[un]prompted II: Six months is a long time

TL;DR

• Six months after the first [un]prompted, people seemed less scared. Nothing got safer, though. Everyone just got used to it.
• The model can’t be your security control. The harness around it is, meaning what an agent can reach, which credentials it holds, and what stops it when policy says no.
• Attackers already run agents through harnesses. Defenders need to build and test theirs just as seriously, starting with what each agent can reach.

All week at [un]prompted II I heard people say “last year at [un]prompted.” There was no last year. The first one was in March, and six months in this field feels like a year.

It was about 20% bigger and maxed out the venue. I missed more of the main stage than I wanted because the Wi-Fi fell over and I spent part of the conference at Best Buy buying two Starlinks to rewire the network. I’ll be catching up on the recordings with everyone else.

The mood was calmer than in March, but only because people have settled into a new normal, and the new normal is insanity. Since I’m apparently required to come back from every conference with a hot take, here’s mine. We’ve spent two years trying to get AI models to behave, and it’s the wrong problem. The security that matters is in the harness around the model, meaning what the agent can call, which credentials it carries, where it runs, and who signs off before it does something you can’t undo.

Attackers already run agents

The most sobering talks were field reports, not demos. Erlend Oftedal found more than 20 exposed control panels for Cairn, a harness that takes a target and a goal and runs agents until it gets there. The criminal clusters behind those panels ran over 1,600 attack projects against roughly 1,100 e-commerce sites at about $5 each, and around one in ten succeeded, typically within a day.

The attackers hadn’t password-protected those panels, which I found enjoyable. Apparently criminals ship vibe-coded infrastructure too. Inside, you could see target selection, the task prompts, every step the agents took, and the exploit chains they built from small bugs, all for about five bucks a project.

A honeypot network built to look like production AI stacks caught campaigns probing new CVEs in AI backends within days of publication. One of the last talks was titled “Not a Boogeyman: The Autonomous Attacker Is Already Here,” and that’s exactly right. This is a now problem. The window between a known weakness and a working exploit used to be weeks, and now it’s down to hours at best, minutes at worst.

And among the more terrifying outcomes of the conference, 24 zero days in the linux kernel were discovered during the onsite CTF.

The harness is the control, not the model

You don’t secure an agent by asking the model nicely. Vince Ovando built Tantalus, an indirect prompt injection arena with an AI assistant that has access to files, email, and chat history, plus a mix of legitimate and poisoned tools. He ran roughly 6.1 million inference calls through it and published the results. Every behavioral and structural control he tested failed except one, and his title tells you where that one lives: “The Model Is NOT a Security Control: Prompt Injection Dies at the Token Sampler.”

Better models won’t fix it. StealthBench, from Adrian Wood and Ads Dawson, found no model above 53.8% safe success on offensive tasks, and some of the most capable were reckless in more than a third of attempts. We have the worst models today that we’re ever going to have, and the better ones will just get better at whatever the harness lets them do, good or bad.

Oleksii Baranovskyi described a failure anyone who’s run an identity program will recognize. An agent asks the policy engine for permission, gets told no, and does it anyway because its harness still holds a credential. His fix is inline enforcement, short-lived credentials, and audit evidence for every call. Identity was the attack surface in 68.1% of the incidents the Expel SOC handled in Q2 2026, and every agent you deploy is one more identity.

On the sandboxing front, Elie Bursztein walked through Capsem, Google DeepMind’s open-source sandbox that gives each agent its own VM. I’ve wanted something like it for a while. My version is a pile of Docker containers. Ankit Agrawal from Webflow called sandboxing a three-body problem, where tightening containment, provenance, or human authority moves the other two, and Daniel Cuthbert walked through everything that broke while hardening his team’s own sandbox.

Defense is getting serious about measurement

The talks closest to my day job were about measuring defensive agents honestly, from Leo Meyerovich’s three years of incident response evals to Wiz shadow-testing its SOC agent against human verdicts. Twilio found that in its security review agents, “the models are the reliable part.” The harness, the context, and the measurement matter as much as the model does.

Start with what your agents can reach

We’re a little over our skis on agent adoption, and our controls haven’t caught up. If you’re deploying coding agents, SOC agents, or anything else that acts on someone’s behalf, start with questions you can answer this week. What can each agent reach, and with which credentials? When policy says no, what physically stops it? Where does code it didn’t write run? Can you check what it says it did against what the system says happened? None of this is exotic. It’s least privilege, short-lived credentials, isolation, and good logging, just faster. (The software all of us are vibe-coding right now is its own problem, and the subject of my next post.)

In March, I closed my remarks with two asks. They still hold.

• At work: tell three people what’s coming. Your CFO, someone in marketing. Security is about to get much harder, and it’s a whole-company problem.

• At home: find three skeptics and help them see what’s coming and how to use it.

The people at [un]prompted are ahead of the curve almost by definition, so getting everyone else ready falls to us. The security community has done that before.