|
Happy Thursday, there 👋
Yesterday we said the evidence layer is the moat — the audit log, the lineage, the proof of who authorized what. That still holds. But a careful reader would have caught what we left hanging: if the moat is the thing incumbents are fortifying, the implied advice is wait, then buy it from them.
The correction showed up this week from an odd direction. The best defensive work on the tape didn’t come from a vendor platform. It came from a research team publishing a technique with no SKU attached, and from an open-source repo that is six days old.
The vendors announced. The researchers shipped. Today is about what that difference costs you — and what it doesn’t.
The Big Thing
The defense that borrows the attacker’s conscience
In Issue #34 we said an agent’s attack surface is everything it ingests. On July 14 a research team published the measured inverse — and buried the most important sentence in its own FAQ.
A context bomb is a short string hidden in a decoy resource that trips an attacking agent’s own safety guardrails. Your fake secret gets read, the agent refuses, and it stops itself.
Obvious part first: Tracebit sells canaries — the decoys this runs on — and has built context-bomb support into its product. Every number below is Tracebit’s own, from its own imitation AWS environment. Not an independent benchmark.
Tracebit reports 152 scored runs against an imitation corporate AWS account whose misconfigurations opened ten distinct attack paths. Five models were pointed at it: Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro, Kimi K2.6 — the attackers here, not products under review. Agents completed at least one attack path in 91% of baseline runs and 15% of bombed runs. Opus 4.8 reached full admin in 93% of clean runs and failed every bombed run; Gemini 3.1 Pro also fell to zero. The most capable attackers fell hardest. Kimi K2.6 reached admin least often and was least affected — though Tracebit says bombs were “still quite effective” against it.
The bombs work by borrowing the attacker’s conscience. Tracebit reports Western models stop on strings referencing dangerous biological topics, and Chinese models accessed through Chinese providers on politically sensitive-in-China strings in Chinese. Your defense is tuned to whose safety training is pointed at you.
Which is why Tracebit’s FAQ is the story. They have not tested “abliterated” models — guardrails surgically stripped — and say whether bombs work on them is an open question. Read that against our Check Point item below: the attackers Check Point ranks most dangerous are the ones removing safety controls. This defense degrades against exactly the attacker who cared enough to remove what it depends on. Tracebit said so themselves.
The quieter finding is the useful one: the alert fired either way. Tracebit reports not one run got through an attack path without raising a canary alert — bombed or not. You aren’t buying a shield; you’re buying warning plus friction.
Ship it? Deploy — narrowly. This doesn’t fix prompt injection; Tracebit says so, and the UK’s NCSC has held since December 2025 that it may never be closed the way SQL injection was. It raises attacker cost in one measured scenario. Plant one canary string in a non-production path your agent reads, and alert on it. The alert is the value; the bomb buys minutes.
Sources: Tracebit’s own research writeup (working paper, July 2026), read in full; corroborated by Help Net Security (Jul 14). All figures Tracebit-reported.
Tour de Headlines
🗂️ Your agent’s config file is executable and nobody reviews it. On Jul 15 Check Point published its AI Security Report 2026 — vendor-reported findings, via Help Net Security. The one that matters: attackers plant malicious instructions in agent config files such as CLAUDE.md, which auto-load at the start of every session and stay active until someone deletes the file. Name the class, not the file — any convention that auto-loads into an agent’s context is an un-reviewed, persistent instruction channel, and every framework has one. In #34 Ghostcommit was the proof-of-concept; Check Point says it’s a field technique now. Ship it? Deploy the mitigation: git-blame your agent config files and put them behind review like any other executable path. Because they are.
🌐 Yesterday a private club. Today, the phone book. Yesterday: Entrust convened a program around agent identity. On Jul 15 TechCrunch reported that Vint Cerf — co-architect of TCP/IP, out of Google last week — is advising Innovation Labs, a subsidiary of DNS registry Identity Digital. Advising, not building. Their proposal, DNSid, ties an agent’s identity to an existing domain name, with cryptographic proofs logging its registration over time. There’s a real IETF draft to read. Interim CEO Allie Kline says they’re trialing with several unnamed hyperscalers — her claim, unnamed and unverifiable. Cerf’s line: “I don’t think it’s inevitable. But what I do think is inevitable is that people will try.” Ship it? Watch. A draft is not a standard. Nothing to install.
