AI moves fast. Stay in the know.

The OWASP GenAI Security Project's latest State of Agentic AI Security and Governance report marks a significant shift from its 2025 predecessor. Where last year's edition cataloged plausible threats, the 2026 edition catalogs actual CVEs, vendor advisories, and breach reports tied to nearly every category of agentic AI risk. Coding agents — tools like Claude Code, Cursor, Codex, and Gemini CLI — are now the epicenter of agentic AI security failures, and prompt injection remains the common thread running through most of them. For organizations deploying AI agents in production workflows, the report signals that the risk is no longer hypothetical.

Source: Help Net Security

What to know:

• Of 53 agentic projects tracked by OWASP, 28 are coding agents, and the five fastest-growing tools (Claude Code, Gemini CLI, Codex, Cline, and Aider) all sit in that category.
• The five repositories with the most security advisories are workflow platform n8n (57), Claude Code (22), AutoGPT (15), Dify (13), and Roo-Code (11). Every project on the list is a semi-autonomous framework or coding agent.
• OWASP maps prompt injection to six of the ten categories in its Top 10 for Agentic Applications. The root cause is architectural: large language models treat system prompts, user requests, and externally retrieved text as a single stream of tokens, making it impossible to reliably separate commands from data.
• Researchers describe a "lethal trifecta": any agent that combines access to private data, exposure to untrusted content, and the ability to communicate externally can be turned into a data exfiltration tool by a single injected prompt.
• A backdoored version of LiteLLM, a language model gateway used by CrewAI, DSPy, Microsoft GraphRAG, and dozens of other AI agent frameworks, was downloaded nearly 47,000 times in a three-hour window before the supply chain attack was caught.
• Shadow AI sits inside almost every organization, OWASP's contributors examined. According to IBM data cited in the report, only 37% of organizations have a policy in place to detect it.

Why it matters:

For mid-sized businesses deploying AI agents across coding environments, desktop tools, and connected workflows, this report makes clear that agentic AI introduces a fundamentally different and expanded attack surface compared to traditional software. When agents can read untrusted content, access sensitive data, and communicate externally, often without human oversight, the conditions for data exfiltration exist by default. Organizations cannot govern what they cannot see. Without continuous visibility into agent activity, prompt-level interactions, and data flows across every AI workspace employees use, the gap between deployment and security quickly becomes a liability.

The cybersecurity agencies of the United States, United Kingdom, Canada, Australia, and New Zealand issued a rare joint statement warning that artificial intelligence is fundamentally accelerating cyber risk, and that the timeline for action is months, not years. Signed by the heads of CISA, the NSA, the UK's NCSC, and counterparts across the alliance, the statement calls on business leaders to treat AI-driven cyber risk as a board-level concern, not a technical one.

Source: CISA

What to know:

• The Five Eyes agencies issued a joint statement on June 22, 2026 — one of the most coordinated high-level calls to action the alliance has published on AI and cyber risk.
• Frontier AI models are expected to exceed current industry expectations within months, fundamentally transforming both offensive and defensive cyber capabilities.
• AI is compressing the window between vulnerability discovery and active exploitation from weeks to days or hours, while lowering barriers for malicious actors.
• Boards and executives must ensure resilience controls will perform under pressure, not just exist on paper; cyber risk is a leadership responsibility, not a technical one.
• Organizations are urged to reduce attack surface, accelerate patching cycles, harden identity and access controls, and run pre-incident preparedness exercises.
• Organizations delaying action face compounding operational, financial, and reputational risk alongside growing technical exposure.

Why it matters:

For mid-sized businesses adopting GenAI, this statement reinforces a risk already present in everyday operations. As employees use AI tools across browsers, desktops, and coding environments, organizations may lack visibility into what data is entering those systems, whether usage aligns with internal policies, or how quickly their risk exposure is changing. Point-in-time controls are no longer sufficient; AI risk requires continuous monitoring, prompt-level visibility, and governance that keeps pace with rapidly evolving AI capabilities and threat vectors.