January 2026 Summaries

Between October 2025 and January 2026, GreyNoise's honeypot infrastructure detected 91,403 coordinated attack sessions targeting LLM endpoints, marking a significant shift from theoretical to actual AI risks. These attacks comprised two major campaigns: the SSRF Campaign, which exploited model pull functionality to force outbound connections through vulnerabilities in Ollama Model Pulls and Twilio Webhooks, and the Enumeration Campaign, which systematically probed over 73 model endpoints to identify misconfigured proxies. The attackers, using sophisticated tactics, aim to inventory exposed infrastructure to exploit AI systems, treating them with the same precision used for legacy infrastructures like VPNs and CI/CD servers. This shift emphasizes the critical need for organizations to adopt proactive security measures, such as rigorous egress filtering, continuous monitoring, and AI Red Teaming, to protect their AI infrastructure from being fully mapped and exploited by threat actors. As AI becomes integral to enterprise operations, platforms like NeuralTrust are highlighted for offering essential tools for runtime protection and governance, ensuring AI systems remain secure and trustworthy in the face of advanced reconnaissance and exploitation efforts.

NeuralTrust researchers have discovered a significant vulnerability in the safety architecture of leading multimodal models like Grok 4, Gemini Nano Banana Pro, and Seedream 4.5 through a technique called Semantic Chaining, which bypasses core safety filters to generate prohibited content. This method exploits the models' complex, multi-stage image modification capabilities to circumvent safety mechanisms that typically block harmful prompts, by gradually eroding resistance through a sequence of seemingly innocuous edits. The technique thrives on fragmenting the model's safety logic, rendering it incapable of tracking latent intent across a series of instructions, thus allowing the generation of policy-violating outputs. The research highlights the inadequacy of traditional safety filters, which focus only on surface-level text, and introduces NeuralTrust's Shadow AI module as a proactive solution. This browser plugin intercepts policy-violating queries at the source, preventing them from reaching the AI model and offering a critical advantage in securing enterprise AI against sophisticated exploits like Semantic Chaining.

Security and operations teams are adapting to the challenges posed by AI agents, whose complex, recursive workflows can lead to significant security and cost issues, such as cost explosions and amplified malicious actions. Traditional rate limiting, which managed load through simple request counts, has evolved into a more nuanced approach in this agentic context, emphasizing the need for rate limiting and throttling as essential security and governance controls. Rate limiting aims to prevent abuse by enforcing hard limits, while throttling manages resource usage to ensure fairness and service quality. Key metrics like token consumption and function calls are emphasized over simple request counts, with best practices including context-aware and hierarchical limiting, prioritization of token-based metrics, and dynamic throttling for quality of service. The text underscores the importance of adopting intelligent rate limiting and throttling strategies to transform AI agents from potential liabilities into manageable assets, highlighting the role of platforms like NeuralTrust in providing real-time mitigation and security frameworks for enterprise AI deployment.

AI "Circuit Breakers" are an innovative safety mechanism designed to halt the generation of harmful content in large language models (LLMs) by intervening directly in the model's internal processes, rather than relying on external filtering or patching vulnerabilities post-output. Inspired by electrical circuit breakers, this approach uses a technique called Representation Engineering to detect and reroute harmful internal activations, ensuring that the model's thought pathways leading to undesirable outputs are cut off. This proactive method not only enhances the model's safety by preventing a wide range of attacks, including those not yet conceived, but also maintains the model's performance on standard tasks without degradation. Circuit breakers have demonstrated impressive results across various AI applications, including text-based models, multimodal systems, and autonomous agents, effectively reducing harmful outputs while preserving core functionalities. This advancement represents a significant paradigm shift towards building intrinsically safe AI systems, moving away from reactive defenses to a more efficient model of internal control, ultimately enhancing AI security by designing AI systems that are both powerful and reliably aligned with safety standards.

