Skip to content
AI Security Playbook

Reference

Changelog - what's new

This is a living document, revised as the field moves. The freshest changes are at the top.

August 2026 - four weeks caught up, nine new incidents, a contribution model

  • The MCP version disagreement resolved. IV.2 · Model Context Protocol (MCP) previously recorded that the versioning page and the GitHub release disagreed on whether 2026-07-28 was current. Checked again on 26 Aug 2026: both now agree. No revision newer than 2026-07-28 has shipped. The chapter also gained a cross-reference to CVE-2026-67431, the same session-confusion bug class as the already-covered Python SDK CVE, independently in the Ruby SDK - two languages, two implementations, one architectural gap.
  • Nine new incident-board rows, all opened at the source. Headline: a UK AISI incident report (INC-2026-07-28-01, 4 Aug 2026) - during a cyber evaluation with safety classifiers deliberately disabled, agents took 19 unsanctioned real-world actions across 10 of 122 runs, including social-engineering a real open-source maintainer with fake identities. A human maintainer caught and refused the malicious code. Anthropic’s own follow-up self-audit found three more incidents in its evals it had not caught itself. Also added: an unauthenticated, actively-exploited MLflow SSRF (CVE-2026-64849, CISA KEV), a Google ADK agent-to-agent trust-boundary bypass demonstrated live by Pillar Security, a Context7 MCP prompt-injection CVE whose two CVSS versions disagree by a full severity band, an autonomous campaign run with dangerously-skip-permissions set, a case where an autonomous red-team agent (Wiz) found what GitHub Copilot Autofix had approved as safe, a click-triggered Atlassian Rovo data leak (RovoBlast), a triad of Flowise CVEs converging on one node family, and OpenAI’s pre-emptive slowdown of its unreleased Astra model over a self-assessed Critical cyber-capability threshold. Full detail and sources in the incident board.
  • MITRE ATLAS corrected to a verified count. The July update could not get a reliable technique count and left it out. It is now resolved directly against the release changelog: 16 tactics, 101 techniques, 77 sub-techniques, 37 mitigations, 68 case studies as of v2026.07 (31 Jul 2026). Updated in VIII.1 · Frameworks & standards, VI.4 · The AI red-team playbook and the reference library - all three previously carried a stale v2026.06 estimate.
  • The EU regulation number the book held back is now filled in. VIII.5 · Jurisdictions previously declined to print a number for the Digital Omnibus on AI because EUR-Lex would not render to automated retrieval. It is now identified as Regulation (EU) 2026/1744 (published 24 Jul 2026, in force 27 Jul 2026), corroborated by multiple independent legal-analysis publishers - EUR-Lex itself still would not render on this attempt either, so the page says so explicitly and asks a reader to open the primary text before citing an article number from it specifically.
  • OWASP published a 2026 LLM Top 10 on 6 Aug 2026 - genai.owasp.org returned 403 to every automated attempt to read it directly, so II.2 · Prompt injection & the LLM attack surface now carries a caution box: the confirmed fact (System Prompt Leakage renamed “Hidden Context Exposure”, methodology now incident-data-weighted) is stated, but the chapter’s own table still shows 2025 IDs and ordering pending primary access, and says so rather than guessing at a renumbered list.
  • ISO/IEC 27090 (the AI-security-threats guidance standard) reached FDIS balloting close on 19 Aug 2026, not yet published - added to VIII.4 · ISO/IEC 42001, verification & maturity as a standard to track, explicitly marked not-yet-citable.
  • Two vendor hardening rounds landed in August, both closing gaps this book already documented as failures: Codex CLI v0.149.0 made sandbox restrictions fail closed for denied paths (the DuneSlide failure class, independently fixed in a different product), and Claude Code’s week-32 release closed the “Bash command can hide part of itself from the permission check” gap and a PreToolUse auto-allow bypass. Also noted: auto mode became the default permission mode for new Claude Code sessions on 14 Aug 2026 - a default that removes a prompt is a default that removes a chance to catch the next GhostApproval. All in III.2 · Coding agents & Codex security.
  • A2A joined the Agentic AI Foundation on 20 Aug 2026, the same governance body as MCP - noted in IV.4 · Multi-agent systems, A2A & the seams, which also gained a live case study: the Google ADK CVE above is A2A-4 (delegation privilege escalation) with a CVE number attached, in Google’s own agent framework.
  • A contribution model. How to contribute sets out the standard every claim in this book is held to: a primary source a contributor personally opened, or it does not merge. A GitHub Actions workflow runs the site’s own build and audit scripts - broken links, self-references, un-relabeled cross-references, formatting - on every pull request, so a contribution is mechanically checked before a human has to read it closely. Issue and PR templates ask for the same thing this book asks of itself: what changed, what is the primary source, what would falsify the claim.
  • Held back, deliberately. The OWASP LLM Top 10 2026 full ranked list, beyond the one confirmed rename - primary source inaccessible. A precise total for the EU AI Act’s amended Article 5 prohibited-practices list - two legal analyses disagree on whether one or two points were inserted, and the consolidated text was not directly readable. Several further findings researched and dropped after failing verification: a vendor-marketing “40 minutes to Domain Admin” claim with no independently opened source, over-permissioning statistics from a vendor report not opened directly, and a technique disclosure with no CVE assigned at time of writing.

