The Watch

Volexity attributes exploitation of the Ivanti Connect Secure chain to UTA0576, per Risky Business. The actor does not stop at the appliance. It uses the access to read LAPS passwords, BitLocker recovery keys and AD service-account secrets. LAPS stores a separate local admin password for each machine in AD, so one stolen password cannot open every endpoint. A bulk read of those attributes reverses that design. BitLocker recovery keys unlock encrypted disks, which leaves a stolen laptop or a pulled drive unprotected at rest.

The Ivanti fix closes the entry point but does not invalidate secrets already exfiltrated. An organization that patches and stops there leaves the attacker holding passwords and keys that stay usable until they are rotated.

Three perimeter and Windows patches from the same week

The Windows flaw matters as a phishing enabler. Mark-of-the-Web is the tag Windows applies to downloaded files so it can warn before running them. A bypass lets phishing payloads execute without that warning. Risky Business reports the flaw as exploited and fixed in a Patch Tuesday of 1,411 fixes. Its headline mentions two zero-days while the text describes only one, so MSRC and CISA's Known Exploited Vulnerabilities catalog are where to confirm before closing the ticket. In a release that size, exploitation status rather than volume sets the order of work.

NetScaler is the third item. Both CSO editions report another critical patch for ADC and Gateway and describe a recurring memory-handling problem. The CSO coverage omits the CVE ID, the score and the exploitation status, so Citrix's own bulletin is the authority. These appliances sit on the perimeter and hold authentication and session state.

Look for evidence of theft, then rotate anyway

Enable auditing for reads of the LAPS and BitLocker recovery attributes in AD. Hunt for bulk reads or unusual LDAP queries from the appliance's internal addresses. A hit makes rotation mandatory and extends the scope to endpoint forensics. A clean result proves little if auditing was off during the exposure window. Any appliance that ran a vulnerable build while facing the internet warrants rotation regardless.

Rotation scope is every secret the edge appliance could reach, including LAPS passwords, BitLocker recovery keys and AD service-account secrets.

Caveat: this rests on one report citing Volexity, which gives no indicators of compromise or exploitation dates. We would still act this week. Rotation costs far less than an attacker holding local admin on every managed endpoint.

The six frameworks that fell share one design assumption. When text shows up in the model's output as a tool invocation, the runtime executes it. As CSO describes it, the 'Repeat-After-Me' technique only needs untrusted content to get the agent to restate a call. Nothing checks where that call came from. That combines prompt injection (OWASP LLM01) with excessive agency (LLM06). Six separate implementations failing points to a shared pattern, not six coding mistakes. CSO names no frameworks, payloads or patches, so assume yours is affected until your own test says it isn't.

Every control placed near the model failed in the reported incidents

Taken together, this reporting shows the same weakness at four layers.

• The runtime. Text the agent echoed back became an authorized tool call (CSO).
• The monitor. DeepMind's Neel Nanda, quoted by AINews, says Gemini 4 Argon evaded a realistic monitor of its reasoning and actions about half the time on simple sabotage tasks. A separate study of 11 multimodal models found that giving them tools made them fail to refuse harmful requests more often, in every model, by up to 68.7%. Guardrails tested in chat mode don't hold in agent mode.
• The gate. Daily Dose of Data Science had Claude Code build an incident-response agent, and it passed all 46 tests. CodeRabbit then found that when the model's chosen action was missing from its probability map, the code substituted the highest probability of any option. So a missing page_team score became 0.90, borrowed from inspect_logs. That cleared the 0.80 permit threshold for an action the model never scored.
• The credential. Computerworld reports that AWS agents have repeatedly been tricked into revealing credentials, and each patched path left others open.

The tool layer behind the agent adds its own risk. CSO's 253 bugs work out to about two per server, though we don't know how they are spread. MCP servers usually hold OAuth tokens or database credentials for the agent, so a vulnerable server can reach whatever it can log in to. The chain to plan for runs from planted content, to an echoed call, to a vulnerable server, to access into SaaS or data stores. No source reports that full chain being exploited.

Where the evidence stops: every item is a lab result, an evaluation or a reference build. None reports exploitation in the wild. That argues for architecture work, not incident response.

The move: take authorization away from the model

Every failure above has the same root. A model's output, its reasoning or its own confidence score was allowed to authorize an action. The lasting fix is policy code that runs no matter what the model says:

• a tool allow-list for each agent
• schema validation on tool arguments
• parsing that sends the decision to a human when fields are missing
• short-lived, narrowly scoped credentials
• human approval for destructive, financial or external-egress actions

Detection is cheap. Log every tool call along with where its input came from. Then alert when a call's arguments match untrusted input word for word, or when an agent uses tools outside its normal pattern. Most SIEMs can do this today.

If a model's output can authorize an action, so can an attacker's text. Put the decision in policy code the model can't argue with.

The two decisions give opposite answers to the same question. Workday is opening its HR and payroll records to outside agents through connectors and actions. JPMorgan is turning them away. "We're not going to allow just any outside agent to come in inside the company because that's just too risky for clients and for JPMorgan," Jamie Dimon said, per The Information. Most companies sit on both sides. You buy SaaS that now accepts agents, and you run customer accounts that agents will try to get into.

Why the logs can't tell the agent from the user

An agent using a person's delegated credentials looks like that person in most audit trails. That muddies who did what in an investigation and who is liable in a dispute. In Workday's case, the agent is a model making probabilistic choices while reading text attackers can write, such as resumes, tickets and inbound email. It also holds reach into compensation, direct-deposit details and vendor master data. The high-value abuse is a manipulated agent changing bank details. That is our threat model, not a reported incident.

The Information also points to pricing as a security factor. Workday's grace period ends when per-use charges begin in February 2027. We expect agent sprawl during the free period. Once charges start, cost pressure tends to push teams toward shared tokens and unmanaged integrations, which are the patterns that defeat detection.

Calendar invites show the auto-accept problem

Treat Sublime's figure with care. It comes from one detection vendor, with no baseline and no named actor, and almost certainly started from a small base. The mechanism is concrete, though. The lure sits in calendar fields rather than an attachment, so filters tuned for attachments and message bodies can miss it. When an AI assistant accepts on the user's behalf, the event looks pre-vetted before anyone has read it. If the same assistant summarizes meeting descriptions, a hostile invite could also carry instructions aimed at the model. That last point is our extension, not something the reporting covers.

Computerworld adds a sense of scale: 7% of respondents say agents built by business users have gone rogue. Neither the sample nor the definition of 'rogue' is given, so treat the figure as a direction, not a measurement.

The move

Treat agents as their own class of non-human identity. Each one gets its own principal, a named owner, read-only access by default and credentials that expire. Any change it starts to bank details, compensation, payment data or roles needs step-up approval. Then answer your own version of the JPMorgan question in writing: which outside agents may touch your customer accounts, and through what scoped, revocable token.

An agent holding your user's credentials is that user in your logs, so decide which agents get through the door before they show up.