Topic
Access governance, data classification, breaches and data security posture.
In the vendor-commissioned survey of 400 US and UK security leaders, 77% of those reporting an incident said an approved AI tool was involved, and 56% said autonomous agents fall outside existing controls.
The campaign, which CrowdStrike says began on 17 October, paired the DeepSeek model with agentic tooling and, in one case, used mail-server keys likely not rotated since a 2022 directory export.
The AEPD and the Hellenic DPA say providers of secure processing environments must keep real, effective control even when third parties run the infrastructure; contracts and certifications alone are not enough.
Internal Report 8621, drawn from a May workshop of more than 400 participants, lists evidence collection, information sharing and clarifying responsibilities across developers, deployers and users as future work.
Auditors traced the oversharing to weak data loss prevention management, including outdated search terms, OCR left switched off and an unnoticed 15 MB file-size limit.
According to WIRED's anonymous sources, the agent ran for two months with the contractor's admin credentials and appears to have sent credentials and a network map to a high-risk site. Accenture says the allegations lack merit.
The detection language and engine examines whole agent sessions, including tool calls and MCP interactions, rather than single commands, and records the evidence behind each match.
Agent Identity, Vault 2.2 and agent evaluation in watsonx Orchestrate are generally available. Cross-platform agent discovery and a sandbox-plus-kill-switch feature remain in tech preview.
The Investigatory Powers Commissioner says oversight is working but criticises GCHQ, the NCA, the prison service and the MoD, and records four serious errors linked to communications data.
The Norwegian data protection authority urges organisations to map their AI agents and give each one a defined identity, access limits and a clear owner before automations escape oversight.
The two US carriers told Reuters they are increasing security investment as AI takes on network tasks. AT&T is checking whether third-party AI agents seeking account access act for real customers.
After five banks moved to block third-party AI agents from customer accounts, Forrester argues for agent identities, scoped and revocable permissions, and continuous monitoring rather than outright bans.
Following a complaint, the Swedish regulator found that signs did not clearly tell people, including those arriving by train, that they were entering a monitored area.
Fangcun AI's evaluation of DeepSeek V4.1 Flash-1017 finds that agent actions can evade monitoring that only inspects outputs or end states, and recommends logging every action.
Complaints in France, Italy, the Netherlands and Austria target third-party trackers, mandatory Persona face-and-ID verification and unanswered access requests on the AI training platform.
The decalogue asks users five questions before delegating, from what an agent can see to where it sends data, and says providers must also supply permissions, activity logs and a way to stop agents.
The company says the agent took aggregate vote counts the state normally sells, without human approval, but did not touch voter-registration systems or records.
A root-cause analysis says a key exposed in May led to an organisation owner's unscoped GitHub token, stolen CI secrets and a malicious v1.107.0 release on PyPI and container registries.
Supervisors in the UK, the US and the euro area are questioning banks about controls over autonomous AI agents and recovery from AI-enabled cyber attacks, according to a Reuters report.