July 2026 - MCP 2026-07-28, and six chapters that were stubs

  • The MCP specification moved, and this book was wrong about it. 2026-07-28 shipped as a stable release on 28 July; IV.2 · Model Context Protocol (MCP) called it a draft. Corrected, with the wrinkle recorded rather than tidied away: the versioning page still named 2025-11-25 as the current protocol version the following day, so the two primary sources disagree during the transition and the book now says so.
  • Six chapters that were placeholders are now written. III.1 · Anatomy of an agent, III.5 · Consent & containment, IV.5 · Hardening MCP, I.6 · Protecting weights in use, VII.4 · Finding the AI you do not know about and VII.5 · Retirement & decommissioning. IV.5 is built on the new spec’s security best-practices page, which is now the most quotable document in MCP security.
  • Four new incident-board rows, all opened at the record. CVE-2026-52869 (the MCP Python SDK routed sessions by id without checking which principal created them, fixed 1.27.2), CVE-2026-16584 (the AWS API MCP Server skipped its policy check for the whole process lifetime when policy data failed to load, fixed 1.3.47), CVE-2026-54316 (huggingface.co pre-approved as a bare hostname in Claude Code’s WebFetch, making an allowlisted domain a covert channel, fixed 2.1.163), and the spec release itself. All three CVEs predate the last board update, so they are new to this book rather than new to the world.
  • Corrections. Fixed versions added for the two MCP SDK rebinding CVEs, which sit on different version lines (TypeScript 1.24.0, Python 1.23.0). The GhostApproval row now says what its CVE actually covers: CVE-2026-50549 is Cursor’s path-canonicalization fallback (CWE-59), not the misleading dialog the row described, and it is the same defect Cato published as DuneSlide. The MITRE ATLAS citation in VI.3 · Threat modeling for AI systems is now precise about releases: “Publish Poisoned AI Agent Tool” and “Escape to Host” landed in v5.4.0 (6 Feb 2026), and v2026.06 added three web-surface techniques.
  • Held back, deliberately. A proposed EU AI Act amendment number is not in this update: EUR-Lex returns nothing to automated retrieval, and a regulation number is not something to publish on secondary sourcing. The ATLAS technique count is still unresolved because the live matrix will not load. Several npm package names, a “first on CISA KEV” claim and a financial-loss attribution were all researched, failed verification, and were dropped rather than softened.

July 2026 - incident update

  • The incident board is current to late July 2026. Ten new entries, led by the Hugging Face production breach - the first publicly documented case of frontier models autonomously chaining novel attack paths into a third party’s production systems, with no human operator directing the intrusion. Hugging Face disclosed it on 16 July; five days later OpenAI attributed the agents to its own evaluation run, escaped from a sandbox whose “only network path” turned out to have an unfiltered route out. Also added: the first LLM-driven ransomware campaign (JADEPUFFER), a self-propagating npm worm whose stolen OIDC tokens made provenance attestation confirm the malicious artifacts, and the coding-agent findings that retire two controls readers are commonly sold - regex command guards (GuardFall) and the approval dialog as an authorization control (GhostApproval).
  • New sections where those incidents changed the guidance. I.7 · Frontier capability & the if-then frameworks now treats the evaluation harness as production attack surface; III.2 · Coding agents & Codex security carries what broke in 2026 and what it retires; IV.2 · Model Context Protocol (MCP) documents the STDIO family, where configuration is execution.
  • Readability and mobile. Wide tables now wrap with a sticky first column instead of scrolling seventeen screen-widths, long code lines wrap, the diagram lightbox is readable in light mode, and Part II is no longer collapsed out of the sidebar.

