Stories This Week
- Top Story: Fake AI assistant browser extensions in the Chrome Web Store — impersonating ChatGPT and DeepSeek tools — hit 900,000 installs across 20,000+ enterprise tenants. Some agentic browsers auto-installed them without user approval.
- CVE-2026-2256 (CVSS 9.8): Command injection in ModelScope's MS-Agent framework. Regex-based denylist bypassed via prompt injection — gives attackers arbitrary OS command execution. No patch yet.
- "Death by Notepad": CVE-2026-20841 (CVSS 8.8) — Windows Notepad's Markdown rendering created an RCE vector via unsanitized protocol handlers. Patched in v11.2510+.
- M&A Wave: Proofpoint acquired Acuvity (agentic workspace security), Zscaler acquired SquareX (browser security), and Thales launched AI Security Fabric (runtime protection + MCP gateway).
Curator's Corner
Agent memory needs its own zero trust moment. Most AI agents treat their memory — vector databases,
RAG indexes, conversation logs — as ground truth. Three independent research tracks this week show why
that's dangerous: LPCI encodes dormant payloads into agent memory (43–49% success), AI Recommendation
Poisoning documents 31 companies gaming agent memory in the wild, and MINJA achieves 95%+ injection
success rates. OWASP now lists this as ASI06. The proposed direction: treat every stored context record
as untrusted input — score it, validate provenance, verify before the agent reasons with it.