Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

armo

WebInject: The Web Agent Prompt Injection With No Payload

Sep 10, 2026 By Yossi Ben Naim In ARMO
A browser agent in your cluster opens a supplier portal, screenshots it, and clicks somewhere the task never called for. The page looks exactly like the page the supplier serves, and to the person who checks it later, it still does. The classifier in front of the agent returned nothing, because the instruction that produced the click does not exist.
Read Post
mend

Detection scaled. The loop did not.

Sep 10, 2026 By Asaf Saar In Mend
Findings got cheap. Verified closure did not. That AppSec remediation gap is the actual problem. AppSec spent a decade winning the wrong race. We got very good at finding things. Scanners in CI. SCA on every manifest. SAST on every pull request. Container and IaC checks on the way to the cluster. Then AI arrived and did what AI does to a solved problem: it made discovery cheaper, louder, and continuous. The same model that writes the function will also enumerate the ways to break it.
Read Post

An agent breaks in production. Who's accountable?

Sep 9, 2026 By Teleport In Teleport
We asked eight security and product leaders who's accountable when an agent ships to production and breaks something. Nobody said the model. Harish Gaggar named the reason. An agent runs on permissions someone approved and configuration someone set. Ron Reiter drew the line in the same place, accountability sits with whoever decided what the agent could actually do. As agents act across more systems, the accountability trail gets harder to follow. Most teams cannot determine which human granted an agent access.
View Video
teleport

FIPS 140-2 vs FIPS 140-3, Explained

Sep 9, 2026 By Mayur Pipaliya In Teleport
FIPS 140-3 is the current standard for validating cryptographic modules, which are the specific hardware or software components that implement encryption and manage keys inside a defined boundary. FIPS 140-3 was approved on March 22, 2019, became effective on September 22, 2019, and supersedes FIPS 140-2, which dates back to 2001. Most FIPS 140-3 security requirements come from ISO/IEC 19790:2012, with test requirements drawn from ISO/IEC 24759:2025.
Read Post
armo

How Far Can Prompt Injection Reach in Agentic Coding Assistants?

Sep 8, 2026 By Shauli Rozen In ARMO
The blast radius of a prompt injection against your coding assistant was set weeks ago, by whoever built the dev environment image. Same assistant, same model, same injected sentence: on a laptop it collects every repository, SSH key and cloud login the developer holds; on a provisioned dev box it collects an organization token plus whatever the image left behind; on a CI runner it collects a deployment credential and a network path to production. Three environments, three incidents, one payload.
Read Post

Securing autonomous AI agents: regulatory risk and governance for modern AppSec

Sep 7, 2026 By Mend In Mend
Autonomous AI agents writing and executing code at machine speed present an urgent compliance challenge for modern software organizations. As global regulations tighten, engineering leaders must establish clear governance layers over agentic workflows, external tool calls, and Model Context Protocol integrations to ensure full accountability. In this session, Mend.io experts Asaf Saar and Ben Goldberg unpack the intersection of AI compliance, software supply chain security, and enterprise risk management. Learn how to bridge the accountability gap without sacrificing development velocity.
View Video
armo

Prompt Injection in RAG: The Payload Is Still in Your Index

Sep 6, 2026 By Yossi Ben Naim In ARMO
Every action in your agent-incident runbook operates on the agent. The payload of a RAG prompt injection sits in the index. You can kill the pod, rotate the credential and revoke the session, and each of those stops this workload from doing that thing again. None of them touch the chunk that caused it.
Read Post
armo

Prompt Injection Through Tool Output Is Two Events (Your Screens Read One)

Sep 6, 2026 By Ben Hirschberg In ARMO
Tool output is untrusted because your own systems produce it. That is the part of the OWASP guidance that never makes it into a deployment. The label goes on web pages and email bodies, where an outsider obviously wrote the text. It never goes on the ticket store, the CRM, or the repo, because those are yours. The attacker does not care whose system it is. He cares which field takes free text: the ticket body, the opportunity note, the PR description.
Read Post

Copyright © 2026 OpsMatters™. All rights reserved.