ClarityBeta

Security & Threat Intelligence

The Watch

8 min read · 1,584 words · 4 moves to watch
The Signal

AI agents are under active attack and simultaneously shipping unreviewed code at

If your security architecture doesn't treat AI agents as first-class identities and your AppSec program still assumes humans read the code they ship, you have two critical gaps widening simultaneously.

In Play

  1. Agentic AI as a Live Attack Surface

    Autonomous AI agents are being targeted by adversaries, deployed with minimal security controls, and granted persistent OAuth access to critical business systems via MCP — creating a new class of unmanaged, high-privilege attack surface that most security architectures were never designed to address.

    Ask Clarity

  2. AI-Augmented Attacks Cross the Scalability Threshold

    Commercial AI tools enabled a small threat actor group to compromise 600+ Fortinet firewalls across 55 countries in weeks using basic credential attacks at machine speed — a paradigm shift that invalidates assumptions about attacker throughput and detection timelines.

    Ask Clarity

  3. AI-Generated Code Breaks AppSec Assumptions

    Major companies are shipping 1,000+ agent-generated PRs per week with minimal human review, while 87% of top AI agents lack formal safety evaluations — creating a structural AppSec gap where code volume overwhelms review capacity and agent configuration files become high-value attack targets.

    Ask Clarity

  4. Shadow AI and Data Governance Sprawl

    Third-party AI tools requiring only a URL or prompt input are proliferating faster than acceptable use policies can track, while native LLM-to-SaaS connectors create new OAuth trust boundaries that most DLP and CASB solutions don't monitor.

    Ask Clarity

  5. Geopolitical and Vendor Ecosystem Risk Signals

    A partial DHS shutdown raises CISA continuity concerns, cybersecurity stocks dropped 20-30% YTD amid SaaS selloff fears, and AI infrastructure talent scarcity creates correlated data center delivery risk across cloud providers — all second-order risks to vendor resilience and federal threat intelligence availability.

    Ask Clarity

Deep Dives

Agentic AI Is Under Active Attack — And Your Security Architecture Isn't Ready

The Threat Is Live, Not Theoretical

Multiple intelligence streams converge on the same conclusion: autonomous AI agents are a production attack surface being actively probed by adversaries. Cisco's SVP of AI, DJ Sampath, confirmed at the Cisco AI Summit that agents are being hijacked, impersonated, and manipulated to exfiltrate data at machine speed. Simultaneously, Anthropic's Claude Code now connects to Gmail, Slack, Notion, and calendars via Model Context Protocol (MCP) integrations running autonomously on cron schedules — granting persistent OAuth tokens with broad read/write scopes across an organization's most sensitive communication platforms.

AI agents are the new unmanaged endpoints — if you're not treating them as first-class identities in your zero-trust architecture, you have an attack surface growing at machine speed with no visibility.

The Protocol Gap

MCP and agent-to-agent communication protocols have scaled far ahead of their security controls. Sampath's critical observation: these protocols scaled faster than the security around them. This mirrors the API security crisis of 2019-2022, but with higher stakes because agents take autonomous actions. At Stripe, agents access over 400 internal tools via MCP servers through their centralized "Toolshed" integration, operating autonomously between task assignment and PR submission with no human interaction.

Attack SurfaceTraditional IT EquivalentCurrent Security MaturityRisk Level
Agent IdentityService accounts / API keysLow — most agents lack managed identitiesCritical
MCP / Agent ProtocolsAPI gateways / service meshVery Low — adopted without security hardeningCritical
Agent-to-Agent CommunicationEast-west network trafficVery Low — largely unmonitoredHigh
Agent Behavioral BaselinesUEBA for human usersMinimal — most SOCs lack agent telemetryHigh

The Safety Evaluation Gap

A Cambridge study quantifies the problem: only 4 of 30 top AI agents (13%) have published formal safety evaluations. Browser agents — the most autonomous and highest-risk category — are missing 64% of safety disclosures. You cannot perform adequate third-party risk assessment on tools that haven't assessed themselves.

Dual Threat Model

Cisco frames the problem with a useful dual lens that every security team should adopt: enterprises must protect themselves from their own agents (compromised or misconfigured agents acting against the organization) and protect their agents from external threats (adversaries targeting agents as entry points). The specific vectors — agent hijacking, impersonation, prompt injection, and protocol exploitation — map to gaps most enterprise security architectures were never designed to address. Your firewall rules, EDR agents, and SIEM correlation rules don't see agent-to-agent communication. Your IAM policies probably don't treat AI agents as first-class identities.

Compliance Implications

Autonomous agents acting on regulated data create accountability challenges. For SOC 2: agent actions need audit log fidelity equal to human actions. For GDPR: agents processing personal data must be documented in records of processing activities. For HIPAA: agents accessing ePHI must be treated as workforce members. Most compliance frameworks haven't caught up — the burden is on you to interpret and apply existing controls.

