Agent Mode AI — Episode 18
Credentials, surface, execution: the May 17 risk surface, 100 days later
Duration: 25:14
Hosts: Abby and Avery
Published: 6 Sep 2026
Anchor claims: AM-155, AM-156, AM-157
Summary
Three pieces on 17 May 2026 traced a single enterprise AI risk chain. AM-155 named the credential storage practices Storm-0558 exposed. AM-156 named the detection lag that lets shadow AI run for months before discovery. AM-157 named the framework-level CVEs that turn prompt injection into host-level RCE. Abby and Avery walk the trilogy as one chain — credential exposure plus undetected surface plus framework-RCE — and report what the September reviews moved on each of the three claims, 112 days after the original batch.
Chapters
[00:00] Cold open — credentials, surface, execution
[00:50] AM-155 — the CSRB report and the four credential failures
[04:00] AM-155 — mapping the four failures onto 2026 AI agent identity
[06:15] AM-155 — why AI agents have wider blast radius than service accounts
[07:30] AM-156 — Samsung 2023 and the structural detection lag
[09:30] AM-156 — partial closure of the gap by 2026
[10:30] AM-156 — the 2023-to-2026 pattern inversion
[11:45] AM-156 — three operational tests for the Samsung gap
[12:45] AM-157 — three framework-layer CVEs in one fortnight
[15:30] AM-157 — the framework-default trust boundary that broke
[17:00] AM-157 — Microsoft's structural read and the affected surface
[18:30] The chain — credentials, surface, execution as one composite
[19:30] Holding-up review on AM-155, AM-156, AM-157
[21:30] Procurement red-team additions from the trilogy
[23:00] Five operational controls AM-157 mandates
[24:00] Verdicts as of the airdate review
[24:50] Outtro
Transcript
[00:00] Cold open
ABBY: This is Agent Mode AI. I'm Abby. We are recording on 20 May 2026, three days after the publication batch this episode walks. This episode airs the week of 6 September. By then the three claims it tracks — AM-155, AM-156, AM-157 — have cleared their first review cadence, and the ledger entries on the holding page carry the live status. What we are going to do is walk the three pieces as one chain — credentials, surface, execution — and walk what the chain adds that no single piece names.
AVERY: I'm Avery. The chain. Frame it.
ABBY: Three pieces published on the agentmodeai.com risk-and-governance register on 16 and 17 May 2026. AM-155 read the Cyber Safety Review Board's April 2024 report on Storm-0558 forward into 2026 enterprise AI agent credential practice. AM-156 read the Samsung April 2023 ChatGPT incidents forward into 2026 shadow-AI detection. AM-157 read the May 2026 framework-layer prompt-injection CVEs forward into 2026 agent execution authority. The pieces were deliberately composed as a sequence. Credentials are stolen. The surface that uses the credentials is undetected. The execution that follows is host-level.
[00:50] AM-155 — the CSRB report and the four credential failures
AVERY: Start with AM-155. The credentials end.
ABBY: The CSRB report on Storm-0558 is, on its surface, a post-mortem of a specific 2023 breach at a specific cloud provider. The report concluded the intrusion was preventable and that Microsoft's security culture was inadequate. Microsoft published a technical investigation and remediation commitments. For most readers, the file closed there.
The structural read is different. The four credential-management failures the CSRB documented are the same four failures most enterprises are currently building into their AI agent identity programmes.
AVERY: Walk the four.
ABBY: First, the compromised Microsoft consumer-key-signing certificate, the MSA-2016 key, was issued in April 2016 and still in active use in summer 2023. Seven years past any reasonable rotation interval. Microsoft did not have an automated rotation policy for consumer signing keys. The CSRB called the absence of rotation policy one of a cascade of avoidable errors.
Second, the key was extracted from a 2021 engineering crash dump that transited from Microsoft's production environment to its corporate environment. The boundary between those environments was supposed to prevent the transfer. The enforcement was procedural, not technical, and procedural enforcement does not block what the operator does not see.
Third, the corporate environment's credential-scanning tooling did not flag the signing key inside the dump. The dump sat available to anyone with access to the corporate environment.
Fourth, in 2023 a separate intrusion compromised an engineer's corporate account, the threat actor retrieved the dump, extracted the key, and used it to forge authentication tokens. The forged-token usage was not flagged as anomalous because Microsoft's own anomaly-detection baseline did not exist for that class of usage. The intrusion was first detected externally, by the US State Department, on 16 June 2023, two-and-a-half weeks after the access began.
[04:00] AM-155 — mapping the four failures onto 2026 AI agent identity
AVERY: Map the four onto AI agent identity in 2026.
ABBY: Each failure has a direct 2026 analogue. Long-lived API keys without rotation policy are the dominant AI agent credential pattern in enterprises today. Most agents authenticate with credentials that have no automated rotation, no documented maximum lifetime, and no broker layer to enforce expiry. That is failure one.
