Prompt Injection

The Model Context Protocol (MCP) lets AI agents call external tools and data — and introduces real risks: tool poisoning, indirect prompt injection, over-broad permissions, credential exposure and supply-chain trust. The risks that matter and the controls that reduce them.

Google’s Harness² lets an AI agent rewrite its own harness — prompts, guardrails, memory, tools — per task, weights fixed. A calm read of what it is and the governance controls it demands.

A new class of free, open-source tool — Muxin is the latest — runs AI coding agents (Claude Code, Codex, OpenCode, Gemini CLI, or a plain shell) across your Macs, Linux servers, Windows PCs and cloud machines from a single window, with persistent TMUX-style sessions and one-click commit/push/PR. It is genuinely useful. It also concentrates reach into every machine you own behind one app, hands autonomous agents write access and a shell on all of them, and lets those agents keep running after you close the lid — the "lethal trifecta" at fleet scale. Here is the real risk surface and how to run one safely.

Researchers at swarmcha.se report that between 28 Sept and 8 Oct 2026, a fleet of internet-connected AI agents running on Tencent Cloud repeatedly tried to extract Amap (Alibaba mapping) data — bypassing anti-bot defences by abusing a public URL-scanning service as a remote browser, and in several cases using exposed API credentials found in public source. Attribution to any specific Tencent team is explicitly uncertain. Here is what was reported, the heavy caveats the authors themselves raise, and what it means for anyone running or defending against internet-connected AI agents.

What Google AI Edge Foresight is: Google's on-device, local-first AI meeting notetaker for Apple Silicon Macs — plus the platform/Windows question and the security checks a CISO runs first.

Google Labs' Project CC is a family AI assistant with its own verified Google account, email address, and permission to act in Gmail, Calendar, Drive and Maps. Strip away the household framing and it is the clearest consumer preview yet of the hardest problem in enterprise AI: giving an autonomous agent a scoped identity, delegated data access, an action-approval gate, and an isolated runtime — plus the prompt-injection exposure that comes free with an agent that reads forwarded email.

Prompt injection explained for practitioners: direct vs. indirect attacks, why tool-calling agents make it worse, real attack patterns, and the defenses — treat tool output as data, scan it, and constrain what agents can do.

A defensive brief on a fast-rising risk class: malicious or compromised LLM routers and MCP gateways that inject unintended tool calls, steal credentials in transit, and pivot across hosts. What the attack looks like, why it scales, and the controls that actually contain it.

From RovoBlast to EchoLeak — a single click can now turn your enterprise AI assistant into a data exfiltration tool. Here is how the attacks work, a timeline of every known incident, and what security leaders should do about it.