Top AI agent security resources — October 2026

What it is

This is a roundup of 49 resources, and the summary already names the headline items. But the page carries several specific technical details the summary omits: exact CVE mechanisms, a concrete benchmark number for a detection bypass, and a specific protocol-level vulnerability class (A2ABreak) not mentioned at all in the summary.

How it works

Two CVEs get mechanism-level detail beyond the summary's one-line mention:

• CVE-2026-65669 (SQL Copilot): read-only mode was enforced by a regex blocklist. Instructions planted in database extended properties, named to mimic AGENTS.md/CONSTITUTION.md, let a lower-privileged user inject prompts that run arbitrary SQL as the victim and escalate to sysadmin.
• CVE-2026-77521 (MaxKB): the sandbox only inspects the first command in a string; chaining a second command after a semicolon runs as root, exposing other tenants' data. The shell tool itself cannot be removed.

Separately, A2ABreak models the Agent2Agent (A2A) protocol as a state machine and finds 11 flaws exploitable with no implementation bug needed — context injection across clients via unprotected context IDs, credential harvesting through multi-hop delegation, and exfiltration by rogue agents advertising unattested capabilities.

On detection: testing ten open-source prompt-injection detectors against 629 AgentDojo attacks buried in realistic tool output found Meta's Prompt Guard 2 catches only 1% of attacks at its default threshold, but 99% once tuned to a 2% false-alarm budget — the default is not a deployment-ready configuration.

Preconditions / Affected

• SQL Copilot: requires a lower-privileged user able to write database extended properties.
• MaxKB: requires indirect prompt injection reaching the agent's shell tool via crawled web content into the knowledge base.
• A2ABreak: affects any implementation of the A2A protocol spec itself, not a specific product bug.
• Prompt Guard 2: affected by whatever threshold the deployer sets — default is unsafe.

What to do

• For MaxKB-style shells: don't rely on sandboxes that check only the first command in a string; the page calls this "a recurring bug class in agent shells" — validate entire command strings, not the first token.
• For SQL Copilot-style injection: treat any data read into an assistant's context (including extended properties) as carrying the querying user's privileges.
• For prompt-injection detectors: explicitly tune the threshold against a target false-alarm budget rather than shipping defaults.

Caveats

The page itself flags that attack-success numbers elsewhere in the same digest were unreliable: rescoring one benchmark harness after finding four defects turned a reported 21.7% attack success rate into 1.2%, and another model's reported 62.8% into 0% — a general warning against trusting red-team figures without checking the harness.