Agents that traverse dev, staging, and production with the same credential class — or worse, the same credential — are the dominant deployment pattern. Cross-environment promotion in most enterprises is not an explicit pipeline step that re-issues credentials; it is a code-config change that lets the same identity reach a new environment. That is failure two.
Secrets-scanning tooling in most enterprises does not catch agent-issued tokens in logs, in crash dumps, in CI artefacts, or in developer-workstation caches. The scanners are tuned for credentials issued by IAM systems with predictable formats. Agent credentials issued by application-layer brokers or vendor-managed identity providers often do not match the scanner's pattern set. That is failure three.
Anomaly-detection baselines for agent credential use do not exist in most enterprises in 2026. The issuance pattern is unprofiled. The usage pattern is unprofiled. A compromised agent credential used at a normal volume against a normal endpoint produces no signal because there is no baseline to deviate from. That is failure four.
[06:15] AM-155 — why AI agents have wider blast radius than service accounts
AVERY: Why this matters more for AI agents than for traditional service accounts.
ABBY: The blast radius is wider. A compromised service account that fetches data from one downstream system is bounded by that system's data scope. An AI agent that holds the same credential typically has tool-use capability against many downstream systems, often with the ability to write, send, or transact. The Storm-0558 attacker used the forged tokens to read email. A compromised AI agent credential in a 2026 enterprise can be used to send email, file tickets, modify configurations, issue purchase orders, or call other agents. The token-class trust boundary is the same. The actions a compromised credential authorises are categorically larger.
The procurement question that follows is whether the agent's identity primitive matches its action surface. Most 2026 deployments still authenticate agents with primitives sized for read-only data access.
[07:30] AM-156 — Samsung 2023 and the structural detection lag
AVERY: That is the credentials end. Move to AM-156. The surface end.
ABBY: AM-156 is built around Samsung's April 2023 ChatGPT incidents and the 2 May 2023 restriction memo. Three Samsung Electronics employees in the Device Solutions division pasted confidential information into the public ChatGPT interface. The reported categories were semiconductor source code, internal source code submitted for optimisation, and a recorded meeting transcript submitted for summarisation. The information was, by OpenAI's then-current consumer policy, retained for service improvement.
The headline at the time read as a corporate-policy story. The load-bearing detail is in the detection path. Samsung learned about the leaks through internal audit and self-report, not at the moment of the paste. The detection lag was three years ahead of where most 2026 enterprise shadow-AI programmes still operate.
AVERY: Why the detection lag is structural.
ABBY: Enterprise data-loss prevention in 2023 was designed against three channel classes. Email attachments. Browser uploads to recognised file-share services. Removable media. Pasting text into a browser-rendered chat interface fits none of those classes cleanly. The browser session was permitted because the domain was not blocked. The egress was not a file, so attachment scanning did not run. The destination was a generative AI service, a category most DLP rule sets did not yet enumerate. The result was a structural blind spot. Samsung did not have a procedural failure. The policy stack did not extend to the new egress channel.
The Bloomberg report from 2 May 2023 has the corporate-policy framing. The earlier Korean tech-press reporting from the Economist Korea on 30 March 2023 has the operational detail on the three incidents. Both are referenced on the holding page.
[09:30] AM-156 — partial closure of the gap by 2026
AVERY: Has the gap been closed in 2026.
ABBY: Partially. The major DLP vendors have shipped generative-AI-channel detectors since 2023. Browser-extension hooks that flag pastes to known AI hosts. Network rules that block or watermark traffic to AI service endpoints. Endpoint sensors that flag generative-AI process activity. The coverage is uneven. The browser-extension layer works only on managed devices with the extension installed. Network rules work only against destinations the rules enumerate, which lags new AI services by weeks or months. Endpoint sensors work only against installed clients, not against web-only interfaces.
The structural answer requires inventory of every AI-capable surface in the environment, not just every AI vendor. Most 2026 programmes do the second and miss the first by 30 to 60 percent of the actual surface.
[10:30] AM-156 — the 2023-to-2026 pattern inversion
AVERY: The pattern has inverted between 2023 and 2026.
ABBY: In 2023, the dominant shadow-AI risk was workers using unsanctioned tools. Consumer ChatGPT in a browser. A personal Claude account. A browser extension installed without IT approval. Samsung is the canonical 2023 case.
In 2026, the dominant shadow-AI risk is agentic capability silently activating inside already-approved tools. Microsoft 365 Copilot agents acquiring write capability the deployer did not configure. Custom GPTs created by individual contributors against the corporate OpenAI account. MCP server connections that the approved IDE makes without an inventory step. The detection-lag problem is structurally worse because the tool is sanctioned and the AI capability is opaque.
[11:45] AM-156 — three operational tests for the Samsung gap
AVERY: The three operational tests.
ABBY: Three tests for whether a programme has closed the Samsung gap. First, can the programme produce a complete inventory of AI-capable interfaces in the environment, including approved-tool feature flags, in under 24 hours when asked. Second, for a randomly selected confidential document type — semiconductor source, contract terms, customer PII — can the programme trace which AI-capable interfaces an employee could plausibly paste that document into, and which of those interfaces have detection in place. Third, when an AI-capable surface is added to an approved tool by the vendor — a new agent feature, a new MCP endpoint, a new copilot extension — does the inventory update automatically or does it require a manual review cycle that lags the vendor release.
