets filed. Then the agent ships, and nobody can say what it actually did on Tuesday. That isn't governance.

On October 21, 2026, two critical vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were publicly disclosed. Both are rated 9.2 and both allow remote code execution on vulnerable servers. Government portals, public services, and commercial sites across multiple countries went offline as a precaution while teams rushed to patch. But the flaws were known on October 20, and the patch didn’t ship until the 21st.

Researchers pulled real, leaked API keys out of three LLMs using only API output. Here is how AI agents carry secrets from developer laptops into model context, and how to stop them before the model sees them.

APRA's information security standard already covers the APIs your agents run on. Most institutions cannot yet evidence it. All APRA-regulated institutions in Australia are bound to meet CPS 234. This is the Prudential Standard for Information Security. Whether that's a bank, insurance provider, or super fund, they all fall under CPS 234, as do their third-party providers. Together, these institutions hold trillions of dollars in assets.

Open banking drives financial innovation but introduces new cybersecurity risks through APIs, exposed credentials and third-party integrations. Discover how cyber threat intelligence helps financial institutions identify emerging threats, improve visibility and strengthen security.

Nearly half of the organizations we surveyed — 49.8% — confirmed or suspected that an AI agent in their environment took an action in the past year that nobody intended, expected, or authorized. That is not a prediction. It is what security and technology professionals told us when we asked them directly, across a survey of over 380 organizations, about their experience over the last 12 months. Agentic AI has moved fast. The data shows it has moved faster than most organizations can govern.

AI Detection and Response (AI-DR), also called AI runtime security, is quickly becoming a must-have. Prompt injection, jailbreaks, and data leakage are real, and the prompt is often where attacks begin. But the prompt is only the first hop. In an agentic enterprise, a single instruction can trigger activity well beyond the LLM, all the way to your business systems and data.

Ask an AWS security team how many accounts they run, and the honest answer is usually a range. Enterprises on AWS operate anywhere from 100 to 5,000 accounts. Most security teams can see only a fraction of them. That gap is why we built Wallarm Infrastructure Discovery. This week, it was named Enterprise Cloud Security Solution of the Year in the 10th annual CyberSecurity Breakthrough Awards. Here's what it does, and why the judges picked it.

If your team already runs API security tooling, you have probably answered the board’s question with a list: API discovery, testing, runtime protection, bot defense, perhaps a WAF or API gateway in front of it all. Every box is ticked. Yet the honest question every security leader still carries is harder to answer. Is anything getting through? That question has a specific answer, and it rarely comes from the tool inventory.

Salt Labs found that the agentic AI platform Manus could be hijacked with a single email. By hiding malicious instructions inside an ordinary message, researchers got Manus to execute malicious code and, from there, reach the email, cloud storage, and code repository accounts a user had connected to it. The full attack required nothing from the victim beyond asking Manus to check their inbox. No stolen password, no clicked link.

Salt Labs recently showed that a single email could hijack the AI agent platform Manus and reach a victim’s connected accounts. The full technical breakdown, with complete evidence, payloads, and screenshots, is in our research team’s write-up, and Dark Reading first reported the finding in an exclusive. This post is the shorter version: what the finding means and what it tells every organization now deploying AI agents. For the full technical detail, read the Salt Labs research blog.

Every automated red-teaming vendor finds the planted flaw in its own demo app. That tells you very little about how the tool will behave on your APIs, with your login flows, your token lifetimes and your developers. The programs we see struggle usually stall on the work around detection: writing auth scripts, keeping tokens alive, arguing over whether a finding is real, and re-testing fixes by hand. That work lands on a small number of senior security engineers.