Prompt injection attacks and silent data exfiltration have turned AI agent security from a theoretical worry into an urgent enterprise concern. As agents move from developer laptops into data centers, companies need guardrails that don’t strip away what makes agents useful. Red Hat Inc. and Nvidia Corp. have expanded their partnership to tackle that problem through OpenShell, an open-source project that sets limits on what agents can do. The threat model for agents differs sharply from that of traditional software, so the industry has to build a shared standard to secure them, according to Derek Carr (pictured, left), senior distinguished engineer at Red Hat. “Agents can’t get access to your secrets. They need deny-by-default networking, and you need a rich policy framework for what happened and when for this class of apps,” Carr said. “Nvidia had reached out to us and noted that they were seeing the same problem domain. No one wants to work on this alone. It’s better to work together.” Carr and Mrunal Patel (right), distinguished engineer at Red Hat, spoke with theCUBE’s John Furrier and Rebecca Knight at KubeCon + CloudNativeCon NA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed how OpenShell...

Introduction: The convergence of autonomous AI agents and automated data exfiltration has ushered in an era where cybercriminals execute high-velocity infrastructure attacks faster than legacy security operations centers can react. Modern threat actors leverage machine learning models to automate asset discovery, craft identity-bypass payloads, and extract high-value corporate datasets before initial detection triggers fire. Addressing these escalated vector dynamics requires a pivot toward zero-trust microsegmentation, aggressive mTLS network enforcement, and strict agent governance.

Security researchers at Check Point Research discovered a vulnerability in ChatGPT that allows an attacker to bypass the heightened security of Lockdown Mode and leak your entire chat history with zero user interaction. Lockdown Mode is a setting you can enable in ChatGPT to limit "to the web and external services to help reduce data exfiltration risk from prompt injection attacks." The setting works on a similar idea to Apple's Lockdown Mode: it disables features that pose a security risk to defend against potential exploits. However, OpenAI's Lockdown Mode is specifically designed to prevent data exfiltration from prompt injection attacks. These attacks exploit an inherent security flaw in AI chatbots: they can't tell the difference between instructions and input. In other words, they inherently can't tell the difference between what they were originally told to do and what the user is telling them to do right now. Instead, they rely on training and guardrails in order to distinguish the difference, but it's a cat-and-mouse game. A malicious actor can find a way around the guardrails and instruct the bot to send sensitive data off to them, for example. But if the model can't exfiltrate data out of the chatbot, then even if a prompt injection attack occurs, the private data of the user is safe theoretically. This is the idea behind Lockdown Mode. Check Point found a way around Lockdown Mode using the HTML preview feature added back in February 2026. OpenAI attempted to protect the feature by implanting guardrails and sandboxing the URLs in iframes. But, they gave them permissions such as `allow-popups` and `allow-popups-to-escape-sandbox`. An attacker can open a popup, which will not be executed in the sandbox, and place any arbitrary HTML code in it. > This vulnerability opens a wide attack surface. It could enable the covert theft of entire chat history and uploaded files, the distribution of malware disguised as a legitimate update, and even credential theft. Check Point Research says they disclosed the vulnerability to OpenAI in September and OpenAI has deployed a fix by removing the `allow-popups` and `allow-popups-to-escape-sandbox` permissions from the iframes. Check Point had previously discovered another data leak in ChatGPT using a single malicious prompt using DNS to exfiltrate user data.

Microsoft reports that threat actors used agentic AI tooling to find exposed GitHub secrets and abuse application credentials across Azure and Microsoft 365…

Two infrastructure-safety stories stood out in the window ending November 4, 2026: a federal cyber advisory on AI-enabled Siemens PLC attacks and a cloud security survey showing data-loss prevention tools often detect breaches only after exfiltration. The first targets the physical control layer beneath facilities; the second exposes how data can leave before controls respond. Both cut across compute and data-center operations, and the analytical finding is that resilience is under pressure on both sides of the data path. ### How the PLC campaign works On August 19, 2026, NSA, CISA, FBI, DOE, and EPA issued joint advisory AA26-231A warning active, AI-enabled attacks against internet-exposed Siemens S7 PLCs across six sectors: water/wastewater, energy, manufacturing, chemical, agriculture, and defense industrial base. Advisory reference The advisory reports threat actors pair AI-generated scripts with internet scanning to find exposed PLCs. At least 30 Minnesota water utilities were targeted in late July 2026 before campaigns broadened. Documented impacts include pumps stopping, valves malfunctioning, a temporary treatment-plant shutdown at Braham, and forced manual operations across seven states. The advisory frames AI-assisted code generation as a driver that lowers the technical bar for attackers, but that causal label comes from the advisory itself, not independent verification. ### The DLP survey: detection after the fact Cloud Security Alliance published findings on October 9, 2026, with follow-up reporting on October 26. CSA article The survey found that 73% of organizations experienced at least one confirmed data loss incident in the past 24 months, but only 16% said DLP blocked their most significant incident before data left the organization. GenAI was ranked the top exfiltration risk by 48% of respondents, yet only 22% strictly block GenAI channels. Cloud storage uploads followed at 41% risk, 19% strict block. Alert fatigue is the mechanism. Security Brief 54% triage false positives; 90% report measurable impact from alert fatigue; 71% of respondents reported pushback on DLP enforcement during the past two years. Among teams with pushback, 66% reduced enforcement for specific teams/use cases, 8% reduced broadly, and 3% paused program. The survey also found fewer than a third of organizations could produce a routine 30-day report on sensitive data sent to AI tools. ### Remaining constraints The PLC advisory confirms active campaigns and specific sector exposure, but it does not establish the number of fully compromised facilities or the total revenue of disrupted output. The DLP survey reports respondent behavior and survey findings; it is not a record of any specific breach or customer loss. Neither event connects to compute-failure, data-center power, cooling, or grid incidents in this window. **Evidence status** * **Established:** Joint federal advisory AA26-231A (Aug 19, 2026) documents AI-enabled PLC targeting across six sectors and 30+ Minnesota water utility targets. CSA survey (Oct 2026) reports 73% data loss incidence, 16% pre-exfiltration DLP blocking. * **Unresolved:** Absolute facility counts, production downtime hours, and material customer impact for both stories remain undocumented. * **Observable milestone:** Advisory AA26-231A issuance as the first public, multi-agency confirmation of active PLC exploitation in the current window. Explore more coverage on BeansSearch this story across publishers→