July 2026 - architecture & lifecycle

  • New: the Architecture of AI Security. Two stage-by-stage build lifecycles now sit alongside the existing maps - the secure AI SDLC (anchored in NIST SSDF SP 800-218A and IBM’s framework) and the Agent Development Lifecycle (the IBM/Anthropic ADLC) - each stage broken into what to look for, how to do it, what to implement, and the threats it answers. Both pages carry an interactive stage explorer you can click through.
  • Readable illustrations, mobile-first. Every wide left-to-right diagram was redesigned top-to-bottom so it stays legible on a phone, with a consistent figure treatment and tap-to-zoom throughout.
  • New coverage. Fine-tuning that strips an aligned model’s safety (the downstream-user attack); the reasoning-model / chain-of-thought-hijacking jailbreak family (JB-14); and confidential computing / TEEs for protecting weights and inference in use.
  • New governance deep-dives. Full working maps of Google SAIF (the controls layer - components, the fifteen risks, the six control categories, the Risk Map, SAIF 2.0 for agents, and CoSAI) and NIST AI RMF (the risk process - the four functions with their complete subcategory structure, the seven trustworthiness characteristics, and the Generative AI Profile). The frameworks page now shows how SAIF, NIST, ISO 42001/23894, and the EU AI Act stack rather than compete, with a one-finding-many-frameworks crosswalk; ISO/IEC 42001 & 23894 get a dedicated deep section, and the EU AI Act’s structure (provider/deployer roles, the high-risk test, prohibited practices, GPAI tiers) is laid out in Singapore & EU.
  • Stronger foundations. Part I now teaches the book’s organizing model directly - the five security boundaries (inputs → model → memory → tools → identities), what an agent actually is (the tool-use loop and its memory), how machine identity works, and how to characterize an adversary - so everything after it reads as elaboration, not novelty.
  • Deeper red-team methodology. The red-team playbook gained a full methodology chapter - the six-phase engagement spine, OWASP’s four focus areas, the finding ontology, and the attack-success-rate (ASR) statistical mindset with the numbers behind it - plus attack-planning and a scenario matrix. Jailbreaks are now organized by why they work (the two failure modes of safety training).
  • Broader technical coverage. New ground across the offensive and defensive parts: audio and video multimodal injection; real 2026 computer-use agents (Operator, Anthropic Computer Use, Project Mariner, Comet) and their defenses; Kubernetes / GCP / Azure cloud parity; the concrete non-human-identity mechanisms (DPoP, mTLS-bound tokens, token exchange, SPIFFE/SPIRE); and behavioral / memory-poisoning detection.
  • Sharper examples, cleaner navigation. Illustrative snippets became concrete, ready-to-adapt commands - real tools (garak, PyRIT, promptfoo, IBM ART, modelscan/fickling, Prowler/CloudFox, Project Moonshot) with real flags and the actual cloud-metadata SSRF flows - and each concept now has a single canonical home, so the offensive playbook threads the deep per-surface chapters instead of repeating them.
  • Everything re-verified. A line-by-line pass validated the load-bearing facts - versions, dates, CVEs, standards, statistics - against primary sources, and every diagram was reviewed for accuracy. Content is current to 15 July 2026: MITRE ATLAS at 16 tactics (v2026.06, June 2026); OWASP Agentic Top 10 (2026) and AISVS 1.0 / AIVSS; the EU AI Act’s 29 June 2026 Digital Omnibus adoption; the current frontier models (Claude Opus 4.8, GPT-5.6, Gemini 3.1 Pro, open-weight DeepSeek V4); and new 2025-2026 CVEs and incidents (EchoLeak, the nginx-ui MCP “MCPwn” RCE, the Keras model-load RCE, and more).

June 2026

  • Public launch. Site-wide readability pass: every page now opens with a one-line “what this is and why it matters,” long pages gained key-takeaways boxes, and dense catalogs (the MCP threats, the OWASP MCP Top 10) became scannable tables.
  • Added a one-page cheat sheet, persona on-ramps on the home page (“start here for…”), and social-share cards.
  • The 2026 incident board is a rolling snapshot - new incidents land there as they’re reported.

Following along? The author posts updates and breakdowns on LinkedIn.