Programmes that pass all three have closed the Samsung gap. Programmes that pass one or two have a structural detection lag that a follow-on incident will surface.
[12:45] AM-157 — three framework-layer CVEs in one fortnight
AVERY: Move to AM-157. The execution end.
ABBY: AM-157 walks three CVE disclosures that all landed within a single fortnight in May 2026. Microsoft Security Response Center published CVE-2026-25592 and CVE-2026-26030 against Semantic Kernel on 7 May 2026. The proof-of-concept in the public write-up is canonical: a single attacker-controlled prompt resolves to host-level code execution on the device running the agent.
OX Security published a supply-chain advisory in the same fortnight covering Anthropic's Model Context Protocol STDIO interface. The advisory documents that the STDIO command-injection path is present in every published MCP implementation regardless of language, with the command line itself acting as the payload.
A separate disclosure against Windsurf 1.9544.26 showed a prompt-injection path that writes to the local MCP configuration file and registers a malicious server entry that the IDE loads on its next session, with no user interaction required.
[15:30] AM-157 — the framework-default trust boundary that broke
AVERY: Why this is a framework-layer problem, not a deployment-layer problem.
ABBY: The conventional treatment of prompt injection through summer 2025 placed the threat boundary between the model's output and the tools the deployer had explicitly registered. The deployer would restrict the agent's toolset, run the agent under a low-privilege account, block egress to sensitive systems, and trust the framework to keep the model's authored content separated from the configuration the framework executed against. That is what Microsoft's own threat-modelling guidance documented through 2024 and 2025. It is what Anthropic's MCP specification assumed in the original protocol design.
The May 2026 CVE class breaks this assumption at the framework layer. In the Semantic Kernel demonstration, the prompt injection authors a new tool configuration that the framework executes inside the agent process. In the MCP STDIO class, the prompt injection alters the configuration the agent uses to launch a server, where the command line itself is the payload. In the Windsurf class, the prompt injection writes to the local MCP configuration file and installs a new server entry that the IDE loads on its next session.
The three demonstrations share a single property. The framework, by default, treats tool-configuration as data the model is allowed to author. The deployer's allowlist is enforced against the configured tools, not against the model's ability to mutate the configuration. The patch surface is the framework default, not the deployer's wrap.
[17:00] AM-157 — Microsoft's structural read and the affected surface
AVERY: The structural reading from Microsoft's own post.
ABBY: The Microsoft Security Response Center post is explicit about the structural read. The CVE class is described as a representative instance of an anti-pattern observable across multiple frameworks the team examined privately. The recommended mitigation is at the framework default, not the deployer's configuration. That is the load-bearing sentence from the disclosure, because it tells the procurement reader that the patch surface for this class of vulnerability is not under the deployer's control.
The OX Security advisory is the broader of the three, because it traverses the protocol itself rather than a specific framework's implementation of it. The MCP STDIO command-line construction issue is present in every published MCP implementation regardless of language. The protocol-level fix requires every published implementation to update.
AVERY: How wide the affected surface is.
ABBY: Wider than the three named frameworks. The Microsoft post notes the underlying anti-pattern is observable across multiple frameworks the team examined. The OX Security advisory documents that the STDIO command-injection path is present in every published MCP implementation. The OWASP 2026 agent-security survey found 73 percent of live AI rollouts have prompt-injection exposure and only 34.7 percent have dedicated defences.
The operational implication is that a CIO reading the disclosure should assume the production surface is exposed until each framework in the stack is checked individually against the vendor's response.
[18:30] The chain — credentials, surface, execution as one composite
AVERY: Now the chain Avery presses. Walk the three together.
ABBY: The credential layer produces stolen non-human identities with action authority that exceeds the audit baseline. The surface layer produces shadow agentic capability inside sanctioned tools, undetected by 2026 DLP. The execution layer turns prompt injection on those agents into host-level code execution at the framework's default trust boundary. The compromise sequence the three pieces describe is: a long-lived AI agent credential leaks through a path the credential-scanner does not see, the credential is used inside a sanctioned agent surface the shadow-AI programme does not inventory, and the agent's framework executes attacker-supplied tool-configuration as if it were deployer-authored. The deployer's allowlist is bypassed at every stage.
No single piece names this composite. AM-155 walks the credential failure mode in isolation. AM-156 walks the detection failure mode in isolation. AM-157 walks the execution failure mode in isolation. The composite is the trilogy.
[19:30] Holding-up review on AM-155, AM-156, AM-157
AVERY: Holding-up review on each. By airdate the ledger entries carry the live status. Walk the trigger conditions so listeners can interpret what they read.
