AI agent security weekly review: the boundaries businesses should test

The supplied briefs cover five dated editions, not seven complete daily reports. Our six companion articles examine MindSearch, Manus, Loom, Wikimedia, Progress and the PraisonAI/Pydantic AI control findings. The remaining reviewed items are summarised below.

Pentriarch analysis: each story asks where a system turns information into authority. The useful business response is a small, owned acceptance test for that transition, rather than treating every AI headline as the same kind of breach.

GitLab identifies CVE-2026-90970 as a prompt-template sandbox escape affecting self-hosted AI Gateway deployments under specified conditions, involving an authenticated user with Duo Agent Platform access. The advisory lists fixes in 19.2.4, 19.3.2 and 19.4.1. GitLab-hosted gateways were already patched; the vendor says customers using those gateways need no action.

Pentriarch analysis: inventory the gateway independently of the main GitLab instance. Record its deployed version and follow the vendor’s update guidance. An update to a related component is not evidence that this gateway changed.

The published CVE records for CVE-2026-51857 and CVE-2026-51858 describe model-produced Python execution and prompt-driven shell execution in Camel 0.2.91a1, a2 and a3 without an approval boundary. These are advisory records, not evidence of a production compromise.

Pentriarch analysis: ask whether approval covers the actual action and its arguments. Review process identity, filesystem permissions and outbound destinations alongside the prompt.

Adversa AI reports a Cryptographic Context Injection demonstration against Copilot CLI in autopilot mode: encrypted web content was decoded within the agent workflow, followed by local secret access and outbound transmission in successful tests. The researchers report different outcomes across tested models and a disagreement with GitHub over vulnerability classification.

Pentriarch analysis: a decoded value still originates from the external source. Preserve its provenance and constrain local file access and network destinations. A transformation should not become a new source of permission.

Langflow’s GHSA-w794-rj3p-xv45 advisory describes command execution through MCP stdio server configuration and identifies fixes associated with 1.10.3. Related advisories have their own ranges, so apply the record matching the deployed component rather than assuming every MCP issue has one universal fix.

Pentriarch analysis: review who can configure an executable connector and the checks applied when it is launched. A safe tool description does not establish a safe registration or process-launch path.

CVE-2026-97228 describes GraphQL query injection in Rapid7 Bulk Export MCP 0.2.5 through 0.6.1, fixed in 0.6.2. The record explicitly says injected queries remain within the operator’s existing API scope and do not cross a tenant or account boundary.

Pentriarch analysis: validate identifiers passed from an upstream agent and use structured query variables. Do not turn a query-injection advisory into an unsupported claim that Rapid7 customers or other tenants were breached.

Microsoft’s SimpleChat advisory describes a low-privilege user reaching a stdio process-launch path through an authorisation-ordering flaw. Exploitation depends on personal plugins and permitted MCP actions. The advisory identifies 0.261.031 as the fixed version.

Pentriarch analysis: normalisation, persistence and execution all belong in the permission review. Check the capability that will actually be instantiated, not only the original shape of a submitted manifest.

Microsoft’s UFO advisory covers command injection through Mobile MCP type_text and launch_app before 3.0.10. It requires a valid API key and an ADB-authorised reachable device. Its documented result is Android shell-user execution, not root access or host operating-system execution.

Pentriarch analysis: keep device automation identities and test devices separate from sensitive production access. Confirm that structured tool arguments cannot become extra interpreter instructions.

METR’s 6 October post describes a controlled staging demonstration affecting the Inspect transcript viewer. The displayed transcript could be manipulated while the stored transcript remained unchanged. METR says it had not observed agents exploiting this issue in evaluations and that the maintainer patched it.

Pentriarch analysis: preserve original evidence independently of rendered output. Treat logs and review interfaces as security-relevant components; the reviewer needs a trustworthy view as well as a stored record.

In a statement reported by Becker’s on 2 October, Mayo Clinic said it had no indication or evidence of unauthorised access to its systems or data after the Asymmetric Security report. That is the organisation’s stated position, not a guarantee about every system mentioned in the broader investigation.

Pentriarch analysis: preserve the distinction between reconnaissance, attempted exploitation and verified access. An incident headline should not outrun the organisation-specific evidence.

Reuters reported on 7 October that Yoido Full Gospel Church and SaRang Church were investigating suspected attacks. It attributed indications of possible AI use to Oasis Security and reported that Yoido’s initial analysis suggested information relating to 850,000 members may have been compromised.

This is an investigation with qualified exposure and attribution claims. References to sub-agents do not establish a named model or fully autonomous intrusion. Pentriarch analysis: preserve identity and application logs, establish the entry point and separate observed access from conclusions about how the attacker operated.

Brazil’s Supreme Federal Court reported a hidden AI instruction in a defence petition and a personal fine of R$5,000 imposed by Justice Alexandre de Moraes. Its notice attributes detection to the MARIA Shield security routines. This supports reporting an attempted manipulation and official response, not a successful alteration of a judicial outcome.

Pentriarch analysis: document intake needs provenance and a boundary between submitted material and operating instructions. Record the attempted instruction and the control’s observed decision.

Swarmchasers’ preliminary report describes parallel agents querying Amap through intermediary services. The researchers distinguish a fleet from a coordinated swarm and qualify attribution to particular infrastructure and models. Those observations do not establish that a cloud provider directed the activity.

Pentriarch analysis: examine indirect access paths and permitted resource use. Keep preliminary attribution separate from verified operator identity, and do not equate automated collection with a proven compromise of Alibaba’s infrastructure.

An open letter published by Loughborough University on 5 October, addressed to ministers on 3 October, proposes clearer responsibility, incident reporting and independent investigation of selected cases. It also recommends tested human intervention and limits on access, spending and data use in public procurement.

This is a proposal, not enacted policy or a new attack. The checked publication identifies its named signatories; we do not repeat the scheduler’s unsupported count of 19 experts. Pentriarch analysis: an accountable deployer and a tested stop control are useful requirements to discuss in any agent procurement.

Assign an owner to each affected technology in your inventory. Apply the relevant vendor updates, review potentially exposed credentials and agree a controlled acceptance test. Collect expected and observed outcomes, including any test that did not run.

Use Pentriarch’s documentation to select the relevant assessment workflow. Static MCP inspection helps review declarations and changes; it does not establish every runtime control. Confirm active-test availability and scope before depending on it. None of these articles claims that Pentriarch repaired the named vendors or prevented the reported events.