🖥️ The most conservative vendor on the board put the human in its own footnote. On Jul 15 IBM announced Power Autonomous Operations, an agent that monitors Power systems and resolves issues through chat-style prompts. Availability first: IBM says it is expected to be generally available on September 23, 2026. The release title says “Launches” — a headline, not an availability claim. The 15x comes from IBM’s own internal testing: controlled environment, eleven Power systems, capacity thresholds preconfigured before the run, 52.59 minutes manual against 3.33 with the agent. IBM’s test, IBM’s thresholds. But read IBM’s mechanism — alert ingestion, diagnostic analysis, then remedial actions “with human-in-the-loop approval to remediate.” The machine proposes. The human authorizes. Ship it? Watch — September.
|
Sponsor
The protocol war won’t fix your sales calls.
While the giants fight over agent plumbing, the highest-stakes workflow in your company still runs unmeasured — your live sales and CS conversations. The misread discovery call. The deal where two people “aligned” on different things. The rapport that never formed, and closed-lost with no warning light. RapportScore reads the human signals in every call and email and scores how your team actually connects — B2B communication intelligence for teams that live on calls. You’re verifying the agents. Verify the conversations too.
See your team’s score →
|
Tool of the Day
🛡️ SingGuard-NSFA
Open-source guardrails for agent workflows — sits in the request path, self-hosted, free.
The Big Thing is a technique with no SKU. IBM’s answer is a purchase order dated September. Here’s the third option: a repo you can clone before your first meeting.
SingGuard-NSFA comes from the SingGuard Team at Ant Group’s AI Security Lab, published under the inclusionAI org. Four models (0.8B, 2B, 4B, 9B) and a risk taxonomy of 185 variants cross-checked against three OWASP guidelines, covering prompt injection, malicious code requests, dangerous tool use and resource abuse — on the query side and the response side. Two modes: generative reasoning for offline audit, and real-time classification the project reports at 45–57ms per sample, low enough to sit in the request path without showing up in your p99. Those are the project’s own benchmarks, not independent ones.
Honest scale check, because it matters: this repo is six days old, with 38 stars and 0 forks. That is brand new, not battle-tested — read the code before it goes near anything that matters, and don’t expect a community safety net. The license is Apache-2.0, confirmed in the repo’s LICENSE file. One more fact you need before you self-host: Ant Group is a Chinese fintech affiliate. Not a knock — a procurement question some of you have to answer.
It earns the slot for one reason. There is no purchase decision in the way. Point it at your one production agent this week.
Clone the repo →
Worth a Click
- An agent that writes to your CRM unattended. Dovetail announced a platform expansion: background agents that monitor customer signals and then update the Salesforce record, draft the follow-up, or post to Slack on their own — plus “digital twins,” synthetic customer personas built from real calls and tickets. Announced, not shipped; the twin claims are Dovetail’s. The question the release doesn’t answer is the one you’d ask in review: when an agent writes to the CRM without a human at each step, who reads the output before the customer does?
- Auto-generated tools are auto-generated attack surface. Frigade announced Skills, which lets a product’s in-app assistant discover what the product can do and turn those capabilities into tools, with the company switching on the actions it wants from a dashboard. Company-issued PR — announced, and the SOC 2 / GDPR claims are theirs. Read it next to today’s Big Thing and Check Point item: that review toggle is the entire safety story, and it’s one line in the release.
- A research firm’s moat, delivered as a tool call. IANS announced a cybersecurity MCP server putting its practitioner research into the AI tools security teams already use. It’s client-gated — if you don’t already pay IANS, there’s nothing here for you. Worth two minutes anyway for the business-model question nobody in the release wants asked: if your differentiator is expert judgment and you expose it as a tool call, what’s the plan for next year?
Look at the week’s tape honestly. IBM announced — GA expected September. Dovetail and Frigade announced. IANS shipped, to its own clients. Meanwhile Tracebit published a technique and put the strings on GitHub, Check Point published a config-file vector with a 30-second fix, and SingGuard-NSFA went up as a free repo six days ago.
Yesterday we told you the evidence layer is the moat, and the incumbents are digging in below the seam. All true. Here’s the half we left out: below the seam is also the one layer nobody has to sell you. A canary is a string. Review on your agent config files is a branch protection rule. Vint Cerf is making the same argument one floor up — an identity standard anyone can implement beats a private club, and the pressure comes from users, the way it did with TCP/IP.
Two moves today. Both free, both doable before lunch. Plant one canary in a path your agent reads. Put your agent config files behind review.
The defensible half isn’t the half you buy. That’s not the problem. That’s the discount.
— Ace, for The Agent Stack
|