ABBY: AM-155 reviews on the 90-day cadence on 14 August 2026. Trigger conditions registered on the claim: a published industry survey showing the median AI agent credential lifetime drops below 90 days would move toward Partial because the rotation gap is closing. A major AI agent credential breach with public post-mortem would confirm or refute the structural map. A published CSRB-equivalent review of an AI agent incident would be the closest analogue to the original report and the most direct re-test.
AM-156 reviews on the 60-day cadence on 15 July 2026. Trigger conditions: a published vendor benchmark showing DLP coverage of agentic-AI channels above 90 percent on real enterprise environments would weaken the structural argument. A major 2026 shadow-AI incident with public post-mortem would confirm or refute the structural map. A published Gartner-equivalent assessment of enterprise shadow-AI controls maturity would re-test the operational implication.
AM-157 reviews on the 60-day cadence on 15 July 2026. Trigger conditions: a published vendor benchmark showing framework-layer tool-configuration enforcement in default Semantic Kernel, MCP, and Windsurf builds above 80 percent of measured surface would weaken the structural argument. A second independently-disclosed framework-layer CVE in the same prompt-injection-to-execution class would harden the argument. A major 2026 production incident traceable to one of the three named frameworks would confirm or refute the operational implication. A framework-vendor-issued attestation programme covering tool-configuration as a privileged operation would weaken the structural argument because the procurement pattern has shifted.
AVERY: The ledger entries on airdate carry the verdict for each.
ABBY: The verdicts are on the holding page. The structural reading we just walked does not depend on which specific marker fired. The chain itself — credentials, surface, execution — is the editorial point. Vendor responses inside the review windows refine the procurement-template question, not the structural diagnosis.
[21:30] Procurement red-team additions from the trilogy
AVERY: Procurement red-team additions. The three pieces together added how many questions to the AI MSA review.
ABBY: Three families of question, one per piece, that the AM-155/156/157 trilogy added to the AI MSA red-team checklist. The full list extends what RES-005 documented in March 2026; these are the May 17 additions on top.
From AM-155: the vendor describes the credential primitive every AI agent in the deployer's tenant authenticates with, the maximum credential lifetime under default policy, the rotation mechanism, and the anomaly-detection baseline that exists for credential usage. The vendor commits to surfacing credential telemetry the deployer can integrate into its own SIEM. The deployer's procurement question is not whether the vendor has good credential hygiene in the abstract; it is whether the vendor exposes the operational telemetry the deployer's own SOC needs.
From AM-156: the vendor enumerates every AI-capable surface the vendor's product exposes — feature flags, agent capabilities, embedded copilots, MCP endpoints, custom-tool registration paths — and commits to notifying the deployer at least 30 days before any new AI-capable surface activates in a customer-visible release. The clause closes the inventory-lag gap by making the vendor responsible for surface enumeration rather than the deployer responsible for vendor-feature monitoring.
From AM-157: the vendor attests that the framework treats tool-configuration as a privileged operation, not as model output, with a documented enforcement mechanism. Vendors that cannot attest are signalling that they have not yet shipped the framework-layer fix and the deployer is carrying the residual risk. The attestation requirement is meaningful even when the vendor's answer is no; the no is itself part of the procurement decision.
[23:00] Five operational controls AM-157 mandates
AVERY: Five operational controls AM-157 mandates regardless of vendor response.
ABBY: Five controls in priority order. First, framework-version freeze on every agent in production at the Q2 2026 patched-version baseline, with explicit sign-off required for upgrades. Second, MCP server registration moved from per-developer local configuration to a centrally-managed allowlist with cryptographic verification of server binaries, modelled on the package-signing approach in enterprise package managers. Third, agent-process isolation under a sandbox or container with explicit egress allowlist and no inherited workstation credentials, which limits blast radius even if the framework is compromised. Fourth, telemetry capture of every tool-configuration mutation, with anomaly detection on configuration writes from agent processes — the operational analogue of the credential-issuance baseline AM-155 specified. Fifth, the vendor-attestation requirement in the procurement template.
The first four controls are deployer-side. The fifth is vendor-side. Together they move the May 2026 disclosure from a single-quarter patch cycle into a structural change in how the deployer contracts for agent execution authority.
[24:00] Verdicts as of the airdate review
AVERY: Verdicts as of the airdate review.
ABBY: AM-155 status, AM-156 status, AM-157 status — all three on the holding page. Each entry shows the cadence, the next review date, and the trigger conditions that produced the current status. The trilogy reading we walked does not change with the individual verdicts. The composite is editorial. The verdicts are operational.
[24:50] Outtro
AVERY: Final word.
ABBY: The three pieces are the May 2026 risk-and-governance arc on agentmodeai. They sit at credentials, surface, and execution, and together they describe the failure surface of an enterprise AI agent programme. Each layer has independent structural gaps. Together they compose the actual threat model that 2026 procurement is contracting against. The claims, the CSRB report, the Samsung incident timeline, the Microsoft Security Response Center disclosure, the OX Security MCP advisory, and the Windsurf advisory are linked at agentmodeai dot com slash holding.
AVERY: Holding-up. See you next Sunday.