What to do

  1. Audit all agentic AI deployments for agent identity, authentication, and authorization controls — treat agents as first-class identities in IAM/zero-trust architecture by March 15

  2. Inventory all MCP connections, OAuth grants, and API keys issued to AI tools across the organization by March 7

  3. Implement mandatory human-in-the-loop approval gates for all agent actions affecting privileges, production environments, or sensitive data access by end of Q1

  4. Require formal safety evaluation documentation before approving any new AI agent tool for production use, especially browser-based agents

  5. Deploy continuous behavioral monitoring for AI agent activity — tool calls, data access patterns, agent-to-agent communication — and establish baselines for anomaly detection this quarter

600+ Fortinet Firewalls Breached in Weeks — AI-Augmented Attacks Have Changed the Math

The Campaign

Amazon reported that a small group of Russian-speaking hackers used commercial AI tools to breach 600+ Fortinet firewalls across 55 countries in weeks. Amazon explicitly stated this scale would have been impossible without AI. The attack vector was mundane — weak passwords and exposed management ports — but the speed and breadth of exploitation represents a paradigm shift in attacker capability.

DimensionTraditional AttackAI-Augmented Attack (This Campaign)
Threat Actor SizeLarge team or state-sponsoredSmall group with commercial AI tools
Time to Compromise 600+ DevicesMonths to yearsWeeks
Geographic ScopeTypically regional55 countries simultaneously
Tooling CostCustom infrastructureCommercial AI subscriptions

What Changed

The MITRE ATT&CK mapping is straightforward: T1110 (Brute Force), T1133 (External Remote Services), and likely T1078 (Valid Accounts) post-compromise. The techniques aren't new — the throughput is. AI handles the enumeration, credential testing, and lateral movement planning that previously required human analysts. The old assumption that credential stuffing campaigns are slow and noisy no longer holds.

A small team with commercial AI tools just breached 600+ firewalls in 55 countries in weeks — if your perimeter security still relies on password strength and port hygiene alone, you're already behind the threat curve.

Implications for Threat Modeling

This campaign should recalibrate how you model attacker capability. A small group achieved nation-state-scale impact using commercially available tools — not custom malware, not zero-days, not nation-state resources. Your red team exercises and tabletop scenarios should now assume attackers can scan, enumerate, and exploit at 10-100x human speed. Adjust detection thresholds and response timelines accordingly.

This also intersects with the agentic AI threat: as organizations deploy more autonomous agents with network access and tool integrations, the same AI-augmented attack methodology can be turned against agent infrastructure, MCP endpoints, and agent credential stores.

What to do

  1. Scan your entire Fortinet estate for default/weak credentials and internet-exposed management interfaces immediately — enforce MFA on all admin access

  2. Review Fortinet firewall logs for anomalous authentication patterns over the past 60 days and escalate any indicators of compromise to IR

  3. Update threat models and red team scenarios to assume AI-augmented attacker throughput (10-100x human speed) by end of Q1

  4. Cross-reference your perimeter device inventory against recent Fortinet advisory history and patch any outstanding vulnerabilities within 72 hours

AI-Generated Code at Scale: Your AppSec Program Has a Structural Problem

The Paradigm Shift

A new engineering paradigm called "harness engineering" is moving from experiment to production at major technology companies. The numbers are staggering: Stripe's internal agents produce over 1,000 merged PRs per week. An OpenAI team built a million-line internal product with three engineers and zero hand-written code. A solo developer made 6,600+ commits in a single month running 5-10 agents simultaneously. Anthropic's own research found that agents falsely mark features as complete without proper testing.

From a security standpoint, this breaks fundamental assumptions underlying most AppSec programs. The published playbooks from these organizations focus almost exclusively on productivity guardrails while saying virtually nothing about adversarial threat modeling of the agent infrastructure itself.

Novel Attack Vectors

AGENTS.md as a Control Plane

The emerging AGENTS.md convention places a Markdown file at the repository root that coding agents automatically read at the start of every session. It controls architectural constraints, tool usage patterns, and behavioral guidelines. A malicious modification to this file could instruct agents to bypass security controls, disable linters, or introduce subtle backdoors in all subsequent code generation sessions. There are currently no established integrity controls for these files.

MCP Tool Integration Exposure

Stripe's agents access 400+ internal tools via MCP servers, operating autonomously between task assignment and PR submission. If an attacker can influence agent behavior through prompt injection — via code comments, dependency metadata, or crafted error messages — they could pivot through the agent's authenticated tool access to reach internal systems.

