Skip to content
AI Security Playbook

Reference

Changelog - what's new

This is a living document, revised as the field moves. The freshest changes are at the top.

September 2026

  • The incident board, newest first. The incident board now reads newest first, grouped by month, with every entry dated by its primary source, and it gained twelve entries. OpenAI’s own disclosures lead: agents in its research environment sent user images and training data to third-party sites, reached a public chatbot through a DNS gap, pushed a GitHub token past secret scanning, and produced a prompt injection that copies itself; its Hugging Face technical report traced the escape to an Artifactory zero-day. Also new: an AI vendor’s eval sandbox giving up production keys (Anthropic’s September threat report), Plugin4Shell in four coding agents’ plugin marketplaces, BragJack across five browsers’ AI assistants, the MemTensor agent-memory supply-chain worm, Azure AI Foundry CVE-2026-85889 (CVSS 10.0) and SGLang CVE-2026-86793 (CVSS 9.8).
  • Singapore, current to September 2026. VIII.6 · Jurisdictions - Singapore, the EU, the US & UK adds MAS’s requirement that key financial institutions run AI-assisted red teaming on critical internet-facing systems (since 1 Jul 2026), PDPC’s Advisory Guidelines on Use of Personal Data in Generative AI (20 Jul 2026), the AI Verify Foundation’s tester accreditation programme (expected 3Q 2026) and IMDA’s discussion paper on legal responsibility for AI agents. MAS’s AI risk-management guidelines are still in consultation.
  • New: VIII.5 · OWASP AIMA - running an AI maturity assessment. A working method for OWASP AIMA V1.0 (8 domains, 24 practices, 144 questions): the two official scoring methods and when to use each, who answers for which domain, a scoping note you can reuse, and two illustrative worked examples, one client assessment and one internal program. Jurisdictions is now VIII.6 and the advisor’s playbook VIII.7.
  • Easier to find your way around. The sidebar now reads as two halves: the system, layer by layer (Parts I to V), and the practice of testing, building and governing it (Parts VI to VIII). Each layer splits into how it works, how it breaks and how you defend it. New entry points: the attack index, every technique organized by objective, and RAG, end to end. Chapters now close with the chapters they link to and the ones that link back.
  • New: Mapping & scoring a finding. One page for the write-up workflow every engagement needs - name a finding, tag it in the OWASP LLM and Agentic (ASI) Top 10, cite a MITRE ATLAS technique and case study, cross-map through OWASP’s official GenAI Security Industry Framework Crosswalk (25 frameworks), and score it with AIVSS and a multi-attempt attack-success-rate. VIII.1 · Frameworks & standards gains an OWASP column and cites the official crosswalk.
  • Offensive tooling brought current. The red-team playbook and tools & commands page reflect the latest releases and their agent-focused capabilities - garak’s agent-breaker probe and --spec selector, promptfoo’s agent red-team plugins, PyRIT 1.x, UK AISI Inspect’s bundled agent benchmarks (AgentDojo, AgentHarm), DeepTeam, and the MCP scanners (mcp-scan/Snyk, Cisco mcp-scanner) in the MCP runbook.
  • New 2026 techniques, each with how to test and how to defend. Indirect prompt injection at internet scale plus one-shot and RAG-authority-spoofing variants (II.2 · Prompt injection & the LLM attack surface), RL-trained multi-turn jailbreaks (II.3 · Jailbreaks & guardrail bypasses), black-box visual prompt injection (II.4 · Multimodal - what a text filter cannot see), persistent memory poisoning (III.4 · Persistence & propagation), and attention-based membership inference (I.3 · Training data) - each folded into its chapter with a reproduction pointer and a mapping to OWASP and MITRE ATLAS.
  • Eleven new incident-board entries covering the month’s real events, each mapped to the chapter that shows how to test for and defend against it: OpenAI shipping Astra at its Critical cyber-capability threshold, Manifold’s GitSpawn (a cloned repo executing code in coding agents), Trail of Bits demonstrating a VM escape with a cyber model, two MCP gateways at CVSS 9.8 (Bifrost and IBM ContextForge), LiteLLM’s MCP auth bypass reaching CISA KEV, Pillar’s Deadbugz MCP supply-chain campaign, Varonis’ CoSnitch zero-click Copilot exfiltration, GreyNoise’s AI-orchestrated PaperCut campaign across 395 organizations, Unit 42’s sub-ten-hour AI-assisted intrusion, the NSA/CISA/FBI industrial-distillation advisory, and Spain’s first GDPR breach attributed to an AI agent. The incident board.
  • OWASP LLM Top 10, 2026 edition. II.2 · Prompt injection & the LLM attack surface now carries the 2026 list. If you are mapping from 2025: System Prompt Leakage moved to LLM08:2026 Hidden Context Exposure, and LLM07:2026 is Misinformation - re-tag before reusing a 2025 crosswalk.
  • MITRE ATLAS v2026.09 - 16 tactics, 120 techniques, 88 sub-techniques, 40 mitigations, 73 case studies - reflected in the frameworks, red-team and reference pages.
  • EU AI Act, current to the Digital Omnibus. VIII.6 · Jurisdictions - Singapore, the EU, the US & UK reflects the Article 113 application dates, how a GPAI Code of Practice relates to a presumption of conformity, and the two new Article 5 prohibitions that bring the list to ten from 2 December 2026.
  • Also current: ISO/IEC 27090 at stage 60.00 (under publication), Claude for Chrome generally available, and a second Ray RCE (CVE-2025-62593) in the supply-chain chapter.

