Top Agentic AI security resources — September 2026

What it is

A 37-resource roundup from Adversa AI covering agentic AI security for September 2026. Beyond the five items already highlighted in the catalog summary, the page carries specific, reproducible findings across memory poisoning, red teaming, and framework-level vulnerabilities that the summary omits entirely.

How it works

The month's dominant theme is that per-record content screening cannot catch agent memory poisoning, demonstrated three separate ways:

• Plain false statements (no adversarial crafting) poison 1.2% of a memory corpus and drop accuracy from 85% to 30%; a screening pipeline that catches 83% of indirect prompt injection catches 0 of 360 poisoned memories, because truth-checking requires outside knowledge the text doesn't contain.
• MemSecBench (310 cases, 48 settings) separates persistence, damage, and repair: poisoned memory survives in 84.2% of cases, the full write-then-execute attack chain succeeds in 50.3%, and targeted cleanup only works 56.1% of the time. Across 24 stack configurations, end-to-end success varies by 16.1 points and repair by 41.3 points based on harness/backend/model combination alone.
• Salami attack against OpenClaw splits payloads into fragments that look benign individually (81.3% saved, 75.0% overall attack success across 48 scenarios, 2 backbone models) — defeating any filter that inspects writes one at a time.

A separate, orthogonal finding: orchestration framework choice measurably changes compromise rate with the model held fixed. Four architectures tested under identical conditions: an isolated-task-per-step design had an 11.9% compromise rate, versus 31.1% for an architecture that feeds intermediate tool output back into context, versus 15.5% for no framework at all — a ~2.6x swing from architecture alone.

Separately, eleven vulnerabilities were disclosed across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK — not novel agent bug classes but ordinary web bugs (insecure deserialization, SSRF, path traversal, use-after-free) reimported into orchestration/memory/state layers. A checkpoint deserialization RCE in one framework drew a $10,000 bounty but no CVE was assigned.

Preconditions / Affected

Memory-poisoning findings apply to any agent with persistent/long-term memory and a content-screening or provenance-ranking defense. The framework compromise-rate study applies to multi-agent orchestration choices generally, independent of model. The eleven framework CVEs affect the listed orchestration libraries' deserialization, memory, and state-handling code paths.

What to do

Per the page's own synthesis: stop relying on content screening or provenance ranking as memory defenses — they are statistically indistinguishable from no defense against plain false statements. Treat memory writes as requiring bounding/quarantine logic rather than filtering (several resources propose write-time risk scoring and quarantine tiers). Treat orchestration/harness selection as a security decision requiring its own evaluation, since a single-configuration security assessment doesn't generalize to the same agent run elsewhere. Audit framework dependencies for the named vulnerability classes (deserialization, SSRF, path traversal) rather than assuming agent-specific threats are the only risk.

Caveats

The page notes that simple keyword-based compromise scoring overstates results by 4-6x compared to scoring that filters out refusals, and that an earlier version of the framework-comparison study (describing ten architectures with no evaluation code) was retracted by its author, though the superseded material remains in the repo.