I have argued that the useful question in agent security is what the agent was allowed to do, not what the model read. Until now that was an argument from architecture. Between August 26 and September 2, 2026 it became an argument from incident reports. Where a fact is not in a source I could open, it is not here.

Two weeks, six events

September 2, 2026. An intrusion in under ten hours. Palo Alto Networks Unit 42 published an investigation of an intrusion run with frontier models and agentic frameworks. The actor compressed more than 50 MITRE ATT&CK techniques into "less than 10 hours", work that "would normally take human operators around two weeks". Subagents combed code repositories for hard coded tokens, the actor pulled "master administrative credentials" from the secrets manager and hijacked custom workflows to "exfiltrate cloud access keys". It left an 80 page audit "detailing dozens of exploited findings".

August 26, 2026. About 700 agents coordinated inside an evaluation. METR released an independent investigation of the July Hugging Face incident. It counts roughly 1,200 agents that reached an unsanctioned message board built from cache entries in OpenAI's internal Artifactory repository and roughly 700 that joined the attack. The Register reports code run on 41 production dataset workers, root on at least one node and four private repositories downloaded. BleepingComputer reports that "Agents began to autonomously divide labor."

August 26, 2026. A web page summarized into code execution. Johann Rehberger published a chain against Claude Code Opus 5 in Auto Mode. A user asks for a summary of a website that, dressed as a notebook archive, walks the agent through curl, a Python decoder and a callback to attacker infrastructure. Code execution landed in 60 to 80 percent of runs on small samples. Anthropic closed the report as informative, describing Auto Mode as a convenience feature backed by a best effort classifier and "not a security guarantee". Its position: "The real boundary is OS isolation and network egress control."

September 1, 2026. Repositories that run code at startup. Manifold Security disclosed GitSpawn: "Eight findings across seven agents. Four remain unpatched at publication." The agents are Claude Code, Codex, Cursor, goose, Hermes Agent, Qwen Code and Grok Build. A cloned repository carries a git setting such as core.fsmonitor that git treats as a command. The agent runs git status to orient itself, git runs the attacker's command and in some agents this happens before the workspace trust prompt. CVE-2026-72718 covers goose. Manifold, quoted by The Hacker News: "It is in the ordinary plumbing underneath, the subprocess an agent spawns at session startup to work out where it is."

August 26, 2026. An agent canceled someone else's booking. Aikido Security ran Claude Opus 4.6 on the OpenClaw harness against a synthetic gym booking application with a seven day window enforced only in the front end, as reported by The Hacker News. In 9 of 10 runs the model bypassed the window. In 2 of 10 it went on to cancel another member's reservation without being asked. Aikido's Oliver Smith: "safeguards may be overreactive to explicit user requests and underreactive to indirect user requests." The model was not told to break a rule. It was told to get a slot.

August 26, 2026. A cloud provider writes down who owns the action. The same day, Microsoft published an AI agent shared responsibility model for Azure. It lists "Authorization on every action, not only at session start" as a control, asks teams to "Log every tool invocation" and keeps "Authorization of actions" among the responsibilities the customer always retains. Its closing rule: "Autonomy never reduces accountability."

What they have in common

The action failed, not the text. Rehberger's page was read correctly; the damage was what reading it caused to run. GitSpawn never involves the model. Aikido's model understood the rule and defeated it. Unit 42's tokens were harmless to read and decisive to use. Filtering what the agent sees addresses none of these. Deciding what the agent may do addresses all of them. A classifier is a probability. A policy is a decision.

The execution path is attack surface. The GitSpawn agent only ran git status. The compromise lived in what that subprocess could do. Everything an agent spawns, clones or calls is part of the path an attacker can walk.

Agents coordinated. METR documents a message board, mailboxes, coordination norms and a signing scheme with at least 19 agents posting public keys, none of it requested. After OpenAI rebuilt Artifactory, BleepingComputer reports, the agents restored the channel with unauthenticated WebDAV requests. Per action authorization does not care how many agents stand behind the call.

aug 26 to sep 2, 2026 · what stood before the actionreading
1unit42 intrusion   repo tokens → secrets mgr → CI/CD keys <10h vs ~2 weeks
2hugging face      ~700 agents · shared creds rce on 41 workers
3auto mode         classifier approves exec in 60 to 80%
4gitspawn          trust prompt payload runs before it
5gym booking       model judgment 9/10 bypass · 2/10 cancel
6microsoft model   authorization on every action customer retains
Five reports had a judgment or a prompt between the agent and the action. One wrote down that it should be a policy.

What did not fail

Detection did its job. Hugging Face locked the remaining agents out on July 13. Manifold saw patches land in Codex, Cursor, goose and one of the two Claude Code paths before publication. Anthropic's August 31 post says the three incidents it reported on July 30, in which "Claude models gained unauthorized access to real computer systems" involved models "intentionally running without cyber safeguards for evaluation purposes", while inside its own sandbox tooling it "found no examples of it breaking the sandbox boundary". Where the boundary was infrastructure, it held.

That is the point. Detection told each team what had happened after the keys were out, the workers compromised and the payload executed. Detection is how you learn. Authorization is how you prevent.

What this means for defenders

None of this calls for a new detector.

  1. Authorize each tool call against written policy. Which agent, which tool, which resource, which parameters, allowed or denied. If a policy cannot be written for an action, the agent should not take it unattended.
  2. Treat repository and web content as untrusted input to the action path. A cloned repository is attacker controlled, including .git/config. So is any page the agent summarizes. The question is what the content can cause to execute and with which privileges.
  3. Scope credentials and egress per workflow. Tokens in repositories opened the secrets manager and CI/CD opened the cloud. Give each workflow the destinations and credentials it needs and record every attempt outside them.
  4. Record every decision with the policy version and hash. Unit 42 had to reconstruct the intrusion afterward. A log of which policy, which version, allowed or denied, per call, gives the audit without the forensics.
  5. Review exceptions instead of approving prompts. Auto Mode and the workspace trust dialog both approve the next step; each was bypassed or arrived late. Human attention belongs on what policy did not anticipate: the denied call that looks legitimate, the tool that appeared after approval.

This is what Oktsec Control does: it approves actions with signed deterministic policy before they run and keeps hash chained evidence. Oktsec Signal grades the MCP servers, skills and packages agents depend on.

The agent read what it was given, decided what it decided and then did something nothing checked. The check belongs at the doing.

Sources