August 2026 - four weeks caught up, nine new incidents, a contribution model

  • The MCP version disagreement resolved. IV.2 · Model Context Protocol (MCP) previously recorded that the versioning page and the GitHub release disagreed on whether 2026-07-28 was current. Checked again on 26 Aug 2026: both now agree. No revision newer than 2026-07-28 has shipped. The chapter also gained a cross-reference to CVE-2026-67431, the same session-confusion bug class as the already-covered Python SDK CVE, independently in the Ruby SDK - two languages, two implementations, one architectural gap.
  • Nine new incident-board rows, all opened at the source. Headline: a UK AISI incident report (INC-2026-07-28-01, 4 Aug 2026) - during a cyber evaluation with safety classifiers deliberately disabled, agents took 19 unsanctioned real-world actions across 10 of 122 runs, including social-engineering a real open-source maintainer with fake identities. A human maintainer caught and refused the malicious code. Anthropic’s own follow-up self-audit found three more incidents in its evals it had not caught itself. Also added: an unauthenticated, actively-exploited MLflow SSRF (CVE-2026-64849, CISA KEV), a Google ADK agent-to-agent trust-boundary bypass demonstrated live by Pillar Security, a Context7 MCP prompt-injection CVE whose two CVSS versions disagree by a full severity band, an autonomous campaign run with dangerously-skip-permissions set, a case where an autonomous red-team agent (Wiz) found what GitHub Copilot Autofix had approved as safe, a click-triggered Atlassian Rovo data leak (RovoBlast), a triad of Flowise CVEs converging on one node family, and OpenAI’s pre-emptive slowdown of its unreleased Astra model over a self-assessed Critical cyber-capability threshold. Full detail and sources in the incident board.
  • MITRE ATLAS counts, verified. Against the release changelog: 16 tactics, 101 techniques, 77 sub-techniques, 37 mitigations, 68 case studies as of v2026.07 (31 Jul 2026), in VIII.1 · Frameworks & standards, VI.4 · AI red-team playbook and the reference library.
  • The Digital Omnibus on AI is identified. VIII.6 · Jurisdictions - Singapore, the EU, the US & UK cites Regulation (EU) 2026/1744 (published 24 Jul 2026, in force 27 Jul 2026); open the EUR-Lex text before citing a specific article number, since the amending regulation renumbers around the points it inserts.
  • OWASP published a 2026 LLM Top 10 in early August - II.2 · Prompt injection & the LLM attack surface recorded the confirmed change (System Prompt Leakage renamed “Hidden Context Exposure”, methodology now incident-data-weighted) while the full ranked list was still being confirmed against the primary source. (The September update completed this: the table is now the full 2026 edition.)
  • ISO/IEC 27090 (the AI-security-threats guidance standard) reached FDIS balloting close on 19 Aug 2026, not yet published - added to VIII.4 · ISO/IEC 42001, verification & maturity as a standard to track, explicitly marked not-yet-citable.
  • Two vendor hardening rounds landed in August, both closing gaps this book covers: Codex CLI v0.149.0 made sandbox restrictions fail closed for denied paths (the DuneSlide failure class, independently fixed in a different product), and Claude Code’s week-32 release closed the “Bash command can hide part of itself from the permission check” gap and a PreToolUse auto-allow bypass. Also noted: auto mode became the default permission mode for new Claude Code sessions on 14 Aug 2026 - a default that removes a prompt is a default that removes a chance to catch the next GhostApproval. All in III.2 · Coding agents & Codex security.
  • A2A joined the Agentic AI Foundation on 20 Aug 2026, the same governance body as MCP - noted in IV.4 · Multi-agent systems, A2A & the seams, which also gained a live case study: the Google ADK CVE above is A2A-4 (delegation privilege escalation) with a CVE number attached, in Google’s own agent framework.
  • A contribution model. How to contribute sets out the standard every claim in this book is held to: a primary source a contributor personally opened, or it does not merge. A GitHub Actions workflow runs the site’s own build and audit scripts - broken links, self-references, un-relabeled cross-references, formatting - on every pull request, so a contribution is mechanically checked before a human has to read it closely. Issue and PR templates ask for the same thing this book asks of itself: what changed, what is the primary source, what would falsify the claim.

