#119: The Agent Trust Boundary

PRESENTED BY

Cyber AI Chronicle

By Simon Ganiere · 12^th July 2026

The agent does not need to be fooled. It only needs to be helpful.

The most useful AI attack this week did not break a model. It exploited the fact that people are starting to treat an AI agent's suggestion as if it had already passed the same checks a colleague, a package registry, or a security gateway would apply.

That assumption is becoming an attack surface. Forg365 puts AI-assisted lure generation inside a phishing-as-a-service dashboard. HalluSquatting turns names that coding assistants invent into a malware-delivery channel. And Ghostcommit hides instructions in an image, then uses the agent's own helpfulness to move secrets into a commit.

These are different techniques, but the economics are the same. The attacker is not trying to defeat every control. They are outsourcing the awkward middle of the attack, persuading a trusted assistant to retrieve, interpret, or execute something on their behalf. That is cheaper than compromising an endpoint directly, and it travels well across vendors.

Last edition covered JadePuffer, GuardFall and agent-browser prompt injection. This is the next layer of the same problem: trust boundaries are now being crossed through the agent's context, output and toolchain, not just its shell.

🛡️ AI System Vulnerabilities: → 18 high-scoring articles, down 14% week-on-week. Prompt injection moved into images, workflow context and agent payment flows.
Significance: volume is not rising, but the delivery formats are becoming less visible to conventional review.

📜 AI Governance & Defensive Innovation: → 15 articles, down 12%. The useful defensive signal is narrowing: safety must follow the full task trajectory, not merely screen prompts.
Significance: a chatbot policy is not an agent control.

🤖🏃 AI Autonomous & Agentic Attacks: ↓ 12 articles, down 20%. Active campaigns manipulated browser-capable agents into cryptocurrency payments, while research continued to show unsafe repository execution.
Significance: lower coverage is not lower risk. It is a more specific set of failure modes.

🔗 AI Supply Chain & Developer Tool Abuse: ↓ 9 articles, down 18%. Hallucinated packages, symlinks and malicious repository content all target the path from agent suggestion to action.
Significance: treat agent-sourced dependencies as untrusted input, not recommendation.

🦠 AI-Assisted Malware Development: ↓ 6 articles, down 33%. New research concentrated on payload delivery and scanner evasion rather than a fresh malware family.
Significance: the attacker’s advantage is distribution and automation, not magical code generation.

SPONSORED BY

Speak your prompts into ChatGPT or Claude and get detailed, paste-ready input that actually gives you useful output. Wispr Flow captures what you'd cut when typing. Free on Mac, Windows, and iPhone.

Try Wispr Flow free

Forg365 is a new phishing-as-a-service platform targeting Microsoft 365. Its operators combine adversary-in-the-middle and device-code phishing with AI-assisted lure generation in the operator dashboard, then use a browser extension called ForgCookie to refresh stolen SSO cookies for persistence. Delivery is through Amazon SES, landing pages sit on Cloudflare Pages, and the platform includes the usual anti-bot and sandbox evasion. Some organisations will call that sophistication. It is mostly good product management for criminals.

AI is not the entry point here. It reduces the cost of producing plausible, targeted lures and lets an operator run more campaigns without improving their English, their research, or their patience. That is enough. Device-code phishing bypasses the control many boards still describe as a solution, MFA, because the victim authorises the attacker’s session rather than surrendering a password.

The practical response is not an annual phishing module with a paragraph about AI. Restrict device-code authentication to populations that genuinely need it. Alert on unusual Entra device-code and OAuth-consent events. When compromise is suspected, revoke tokens and sessions, not just passwords. If your incident playbook begins with a password reset, it is protecting the state clock while missing the event.

HalluSquatting starts with a predictable model failure: a coding assistant confidently invents a package, repository or skill. An attacker registers the invented name first, adds malicious instructions or code, and waits for an agent to fetch it. In tests across Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI and OpenClaw, every agent ran an attacker-supplied test payload after being directed to the squatted resource. There is no reported in-the-wild campaign yet. That caveat matters.

