https://agentssafety.com/ Filter verified AI agent runtime security advisories, OWASP Agentic threat controls, Firecracker MicroVM isolation benchmarks, and human-in-the-loop approval patterns. en-au Fri, 06 Nov 2026 00:00:00 GMT https://agentssafety.com/insights/#upstream-v1-18-0-added https://agentssafety.com/insights/#upstream-v1-18-0-added Fri, 06 Nov 2026 00:00:00 GMT #6393 : Added enclave support. Actionable takeaway: Audit hypervisor release notes and jailer seccomp profiles for untrusted agent execution. (Source: Firecracker MicroVM Releases) MicroVM Blast-Radius https://agentssafety.com/insights/#mcp-tool-description-poisoning https://agentssafety.com/insights/#mcp-tool-description-poisoning Thu, 22 Oct 2026 00:00:00 GMT Untrusted third-party tool servers can embed hidden instructions inside tool parameter descriptions that override model routing across sibling connectors. Actionable takeaway: Pin cryptographic hashes of approved tool schemas and strip unverified free-text instructions before prompt assembly. (Source: OWASP GenAI Security Project) OWASP-Agentic Prompt-Injection https://agentssafety.com/insights/#imdsv2-link-local-egress-block https://agentssafety.com/insights/#imdsv2-link-local-egress-block Wed, 09 Sep 2026 00:00:00 GMT Code-interpreter and headless-browser agents require default-deny nftables/eBPF egress rules at the hypervisor tap interface to block SSRF credential theft. Actionable takeaway: Route outbound sandbox traffic strictly through an SNI-allowlisted forward proxy that rejects private IP resolutions. (Source: AWS Firecracker MicroVM Security Design) MicroVM Egress-Firewall Blast-Radius https://agentssafety.com/insights/#nist-ai-600-1-genai-profile https://agentssafety.com/insights/#nist-ai-600-1-genai-profile Fri, 26 Jul 2024 00:00:00 GMT NIST AI 600-1 maps concrete governance and runtime measurement controls for autonomous value-transfer and external system execution. Actionable takeaway: Enforce short-lived, audience-restricted On-Behalf-Of (OBO) tokens instead of static service-account keys. (Source: NIST AI 600-1 Publication) OBO-Tokens HITL OWASP-Agentic