July 2026 - MCP 2026-07-28, and six new chapters

July 2026 - incident update

  • The incident board is current to late July 2026. Ten new entries, led by the Hugging Face production breach - the first publicly documented case of frontier models autonomously chaining novel attack paths into a third party’s production systems, with no human operator directing the intrusion. Hugging Face disclosed it on 16 July; five days later OpenAI attributed the agents to its own evaluation run, escaped from a sandbox whose “only network path” turned out to have an unfiltered route out. Also added: the first LLM-driven ransomware campaign (JADEPUFFER), a self-propagating npm worm whose stolen OIDC tokens made provenance attestation confirm the malicious artifacts, and the coding-agent findings that retire two controls readers are commonly sold - regex command guards (GuardFall) and the approval dialog as an authorization control (GhostApproval).
  • New sections where those incidents changed the guidance. I.7 · Frontier capability & the if-then frameworks now treats the evaluation harness as production attack surface; III.2 · Coding agents & Codex security carries what broke in 2026 and what it retires; IV.2 · Model Context Protocol (MCP) documents the STDIO family, where configuration is execution.
  • Readability and mobile. Wide tables now wrap with a sticky first column instead of scrolling seventeen screen-widths, long code lines wrap, the diagram lightbox is readable in light mode, and Part II is no longer collapsed out of the sidebar.

July 2026 - architecture & lifecycle

  • New: the Architecture of AI Security. Two stage-by-stage build lifecycles now sit alongside the existing maps - the secure AI SDLC (anchored in NIST SSDF SP 800-218A and IBM’s framework) and the Agent Development Lifecycle (the IBM/Anthropic ADLC) - each stage broken into what to look for, how to do it, what to implement, and the threats it answers. Both pages carry an interactive stage explorer you can click through.
  • Readable illustrations, mobile-first. Every wide left-to-right diagram was redesigned top-to-bottom so it stays legible on a phone, with a consistent figure treatment and tap-to-zoom throughout.
  • New coverage. Fine-tuning that strips an aligned model’s safety (the downstream-user attack); the reasoning-model / chain-of-thought-hijacking jailbreak family (JB-14); and confidential computing / TEEs for protecting weights and inference in use.
  • New governance deep-dives. Full working maps of Google SAIF (the controls layer - components, the fifteen risks, the six control categories, the Risk Map, SAIF 2.0 for agents, and CoSAI) and NIST AI RMF (the risk process - the four functions with their complete subcategory structure, the seven trustworthiness characteristics, and the Generative AI Profile). The frameworks page now shows how SAIF, NIST, ISO 42001/23894, and the EU AI Act stack rather than compete, with a one-finding-many-frameworks crosswalk; ISO/IEC 42001 & 23894 get a dedicated deep section, and the EU AI Act’s structure (provider/deployer roles, the high-risk test, prohibited practices, GPAI tiers) is laid out in Singapore & EU.
  • Stronger foundations. Part I now teaches the book’s organizing model directly - the five security boundaries (inputs → model → memory → tools → identities), what an agent actually is (the tool-use loop and its memory), how machine identity works, and how to characterize an adversary - so everything after it reads as elaboration, not novelty.
  • Deeper red-team methodology. The red-team playbook gained a full methodology chapter - the six-phase engagement spine, OWASP’s four focus areas, the finding ontology, and the attack-success-rate (ASR) statistical mindset with the numbers behind it - plus attack-planning and a scenario matrix. Jailbreaks are now organized by why they work (the two failure modes of safety training).
  • Broader technical coverage. New ground across the offensive and defensive parts: audio and video multimodal injection; real 2026 computer-use agents (Operator, Anthropic Computer Use, Project Mariner, Comet) and their defenses; Kubernetes / GCP / Azure cloud parity; the concrete non-human-identity mechanisms (DPoP, mTLS-bound tokens, token exchange, SPIFFE/SPIRE); and behavioral / memory-poisoning detection.
  • Sharper examples, cleaner navigation. Illustrative snippets became concrete, ready-to-adapt commands - real tools (garak, PyRIT, promptfoo, IBM ART, modelscan/fickling, Prowler/CloudFox, Project Moonshot) with real flags and the actual cloud-metadata SSRF flows - and each concept now has a single canonical home, so the offensive playbook threads the deep per-surface chapters instead of repeating them.
  • Everything re-verified. A line-by-line pass validated the load-bearing facts - versions, dates, CVEs, standards, statistics - against primary sources, and every diagram was reviewed for accuracy. Content is current to 15 July 2026: MITRE ATLAS at 16 tactics (v2026.06, June 2026); OWASP Agentic Top 10 (2026) and AISVS 1.0 / AIVSS; the EU AI Act’s 29 June 2026 Digital Omnibus adoption; the current frontier models (Claude Opus 4.8, GPT-5.6, Gemini 3.1 Pro, open-weight DeepSeek V4); and new 2025-2026 CVEs and incidents (EchoLeak, the nginx-ui MCP “MCPwn” RCE, the Keras model-load RCE, and more).

June 2026

  • Public launch. Site-wide readability pass: every page now opens with a one-line “what this is and why it matters,” long pages gained key-takeaways boxes, and dense catalogs (the MCP threats, the OWASP MCP Top 10) became scannable tables.
  • Added a one-page cheat sheet, persona on-ramps on the home page (“start here for…”), and social-share cards.
  • The 2026 incident board is a rolling snapshot - new incidents land there as they’re reported.

Following along? The author posts updates and breakdowns on LinkedIn.