But the underlying condition is not theoretical. A normal dependency-confusion attack asks a developer to make a bad choice. This one lets the assistant make it, with all the confidence of a system that has never checked whether the resource exists. The agent collapses discovery, trust and execution into one transaction. That is the dangerous part.

Do not try to solve this with a new blocklist. Put coding agents behind approved registries and organisation-owned allowlists. Require resolved package identities, hashes and provenance before installation. Disable automatic execution when an agent retrieves a new repository, package or skill. Human approval is only meaningful if the human sees the real dependency, not a fluent summary of it.

Ghostcommit hides a prompt injection inside a PNG included in a pull request. A malicious AGENTS.md points an AI coding agent to the image; the agent reads .env secrets and exfiltrates them as an integer tuple in a later commit. That design is deliberately irritating. Traditional secret scanners do not recognise the payload because it is not a secret string by the time it leaves the repository.

The researchers report end-to-end leakage through Cursor and Google Antigravity across Claude Sonnet, Gemini and GPT-5.5. Claude Code refused in their tests. The important conclusion is not a league table of models. The harness matters as much as the model. Permissions, file handling and tool execution decide whether a clever prompt remains text or becomes an incident.

This is also why document-level review is no longer enough. If an agent can inspect pull requests, it needs the same treatment as any automation handling untrusted artefacts: a sandbox, no standing secrets, scoped repository access and egress controls. Add images and non-code files to AI-review threat modelling. They are now possible instructions, not decoration.

🤖 AI-Enabled Social Engineering: DEBULL continued the device-code-phishing pattern against M365 accounts, with links to the Storm-2372 cluster and Graph-based post-compromise activity.

🤖🏃 Autonomous & Agentic Attacks: Zscaler found indirect prompt-injection campaigns that caused four models to initiate crypto payments through browser-capable agents. No agent should hold payment authority without an independent approval step.

🔗 AI Supply Chain Abuse: GhostApproval lets malicious repositories misrepresent symlink targets in coding-agent approvals. Amazon Q, Cursor and Google patched; Augment and Windsurf had not, and Anthropic treated it as outside its threat model. No in-the-wild exploitation is confirmed.

🛡️ AI System Vulnerabilities: The workflow-level Copilot jailbreak reached 816 successful harmful outputs in 816 tests by distributing instructions across ordinary development steps. Direct prompt refusal tells you almost nothing about agent safety.

📜 Research & Detection: SkillCloak achieved over 90% evasion across eight static scanners with self-extracting agent skills. The companion runtime approach detected 97% in testing. Scan at installation, but monitor at execution.

There is no newly reported, actively exploited AI-platform CVE in this period that meets the edition threshold. Patch the two GhostApproval issues this week, but do not mistake a version update for a complete fix: repository trust and agent write permissions remain the primary control.

The new development this week is not a more capable model. It is the emergence of the agent as a trusted intermediary in three old attack classes: phishing, dependency compromise and malicious pull requests. The attacker supplies context. The agent supplies confidence, access and speed.

The noise is the suggestion that every AI-related proof of concept is an emergency. It is not. HalluSquatting and Ghostcommit are research, with no confirmed campaign behind either. That is precisely when security leaders should act. The cheapest time to correct an unsafe default is before someone has packaged it into a service.

Do not commission another inventory spreadsheet asking whether teams use AI. Ask a harder question on Monday: which agents can fetch external content, read secrets, write files or approve payments, and what independent control stops each of those actions? If the answer is a confirmation dialog, you have ceremonial security with a very fast intern.

Reference: AI Influence Level from Daniel Miessler

Till next time!

Project Overwatch is how a CISO gets ready for what is coming. Every week, the signal across cybersecurity, AI, and resilience, filtered down to what changes your decisions, by someone who actually does this job. Not breaking news. Foresight you can act on.