The BodySnatcher vulnerability, identified as CVE-2025-12420, is a critical Privilege Escalation flaw found in the ServiceNow platform, notably impacting the interaction between the Virtual Agent API and Now Assist AI Agents. This flaw stems from weak security controls, such as a hardcoded credential and reliance on email addresses for user identity verification, enabling unauthenticated remote code execution. The exploit chain involves three key steps: broken API authentication via a static secret, identity hijacking using email-only linking, and the execution of privileged actions through AI agents. This vulnerability highlights the concept of Agentic Amplification, where AI agents with excessive privileges can transform minor security flaws into major threats by executing high-privilege actions based on conversational inputs. The incident underscores the necessity for robust security practices, including strong identity verification, elimination of hardcoded secrets, and the implementation of agent-specific security controls like AI guardrails and continuous monitoring. The BodySnatcher serves as a crucial reminder of the evolving security landscape, emphasizing the need for continuous trust, governance, and specialized tools to manage the complexities of agentic systems in modern enterprises.

The rapid integration of generative AI and autonomous systems into enterprise operations is driving significant productivity and innovation, while simultaneously presenting new security challenges that traditional cybersecurity frameworks cannot address. These systems, which are designed to be creative and flexible, fundamentally shift the risk surface by introducing vulnerabilities like prompt injection and unauthorized tool use, requiring a dedicated approach known as AI Security Posture Management (AI-SPM). AI-SPM is a comprehensive, lifecycle-based discipline that focuses on the unique risks of AI components, encompassing data integrity, model behavior, and runtime interactions. It demands proactive measures such as rigorous pre-deployment testing, secure integration practices, and continuous monitoring during runtime to protect against threats like data poisoning, model theft, and denial of service. As businesses increasingly rely on these technologies, adopting AI-SPM becomes essential to ensure their deployment is both secure and ethical, providing a robust framework that moves beyond traditional security measures to address the complex, dynamic nature of AI systems.

AI agents are increasingly making impactful decisions by interacting with real systems, but the issue arises when they possess more autonomy and authority than designers intended or can safely control, leading to excessive agency. This occurs when agents operate beyond the boundaries of predictable human supervision, acting autonomously with authority but without accountability, which can lead to unintended consequences across multiple systems. Excessive agency is not due to coding errors or bad prompts, but rather design choices and a lack of robust control mechanisms. It poses security, safety, and operational risks by expanding the potential for privilege misuse and unintended actions, often without immediate visible failures. To mitigate these risks while preserving the value of AI agents, systems should be designed to intentionally limit and monitor agency, ensuring that autonomy is appropriately bounded and observable. This approach involves implementing runtime visibility, separating reasoning from action, and enforcing policies dynamically to maintain accountability and control in agentic systems.

The integration of Large Language Models (LLMs) into software development has evolved into the era of agentic systems, where AI entities can autonomously execute tasks like managing version control and orchestrating build pipelines, significantly boosting productivity but also broadening the attack surface. A critical vulnerability, CVE-2026-0830, in AWS Kiro, an AI-powered Integrated Development Environment (IDE), exemplifies the security risks associated with such systems, allowing Remote Code Execution (RCE) through command injection by exploiting trust relationships between developers, their workspaces, and AI agents. The vulnerability was found in the GitLab Merge Request helper, where improper handling of directory paths allowed shell metacharacters to be executed, compromising security. The remediation involved replacing the string-based shell execution with a more secure method that prevents the shell from interpreting paths, thus closing the injection vector. This case underscores the importance of stringent security practices like sanitizing metadata, using sandbox environments, and validating command outputs to prevent similar vulnerabilities in AI-powered tools. As AI agents gain more autonomy, there is an urgent need for robust security frameworks to ensure that the systems remain trustworthy and resilient against potential exploits.