Credentials, surface, execution: the May 17 risk surface, 100 days later
Duration: 25:14
Hosts: Abby and Avery
Published: 6 Sep 2026
Anchor claims: AM-155, AM-156, AM-157
Summary
Three pieces on 17 May 2026 traced a single enterprise AI risk chain. AM-155 named the credential storage practices Storm-0558 exposed. AM-156 named the detection lag that lets shadow AI run for months before discovery. AM-157 named the framework-level CVEs that turn prompt injection into host-level RCE. Abby and Avery walk the trilogy as one chain — credential exposure plus undetected surface plus framework-RCE — and report what the September reviews moved on each of the three claims, 112 days after the original batch.
Chapters
[00:00] Cold open — credentials, surface, execution
[00:50] AM-155 — the CSRB report and the four credential failures
[04:00] AM-155 — mapping the four failures onto 2026 AI agent identity
[06:15] AM-155 — why AI agents have wider blast radius than service accounts
[07:30] AM-156 — Samsung 2023 and the structural detection lag
[09:30] AM-156 — partial closure of the gap by 2026
[10:30] AM-156 — the 2023-to-2026 pattern inversion
[11:45] AM-156 — three operational tests for the Samsung gap
[12:45] AM-157 — three framework-layer CVEs in one fortnight
[15:30] AM-157 — the framework-default trust boundary that broke
[17:00] AM-157 — Microsoft's structural read and the affected surface
[18:30] The chain — credentials, surface, execution as one composite
[19:30] Holding-up review on AM-155, AM-156, AM-157
[21:30] Procurement red-team additions from the trilogy
[23:00] Five operational controls AM-157 mandates
[24:00] Verdicts as of the airdate review
[24:50] Outtro
Transcript
[00:00] Cold open
ABBY: This is Agent Mode AI. I'm Abby. We are recording on 20 May 2026, three days after the publication batch this episode walks. This episode airs the week of 6 September. By then the three claims it tracks — AM-155, AM-156, AM-157 — have cleared their first review cadence, and the ledger entries on the holding page carry the live status. What we are going to do is walk the three pieces as one chain — credentials, surface, execution — and walk what the chain adds that no single piece names.
AVERY: I'm Avery. The chain. Frame it.
ABBY: Three pieces published on the agentmodeai.com risk-and-governance register on 16 and 17 May 2026. AM-155 read the Cyber Safety Review Board's April 2024 report on Storm-0558 forward into 2026 enterprise AI agent credential practice. AM-156 read the Samsung April 2023 ChatGPT incidents forward into 2026 shadow-AI detection. AM-157 read the May 2026 framework-layer prompt-injection CVEs forward into 2026 agent execution authority. The pieces were deliberately composed as a sequence. Credentials are stolen. The surface that uses the credentials is undetected. The execution that follows is host-level.
[00:50] AM-155 — the CSRB report and the four credential failures
AVERY: Start with AM-155. The credentials end.
ABBY: The CSRB report on Storm-0558 is, on its surface, a post-mortem of a specific 2023 breach at a specific cloud provider. The report concluded the intrusion was preventable and that Microsoft's security culture was inadequate. Microsoft published a technical investigation and remediation commitments. For most readers, the file closed there.
The structural read is different. The four credential-management failures the CSRB documented are the same four failures most enterprises are currently building into their AI agent identity programmes.
AVERY: Walk the four.
ABBY: First, the compromised Microsoft consumer-key-signing certificate, the MSA-2016 key, was issued in April 2016 and still in active use in summer 2023. Seven years past any reasonable rotation interval. Microsoft did not have an automated rotation policy for consumer signing keys. The CSRB called the absence of rotation policy one of a cascade of avoidable errors.
Second, the key was extracted from a 2021 engineering crash dump that transited from Microsoft's production environment to its corporate environment. The boundary between those environments was supposed to prevent the transfer. The enforcement was procedural, not technical, and procedural enforcement does not block what the operator does not see.
Third, the corporate environment's credential-scanning tooling did not flag the signing key inside the dump. The dump sat available to anyone with access to the corporate environment.
Fourth, in 2023 a separate intrusion compromised an engineer's corporate account, the threat actor retrieved the dump, extracted the key, and used it to forge authentication tokens. The forged-token usage was not flagged as anomalous because Microsoft's own anomaly-detection baseline did not exist for that class of usage. The intrusion was first detected externally, by the US State Department, on 16 June 2023, two-and-a-half weeks after the access began.
[04:00] AM-155 — mapping the four failures onto 2026 AI agent identity
AVERY: Map the four onto AI agent identity in 2026.
ABBY: Each failure has a direct 2026 analogue. Long-lived API keys without rotation policy are the dominant AI agent credential pattern in enterprises today. Most agents authenticate with credentials that have no automated rotation, no documented maximum lifetime, and no broker layer to enforce expiry. That is failure one.
