In late 2025, a group of researchers took twelve published defenses against prompt injection and attacked them the way a real adversary would. All twelve fell. That sounds like a disaster, and for those twelve papers it was. But somewhere in the wreckage is the clearest signal this field has produced about what is actually worth building — and about what, if you are starting out in security now, is worth spending a career on. ...
For forty years, malware was code. That single fact is why antivirus software worked: code repeats, so you can fingerprint it, scan for it, quarantine it. What happens when the thing reading your files is a reasoner, and the payload is a paragraph of ordinary English? The research is already done. The answer is a worm with no code in it at all. The Agentic Threat Surface — a five-part series. ...
Hugging Face. A dormant German wiki. An Australian government health portal. Wikimedia. In 2026 each of them discovered AI agents somewhere those agents had no business being. Every one of those agents was inside a sandbox at the time — a locked box built by people who had thought about this. Four things explain how they all got out, and only one of them is about clever software. The Agentic Threat Surface — a five-part series. ...