Stories This Week
- Top Story: Two major AI platform sandbox escapes dropped this week, on the eve of RSA Conference 2026..
- Microsoft Launches End-to-End Agentic AI Security at RSA Conference: Three major announcements in 48 hours: **Agent 365** (GA May 1) delivers a control plane to observe, secure, and govern AI agents across the enterprise.
- OpenAI Acquires Astral — Third Deal in Three Months: OpenAI acquired Astral, maker of Python's most popular dev tools (uv package manager, ruff linter — 126M monthly downloads).
- Oasis Security Raises $120M for Agentic Access Management: The startup is building identity and access controls specifically for AI agents — permissions, monitoring, and access management for non-human actors in enterprise systems.
- XBOW Raises $120M at $1B+ Valuation for Autonomous Offensive Security: Two $120M AI security raises in one week.
- Palo Alto Networks: Prisma AIRS + ServiceNow AI Control Tower: Palo Alto announced integration between its AI security platform and ServiceNow's AI Control Tower, aiming to combine runtime protection with IT governance workflows.
- Azure Entra ID Sign-In Log Bypass (GraphGoblin): TrustedSec disclosed their third and fourth Azure sign-in log bypass, finding that repeating scope values overflows a database column and causes sign-in events to simply vanish from logs.
- Critical Langflow RCE — Exploited Within Hours: A critical unauthenticated remote code execution vulnerability in Langflow, a popular open-source AI application builder, was exploited in the wild within hours of disclosure.
- Claude Code Jailbreak via CLAUDE.md: Check Point Research found that attackers can modify Claude Code's project configuration file (CLAUDE.md) to override safety controls and reassign the agent's role, causing it to generate remote access trojans within the project environment.
Curator's Corner
Infrastructure was never fully hardened — and for years, it didn't need to be. Exploiting a misconfigured DNS rule or an over-permissive IAM role required real skill: understanding protocol internals, chaining privileges, building custom tooling. That complexity was a natural filter. Most attackers couldn't pull it off.
AI removed the filter.
This week, researchers broke out of AWS Bedrock's "isolated" sandbox using DNS tunneling and escaped Snowflake's coding agent via process substitution — techniques that once required deep infrastructure expertise. With AI, these attacks become reproducible, teachable, almost routine. Wiz published an AI-powered bounty hunting crash course last month. Check Point documented a single developer building 88,000 lines of deployment-ready malware in a week using an AI IDE.
That's the real shift: AI gives every attacker the tooling and complexity that once required a full-time team. The vulnerability surface didn't change — but the population that can exploit it just expanded by orders of magnitude.