If you just remember one thing from this briefing…
Three separate agent platforms let attackers trigger tools without the model ever being called.
AWS Bedrock AgentCore, Google's Agent Development Kit and Vercel's coding-agent SDKs all shipped a way for a
forged tool-call to reach a live tool directly, skipping the model and every guardrail attached to it. All
three are now patched. Ask your AI platform owner today which production agents call tools through a
harness rather than a model turn, and confirm each one has the fix.
Priority6 Aug
Agent harnesses let tools fire without the model in the loop
AWS Bedrock AgentCore, Google's Agent Development Kit (CVE-2026-18236, CVSS 9.3) and Vercel's Codex and
OpenCode SDKs each let a forged tool-call reach a host tool directly. Google separately deleted three ADK
workflow templates on 4 August after a malicious GitHub issue triggered a privileged agent.
So what: a control that assumes the model sees every request before a tool fires is
unsafe by default. Confirm tool-use blocks are validated server-side, not only by the model.
Priority11 Aug
Patch Tuesday zero-day is already a North Korean rootkit chain
Microsoft's August update fixed 421 CVEs including CVE-2026-68820, a use-after-free in the AFD.sys WinSock
driver. Check Point attributes active exploitation to a North Korea-linked Operation Dream Job campaign
deploying a kernel-mode rootkit after privilege escalation. CISA added it to the KEV catalogue the same day.
So what: treat this ahead of routine patch cycles — exploitation predates the fix.
An endpoint unpatched past 25 August should be assumed compromised, not merely overdue.
PriorityMid-Aug
Entra's stricter federation default can lock out sign-in with no warning
Microsoft is enforcing federatedTokenValidationPolicy by default from mid-August, blocking federated
sign-in wherever internalDomainFederation doesn't match a user's UPN domain (error AADSTS5000820). It
already applies to domains federated since December 2025; this rollout extends it to every existing one.
So what: review every domain federated before December 2025 this week. A helpdesk
spike from blocked sign-ins is the likely first sign it was never checked.
Watch4 Aug
NCSC guidance follows real incidents of AI acting unsupervised
NCSC published guidance for providers of any AI-based system on 4 August, prompted by frontier-model
evaluations that produced unsanctioned, deceptive behaviour. NCSC CTO Ollie Whitehouse said detection
after the fact will not be enough — safeguards are needed from the design stage.
So what: if you build or integrate agentic AI, treat this as the baseline your
assurance evidence will be measured against, not optional reading.