Agents that traverse dev, staging, and production with the same credential class — or worse, the same credential — are the dominant deployment pattern. Cross-environment promotion in most enterprises is not an explicit pipeline step that re-issues credentials; it is a code-config change that lets the same identity reach a new environment. That is failure two.
Secrets-scanning tooling in most enterprises does not catch agent-issued tokens in logs, in crash dumps, in CI artefacts, or in developer-workstation caches. The scanners are tuned for credentials issued by IAM systems with predictable formats. Agent credentials issued by application-layer brokers or vendor-managed identity providers often do not match the scanner's pattern set. That is failure three.
Anomaly-detection baselines for agent credential use do not exist in most enterprises in 2026. The issuance pattern is unprofiled. The usage pattern is unprofiled. A compromised agent credential used at a normal volume against a normal endpoint produces no signal because there is no baseline to deviate from. That is failure four.
[06:15] AM-155 — why AI agents have wider blast radius than service accounts
AVERY: Why this matters more for AI agents than for traditional service accounts.
ABBY: The blast radius is wider. A compromised service account that fetches data from one downstream system is bounded by that system's data scope. An AI agent that holds the same credential typically has tool-use capability against many downstream systems, often with the ability to write, send, or transact. The Storm-0558 attacker used the forged tokens to read email. A compromised AI agent credential in a 2026 enterprise can be used to send email, file tickets, modify configurations, issue purchase orders, or call other agents. The token-class trust boundary is the same. The actions a compromised credential authorises are categorically larger.
The procurement question that follows is whether the agent's identity primitive matches its action surface. Most 2026 deployments still authenticate agents with primitives sized for read-only data access.
[07:30] AM-156 — Samsung 2023 and the structural detection lag
AVERY: That is the credentials end. Move to AM-156. The surface end.
ABBY: AM-156 is built around Samsung's April 2023 ChatGPT incidents and the 2 May 2023 restriction memo. Three Samsung Electronics employees in the Device Solutions division pasted confidential information into the public ChatGPT interface. The reported categories were semiconductor source code, internal source code submitted for optimisation, and a recorded meeting transcript submitted for summarisation. The information was, by OpenAI's then-current consumer policy, retained for service improvement.
The headline at the time read as a corporate-policy story. The load-bearing detail is in the detection path. Samsung learned about the leaks through internal audit and self-report, not at the moment of the paste. The detection lag was three years ahead of where most 2026 enterprise shadow-AI programmes still operate.
AVERY: Why the detection lag is structural.
ABBY: Enterprise data-loss prevention in 2023 was designed against three channel classes. Email attachments. Browser uploads to recognised file-share services. Removable media. Pasting text into a browser-rendered chat interface fits none of those classes cleanly. The browser session was permitted because the domain was not blocked. The egress was not a file, so attachment scanning did not run. The destination was a generative AI service, a category most DLP rule sets did not yet enumerate. The result was a structural blind spot. Samsung did not have a procedural failure. The policy stack did not extend to the new egress channel.
The Bloomberg report from 2 May 2023 has the corporate-policy framing. The earlier Korean tech-press reporting from the Economist Korea on 30 March 2023 has the operational detail on the three incidents. Both are referenced on the holding page.
[09:30] AM-156 — partial closure of the gap by 2026
AVERY: Has the gap been closed in 2026.
ABBY: Partially. The major DLP vendors have shipped generative-AI-channel detectors since 2023. Browser-extension hooks that flag pastes to known AI hosts. Network rules that block or watermark traffic to AI service endpoints. Endpoint sensors that flag generative-AI process activity. The coverage is uneven. The browser-extension layer works only on managed devices with the extension installed. Network rules work only against destinations the rules enumerate, which lags new AI services by weeks or months. Endpoint sensors work only against installed clients, not against web-only interfaces.
The structural answer requires inventory of every AI-capable surface in the environment, not just every AI vendor. Most 2026 programmes do the second and miss the first by 30 to 60 percent of the actual surface.
[10:30] AM-156 — the 2023-to-2026 pattern inversion
AVERY: The pattern has inverted between 2023 and 2026.
ABBY: In 2023, the dominant shadow-AI risk was workers using unsanctioned tools. Consumer ChatGPT in a browser. A personal Claude account. A browser extension installed without IT approval. Samsung is the canonical 2023 case.
In 2026, the dominant shadow-AI risk is agentic capability silently activating inside already-approved tools. Microsoft 365 Copilot agents acquiring write capability the deployer did not configure. Custom GPTs created by individual contributors against the corporate OpenAI account. MCP server connections that the approved IDE makes without an inventory step. The detection-lag problem is structurally worse because the tool is sanctioned and the AI capability is opaque.
[11:45] AM-156 — three operational tests for the Samsung gap
AVERY: The three operational tests.
ABBY: Three tests for whether a programme has closed the Samsung gap. First, can the programme produce a complete inventory of AI-capable interfaces in the environment, including approved-tool feature flags, in under 24 hours when asked. Second, for a randomly selected confidential document type — semiconductor source, contract terms, customer PII — can the programme trace which AI-capable interfaces an employee could plausibly paste that document into, and which of those interfaces have detection in place. Third, when an AI-capable surface is added to an approved tool by the vendor — a new agent feature, a new MCP endpoint, a new copilot extension — does the inventory update automatically or does it require a manual review cycle that lags the vendor release.