TrendAI analyzes three cyber campaigns involving autonomous and AI-assisted attacks, including CyberStrikeAI activity targeting Japan.

Two additional organizations have appeared in ransomware threat-monitoring reports, with SafePay and Vexy separately claiming responsibility for attacks dated October 31, 2026. The reported victims are Taiwan-based Golden Crops and an organization identified as SYSTEM SOFT. While the claims indicate potential cyber incidents, independent confirmation of unauthorized access, encryption, or data exfiltration remains unavailable. Reported Incidents ThreatMon has reported two new ransomware victim claims:

Curate Feeds | Make Collections | Customize Email Briefs

Security researchers detail three cyberattack campaigns against Japanese organizations that utilized artificial intelligence, including the automated...

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Introduction: The cyber threat landscape is accelerating through high-velocity vulnerability weaponization, persistent state-sponsored espionage, and AI-augmented campaign execution. As highlighted in KELA’s daily intelligence pulse, perimeter media servers are being compromised via multi-stage exploit chains like Plex2Shell, while advanced persistent threat (APT) groups like Iran's "Prince of Persia" leverage domestic cloud infrastructure for stealthy exfiltration. Concurrently, autonomous AI agents and automated vulnerability scanners continue to shrink the window between public disclosure and total system compromise.

Splunk has issued a warning that malicious actors are actively exploiting a critical code smuggling vulnerability in Splunk Enterprise. The company has released updates to address the flaw, though specific technical details such as CVE identifiers, affected versions, or exact exploitation methods were not disclosed. The attacks target the vulnerability to compromise Splunk Enterprise instances, though the precise impact—such as potential data exfiltration or remote code execution—remains unspecified. No timeline for the attacks or patch availability was provided in the notice. The advisory emphasizes the urgency of applying the available updates to mitigate risks.

Introduction: Large Language Model (LLM) applications are increasingly vulnerable to sophisticated prompt injection and secret exfiltration attacks that bypass standard instruction tuning. Setting up a local red-teaming lab using frameworks like Promptfoo and FastAPI enables developers to proactively identify security gaps before deployment. Learning Objectives & Secrets: Objective 1: Understand LLM prompt injection mechanics and how sensitive data leakage occurs in customer support chatbot architectures.

Unit 42 investigation reveals threat actor

Introduction: ARTEX is an open-source agentic AI penetration testing framework written in Go that integrates large language models (LLMs) like Claude, GPT, and DeepSeek to orchestrate automated offensive security workflows. By chaining reconnaissance, vulnerability discovery, password spraying, OAuth abuse, and data exfiltration at machine speed, it lowers the barrier for complex multi-stage attacks. Understanding its architecture and defensive hardening is critical for modern security operations centers (SOCs) facing automated threat vectors.

Introduction: The Canadian Centre for Cyber Security has issued an urgent advisory regarding a high-severity vulnerability in Roundcube Webmail that is currently being actively exploited via SQL injection attacks. Small and medium-sized enterprises (SMEs) relying heavily on webmail platforms face significant risk of authentication bypass, arbitrary database command execution, and unauthorized data exfiltration if patching cycles remain neglected. Understanding the mechanics of these exploits and enforcing rigorous server-side hardening is vital to safeguarding organizational infrastructure.

Learn how to trace two invisible threats in a multi-agent AI pipeline, prompt injection propagation and cross-tenant data exfiltration, using Amazon OpenSearch Service and Amazon Bedrock. Instrument every agent hop with embeddings, provenance, and PII detection, reconstruct the attack path, and add guardrails that stop these attacks before they reach production.