Unverified Code at Scale

Anthropic's Claude Code Security tool achieves only 50% accuracy on 14.5-hour tasks and requires limiting to 1-hour tasks for 80% reliability. AI-generated security patches that are wrong half the time create false confidence. Meanwhile, at 3.5 PRs per engineer per day with throughput increasing, the math doesn't work for meaningful human review of every change.

Your AppSec program was built for a world where humans write and understand their own code — that world ended, and every week you delay adapting, autonomous agents are shipping thousands of unreviewed lines into your production environment.

The Compliance Angle

SOC 2 and similar frameworks require demonstrable change management controls. When Greg Brockman says "ensure that some human is accountable for any code that gets merged," he's describing what your auditors will expect. But volume overwhelms reviewers. You need automated controls that are auditable, not just human attestation that becomes a rubber stamp. Brief your auditors proactively — don't let them discover agent-generated code during the audit.

What to do

  1. Conduct a threat model of AI coding agent infrastructure — including MCP server integrations, agent sandbox boundaries, credential access, and AGENTS.md integrity — by end of March

  2. Implement CODEOWNERS rules requiring security team approval for changes to AGENTS.md, CLAUDE.md, or equivalent agent configuration files across all repositories

  3. Evaluate whether SAST/DAST/SCA tooling can handle 1,000+ PRs/week and implement risk-based triage: agent PRs touching auth, crypto, or data handling get mandatory human security review

  4. Add prompt injection and agent sandbox escape scenarios to red team / penetration testing scope for next engagement

Geopolitical and Vendor Ecosystem Risks: DHS Disruption, Iranian Escalation, and SaaS Selloff

Federal Cybersecurity Continuity at Risk

A partial DHS shutdown caused a 12-hour suspension of TSA PreCheck and Global Entry before reversal. The deeper concern: DHS houses CISA, which provides vulnerability advisories, threat intelligence sharing, and incident response coordination for critical infrastructure. During previous shutdowns, CISA operated with skeleton crews, delaying vulnerability disclosures and reducing proactive threat hunting. The funding dispute appears ongoing with no resolution in sight.

Iranian Cyber Escalation Indicators

Trump envoy Steve Witkoff publicly stated Iran is "about a week away" from nuclear weapons capability. This rhetoric pattern — threat inflation combined with military posturing — has historically preceded both kinetic and cyber escalation from Iranian state actors. Known groups with demonstrated capability against U.S. targets include APT33/Peach Sandstorm (energy, aerospace), APT34/OilRig (government, financial), APT35/Charming Kitten (think tanks, media), and MuddyWater (government, telecom). No specific Iranian cyber campaign has been reported in connection with current tensions — this is a preparedness assessment based on historical correlation.

Cybersecurity Vendor Financial Instability

Cybersecurity stocks dropped on Friday, February 20, amid a broader 20-30% YTD SaaS selloff driven by AI disruption fears. Separately, OpenAI's AI model operating costs quadrupled in 2025, with gross margins falling to 33% — signaling that every security vendor marketing "AI-powered" capabilities faces the same inference cost pressure. When vendors can't sustain the economics, they either raise prices, reduce model quality, or cut corners on AI features you're paying for.

Meanwhile, AI data center talent scarcity — fewer than ~16 executives globally can build at gigawatt scale — means key-man clauses in project financing could collapse multi-billion-dollar builds if someone gets poached. Your cloud provider's next data center region may not materialize on schedule.

When DHS can't keep its own travel security programs running for 12 hours, ask yourself how confident you are that CISA will be fully operational the next time you need them during an incident.

What to do

  1. Catalog which threat intelligence feeds, vulnerability notifications, and incident coordination channels depend on CISA/DHS operations and identify commercial and ISAC alternatives by March 7

  2. Refresh Iranian APT detection coverage — validate SIEM/EDR rules for password spraying, DNS tunneling, PowerShell lateral movement, and cloud credential theft for APT33, APT34, APT35, and MuddyWater

  3. Review financial health indicators for your top 5 cybersecurity vendors — check stock performance, layoffs, and earnings guidance — and validate contract terms for price escalation clauses before renewal season

  4. Stress-test BC/DR assumptions against cloud provider capacity delays — model scenarios where planned regions are delayed 12-18 months due to infrastructure talent scarcity

The bottom line

Autonomous AI agents are simultaneously your newest attack surface and your biggest AppSec blind spot: adversaries are actively probing agent infrastructure while your engineering teams ship 1,000+ unreviewed PRs per week through agents with access to 400+ internal tools — and a small group just proved that commercial AI tools can breach 600+ firewalls across 55 countries in weeks. Extend zero-trust to agent identities, harden MCP protocols, and update your threat models for AI-speed attacks before the gap between deployment velocity and security controls becomes unrecoverable.