Programmes that pass all three have closed the Samsung gap. Programmes that pass one or two have a structural detection lag that a follow-on incident will surface.
[12:45] AM-157 — three framework-layer CVEs in one fortnight
AVERY: Move to AM-157. The execution end.
ABBY: AM-157 walks three CVE disclosures that all landed within a single fortnight in May 2026. Microsoft Security Response Center published CVE-2026-25592 and CVE-2026-26030 against Semantic Kernel on 7 May 2026. The proof-of-concept in the public write-up is canonical: a single attacker-controlled prompt resolves to host-level code execution on the device running the agent.
OX Security published a supply-chain advisory in the same fortnight covering Anthropic's Model Context Protocol STDIO interface. The advisory documents that the STDIO command-injection path is present in every published MCP implementation regardless of language, with the command line itself acting as the payload.
A separate disclosure against Windsurf 1.9544.26 showed a prompt-injection path that writes to the local MCP configuration file and registers a malicious server entry that the IDE loads on its next session, with no user interaction required.
[15:30] AM-157 — the framework-default trust boundary that broke
AVERY: Why this is a framework-layer problem, not a deployment-layer problem.
ABBY: The conventional treatment of prompt injection through summer 2025 placed the threat boundary between the model's output and the tools the deployer had explicitly registered. The deployer would restrict the agent's toolset, run the agent under a low-privilege account, block egress to sensitive systems, and trust the framework to keep the model's authored content separated from the configuration the framework executed against. That is what Microsoft's own threat-modelling guidance documented through 2024 and 2025. It is what Anthropic's MCP specification assumed in the original protocol design.
The May 2026 CVE class breaks this assumption at the framework layer. In the Semantic Kernel demonstration, the prompt injection authors a new tool configuration that the framework executes inside the agent process. In the MCP STDIO class, the prompt injection alters the configuration the agent uses to launch a server, where the command line itself is the payload. In the Windsurf class, the prompt injection writes to the local MCP configuration file and installs a new server entry that the IDE loads on its next session.
The three demonstrations share a single property. The framework, by default, treats tool-configuration as data the model is allowed to author. The deployer's allowlist is enforced against the configured tools, not against the model's ability to mutate the configuration. The patch surface is the framework default, not the deployer's wrap.
[17:00] AM-157 — Microsoft's structural read and the affected surface
AVERY: The structural reading from Microsoft's own post.
ABBY: The Microsoft Security Response Center post is explicit about the structural read. The CVE class is described as a representative instance of an anti-pattern observable across multiple frameworks the team examined privately. The recommended mitigation is at the framework default, not the deployer's configuration. That is the load-bearing sentence from the disclosure, because it tells the procurement reader that the patch surface for this class of vulnerability is not under the deployer's control.
The OX Security advisory is the broader of the three, because it traverses the protocol itself rather than a specific framework's implementation of it. The MCP STDIO command-line construction issue is present in every published MCP implementation regardless of language. The protocol-level fix requires every published implementation to update.
AVERY: How wide the affected surface is.
ABBY: Wider than the three named frameworks. The Microsoft post notes the underlying anti-pattern is observable across multiple frameworks the team examined. The OX Security advisory documents that the STDIO command-injection path is present in every published MCP implementation. The OWASP 2026 agent-security survey found 73 percent of live AI rollouts have prompt-injection exposure and only 34.7 percent have dedicated defences.
The operational implication is that a CIO reading the disclosure should assume the production surface is exposed until each framework in the stack is checked individually against the vendor's response.
[18:30] The chain — credentials, surface, execution as one composite
AVERY: Now the chain Avery presses. Walk the three together.
ABBY: The credential layer produces stolen non-human identities with action authority that exceeds the audit baseline. The surface layer produces shadow agentic capability inside sanctioned tools, undetected by 2026 DLP. The execution layer turns prompt injection on those agents into host-level code execution at the framework's default trust boundary. The compromise sequence the three pieces describe is: a long-lived AI agent credential leaks through a path the credential-scanner does not see, the credential is used inside a sanctioned agent surface the shadow-AI programme does not inventory, and the agent's framework executes attacker-supplied tool-configuration as if it were deployer-authored. The deployer's allowlist is bypassed at every stage.
No single piece names this composite. AM-155 walks the credential failure mode in isolation. AM-156 walks the detection failure mode in isolation. AM-157 walks the execution failure mode in isolation. The composite is the trilogy.
[19:30] Holding-up review on AM-155, AM-156, AM-157
AVERY: Holding-up review on each. By airdate the ledger entries carry the live status. Walk the trigger conditions so listeners can interpret what they read.