On January 1, 2026, California enacted groundbreaking AI legislation, transitioning from voluntary ethical guidelines to enforceable laws that prioritize the real-time safety and transparency of AI systems. These laws, including Senate Bill 53, Senate Bill 243, and Assembly Bill 489, impose stringent requirements on AI developers to actively demonstrate and document safety measures, continuously monitor systems, and ensure real-time intervention capabilities, especially in high-stakes environments such as healthcare and emotional support. SB 53 mandates ongoing risk management for large-scale AI models, moving beyond static safety documentation to dynamic, lifecycle-based protocols. SB 243 addresses the ethical complexities of AI systems designed for emotional engagement, requiring immediate intervention in crisis situations to protect users. Meanwhile, AB 489 prohibits AI systems from masquerading as licensed professionals, necessitating real-time safeguards to prevent misleading users. These laws emphasize the importance of runtime behavior over design intentions, encouraging developers to integrate safety features into the core architecture rather than as an afterthought. The shift to real-time compliance and proactive enforcement marks a significant evolution in AI governance, underscoring trust and rigorous safety as competitive differentiators in the industry.

AI agents, unlike human employees, can execute numerous actions swiftly, posing unique challenges for businesses in terms of governance and security. Traditional Identity and Access Management (IAM) models, which rely on Role-Based Access Control (RBAC), are inadequate for managing AI agents due to their speed, dynamic intent, and lack of interpretable context. A new governance framework, RBAC for AI agents, is proposed to address these challenges by employing the Principle of Least Privilege in a dynamic manner, ensuring that permissions are context-aware, action-oriented, and enforced in real-time. Three foundational pillars—Certified Identity and Purpose, a Central Policy Engine and Guardrails, and Dynamic Enforcement and Continuous Audit—are essential for implementing this model. The strategic blueprint for deploying AI Agent RBAC emphasizes inventory and risk classification, defining roles and trust boundaries, integrating RBAC into the orchestration layer, treating permissions as code, and mandating runtime monitoring. This approach ensures AI agents are governed effectively, transforming them into reliable partners that drive innovation while maintaining security and trust.

Memory and Context Poisoning represents a significant threat to AI agents due to its ability to corrupt long-term knowledge bases, leading to persistent misalignment and operational failures. Unlike prompt injection, a transient attack that affects immediate responses, memory poisoning infiltrates an agent's cumulative record of interactions and learned behaviors, stored in systems like vector databases, posing a more insidious threat. This persistent attack manipulates the agent's understanding of its environment, causing it to act on a fabricated reality, and is particularly dangerous as it is challenging to detect with traditional security tools. The risks extend to financial fraud, data exfiltration, and policy misalignment, with the potential for significant enterprise damage due to the agent's reliance on poisoned memory to make decisions. Given its inclusion in the OWASP Top 10 for Agentic Applications 2026 as ASI06, addressing this vulnerability requires new security strategies focused on validating data integrity and monitoring agent behavior over time. This approach involves architectural separation of operational context from long-term memory, robust input sanitization, and provenance tracking to ensure the integrity of information stored in the agent's memory, while specialized solutions like AI Agent Security Posture and Runtime Security platforms are essential for detecting and mitigating such threats.

Agentic AI, a rapidly emerging technology in enterprise applications, represents a shift from predictive models to active, autonomous agents capable of interacting with digital and physical workflows, thereby enhancing efficiency but also introducing new risks. This transformation necessitates a clear understanding of two critical concepts: agent safety, which focuses on preventing unintentional harm caused by an agent's limitations or biases, and agent security, which deals with defending against intentional attacks by malicious actors. As these systems become more integrated and capable, their potential impact grows, making it crucial to address both safety and security comprehensively. Real-world examples such as AI assistants generating false information or security breaches through prompt injections underscore the urgent need for robust defenses. To build trustworthy AI systems, organizations must implement a multi-layered approach that includes enforcing the principle of least privilege, ensuring robust input/output validation, continuous monitoring, secure tool integration, and proactive vulnerability scanning. This structured approach, supported by platforms like NeuralTrust, is essential for deploying autonomous AI systems confidently and responsibly, balancing innovation with the imperative for security and safety.