Opening

Muyan here with the AI Security Daily. The OWASP LLM Top 10 2026 released in August reshuffled 80% of the entries, Excessive Agency surged from sixth to third, thrusting the over-permissioning problem of agentic AI into the spotlight. In a moment I'll tell you why BlueRadius's hands-on test of 21 cases found every single one bypassed human review. Today we're also covering Amazon Bedrock AgentCore falling to a single prompt, and how embedded browsers in mainstream editors have become springboards for host code execution.

Today's AI Security Focus

1. OWASP LLM Top 10 2026 Released, 80% of Items Reshuffled, Excessive Agency Rises to Third

• What happened: The OWASP GenAI Security Project published the 2026 edition of the LLM Top 10 in August 2026. Prompt Injection held the top spot for a fourth consecutive cycle. Excessive Agency climbed from sixth to third. System Prompt Leakage expanded into Hidden Context Exposure (covering RAG schemas, hidden policy logic). Improper Output Handling dropped to tenth. According to Deepstrike, this guide is already downloadable from the official site, though the homepage still shows the 2025 content.
• Impact scope: All teams deploying LLM applications, RAG pipelines, or AI Agents in production. The ranking shifts reflect how the practical attack surface has moved from the "model layer" to the "agent permissions and toolchain layer."
• Defense recommendations: Immediately review existing threat models against the 2026 list. Prioritize Agent permission scoping and leakage risks from non-user-visible context.
• Source: Deepstrike（https://deepstrike.io/blog/owasp-llm-top-10-vulnerabilities）

2. BlueRadius Tests 21 AI Agent Incidents: 100% Bypass Human Review, 70% Involve Prompt Injection, 80% Match the "Deadly Trio"

• What happened: BlueRadius Research published a report in September analyzing 21 publicly documented cases. Findings: 100% lacked or bypassed human approval, 76% exhibited excessive permissions, 71% involved Prompt Injection (mostly indirect injection), and 81% simultaneously possessed all three elements of injection, outbound tooling, and loose permissions. Per the report, only 19% were confirmed in-the-wild incidents; the rest were vulnerability disclosures or red-team exercises, risk exposure leading actual exploitation.
• Impact scope: AI Agent systems already live or planned that can autonomously call APIs, execute code, or access production data. Model Context Protocol (MCP) related cases accounted for 29%, showing protocol-layer defenses remain immature.
• Defense recommendations: Enforce least privilege in Agent identity and permission models, mandate human-approval gates, and deploy indirect injection detection at the input layer. Move authorization and outbound traffic control out of model decision logic.
• Source: BlueRadius Cyber（https://blueradius.io/research/ai-agent-security-report-2026）

3. Amazon Bedrock AgentCore Compromised via Single Prompt to Steal Metadata Credentials; Mainstream Editor Embedded Browsers Over-Trusted Leading to Host Code Execution

• What happened: Adversa AI's November 5 resource roundup disclosed that a single prompt against an exposed Bedrock AgentCore could steal metadata service credentials, subsequently taking over all Agents in the same account and region. Embedded browsers in Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop are trusted more than regular browsers, enabling host code execution and cross-disk file reads. Per Adversa AI, TypeSafe's Jev model saw Prompt Injection recall plummet from 83% to below 4% after a forged policy preface.
• Impact scope: AWS environments using Bedrock AgentCore without metadata access restrictions; engineer workstations using the above editors' embedded browsers for development or testing.
• Defense recommendations: Immediately audit AgentCore network and IAM policies to block metadata endpoint access. Disable or isolate embedded browser local file and execution permissions in editor settings. Apply zero-trust principles to all embedded web content.
• Source: Adversa AI（https://adversa.ai/blog/top-ai-agent-security-resources-november-2026/）

4. OpenAI Releases GPT-6 Cyber, Autonomous Pipeline Finds 948 Linux Privilege Escalations and 81 Firefox Critical Vulnerabilities, Including Brotli Critical CVE-2026-111497

• What happened: OpenAI released GPT-6 Cyber on November 6, classified as Critical under the Preparedness Framework. The model autonomously discovered 948 Linux local privilege escalation vulnerabilities, 81 Firefox critical vulnerabilities, and a critical Brotli library vulnerability CVE-2026-111497 (CVSS 9.2). Official statements indicate a 99.93% probability of staying within scope without deployment safety prompts, and 100% compliance with prompts. Currently available only via API to Daybreak Red customers.
• Impact scope: Systems running affected Linux kernel versions, Firefox browsers, or the Brotli compression library. Attackers with AI-assisted red-team capabilities may accelerate vulnerability weaponization.
• Defense recommendations: Prioritize tracking upstream vendor patches. Assess asset exposure for Brotli CVE-2026-111497 and apply mitigations. Incorporate AI-discovered vulnerabilities into patch prioritization.
• Source: The Hacker News（https://thehackernews.com/2026/11/openai-launches-gpt-6-cyber-after-ai.html）

Closing

The one thing to remember from today: OWASP pushed Excessive Agency into the top three, and BlueRadius used 21 empirical cases to nail the "excessive permissions, no human gate, injection exploitable" deadly trio to the wall. Go do one thing first: pull every Agent that can autonomously call tools, scope its permissions to minimum, hang a human approval gate on it, and cut off metadata and embedded browser access. See you tomorrow.