ABBY: AM-155 reviews on the 90-day cadence on 14 August 2026. Trigger conditions registered on the claim: a published industry survey showing the median AI agent credential lifetime drops below 90 days would move toward Partial because the rotation gap is closing. A major AI agent credential breach with public post-mortem would confirm or refute the structural map. A published CSRB-equivalent review of an AI agent incident would be the closest analogue to the original report and the most direct re-test.
AM-156 reviews on the 60-day cadence on 15 July 2026. Trigger conditions: a published vendor benchmark showing DLP coverage of agentic-AI channels above 90 percent on real enterprise environments would weaken the structural argument. A major 2026 shadow-AI incident with public post-mortem would confirm or refute the structural map. A published Gartner-equivalent assessment of enterprise shadow-AI controls maturity would re-test the operational implication.
AM-157 reviews on the 60-day cadence on 15 July 2026. Trigger conditions: a published vendor benchmark showing framework-layer tool-configuration enforcement in default Semantic Kernel, MCP, and Windsurf builds above 80 percent of measured surface would weaken the structural argument. A second independently-disclosed framework-layer CVE in the same prompt-injection-to-execution class would harden the argument. A major 2026 production incident traceable to one of the three named frameworks would confirm or refute the operational implication. A framework-vendor-issued attestation programme covering tool-configuration as a privileged operation would weaken the structural argument because the procurement pattern has shifted.
AVERY: The ledger entries on airdate carry the verdict for each.
ABBY: The verdicts are on the holding page. The structural reading we just walked does not depend on which specific marker fired. The chain itself — credentials, surface, execution — is the editorial point. Vendor responses inside the review windows refine the procurement-template question, not the structural diagnosis.
[21:30] Procurement red-team additions from the trilogy
AVERY: Procurement red-team additions. The three pieces together added how many questions to the AI MSA review.
ABBY: Three families of question, one per piece, that the AM-155/156/157 trilogy added to the AI MSA red-team checklist. The full list extends what RES-005 documented in March 2026; these are the May 17 additions on top.
From AM-155: the vendor describes the credential primitive every AI agent in the deployer's tenant authenticates with, the maximum credential lifetime under default policy, the rotation mechanism, and the anomaly-detection baseline that exists for credential usage. The vendor commits to surfacing credential telemetry the deployer can integrate into its own SIEM. The deployer's procurement question is not whether the vendor has good credential hygiene in the abstract; it is whether the vendor exposes the operational telemetry the deployer's own SOC needs.
From AM-156: the vendor enumerates every AI-capable surface the vendor's product exposes — feature flags, agent capabilities, embedded copilots, MCP endpoints, custom-tool registration paths — and commits to notifying the deployer at least 30 days before any new AI-capable surface activates in a customer-visible release. The clause closes the inventory-lag gap by making the vendor responsible for surface enumeration rather than the deployer responsible for vendor-feature monitoring.
From AM-157: the vendor attests that the framework treats tool-configuration as a privileged operation, not as model output, with a documented enforcement mechanism. Vendors that cannot attest are signalling that they have not yet shipped the framework-layer fix and the deployer is carrying the residual risk. The attestation requirement is meaningful even when the vendor's answer is no; the no is itself part of the procurement decision.
[23:00] Five operational controls AM-157 mandates
AVERY: Five operational controls AM-157 mandates regardless of vendor response.
ABBY: Five controls in priority order. First, framework-version freeze on every agent in production at the Q2 2026 patched-version baseline, with explicit sign-off required for upgrades. Second, MCP server registration moved from per-developer local configuration to a centrally-managed allowlist with cryptographic verification of server binaries, modelled on the package-signing approach in enterprise package managers. Third, agent-process isolation under a sandbox or container with explicit egress allowlist and no inherited workstation credentials, which limits blast radius even if the framework is compromised. Fourth, telemetry capture of every tool-configuration mutation, with anomaly detection on configuration writes from agent processes — the operational analogue of the credential-issuance baseline AM-155 specified. Fifth, the vendor-attestation requirement in the procurement template.
The first four controls are deployer-side. The fifth is vendor-side. Together they move the May 2026 disclosure from a single-quarter patch cycle into a structural change in how the deployer contracts for agent execution authority.
[24:00] Verdicts as of the airdate review
AVERY: Verdicts as of the airdate review.
ABBY: AM-155 status, AM-156 status, AM-157 status — all three on the holding page. Each entry shows the cadence, the next review date, and the trigger conditions that produced the current status. The trilogy reading we walked does not change with the individual verdicts. The composite is editorial. The verdicts are operational.
[24:50] Outtro
AVERY: Final word.
ABBY: The three pieces are the May 2026 risk-and-governance arc on agentmodeai. They sit at credentials, surface, and execution, and together they describe the failure surface of an enterprise AI agent programme. Each layer has independent structural gaps. Together they compose the actual threat model that 2026 procurement is contracting against. The claims, the CSRB report, the Samsung incident timeline, the Microsoft Security Response Center disclosure, the OX Security MCP advisory, and the Windsurf advisory are linked at agentmodeai dot com slash holding.
AVERY: Holding-up. See you next Sunday.
