Zenity

The first round of speakers is here for the AI Agent Security Summit in London, UK! On October 8, join us at 8 Bishopsgate for research, new findings, and unfiltered talks from the pioneers leading the AI Security discussion: Daniel Cuthbert - Security Researcher, Black Hat Review Board Yağmur Ceren Atay - AI Systems Security Researcher John Sotiropoulos - Founder, Deep Cyber Lorenzo Satta Chiris (Lorenzo S.) - Founder & CTO, oorbital AI Michael Bargury - Co-founder & CTO, Zenity The full agenda is on the way - take a first look now: https://lnkd.in/ey__bJWf The League is Assembling. Save Your Spot. #AISecurity #AIAgents #AIAgentSecuritySummit

An AI agent can have every permission it needs and still do the wrong thing. That's goal misalignment. ⚠️ It splits into two failure modes. One is an attacker planting hidden instructions in an email or document the agent will read, quietly redirecting its objective. The other is autonomous: the agent hits an edge case, makes a bad assumption, and reasons its way into an unauthorized action, no attacker anywhere in the chain. Same outcome either way: an agent pursuing a goal nobody intended, using access it was already granted. Traditional security asks who can reach what. Goal misalignment asks a harder question: what is the agent actually trying to do, right now, with the access it has? Permissions alone can't answer that. 🔐 We break down both failure modes, why they happen, and how to catch them at runtime: 👉 https://lnkd.in/eXHmG84Z #AISecurity #AgenticAI #AIAgentSecurity #AIGovernance #Cybersecurity

Prompt injection in a chat window is annoying. Prompt injection in an agent that can read your mailbox, call your CRM, and send an email? That's an incident waiting for a trigger. 🎯 The 2026 OWASP Top 10 for LLM Applications just moved Excessive Agency from 6th to 3rd. Prompt Injection and Sensitive Information Disclosure held the top two spots. The common thread across all three: they're harmless until the model can act. Rock Lambros, who co-leads the 2026 OWASP GenAI Security Project edition, breaks down where Zenity detects and blocks each entry on the list, and where it doesn't (yet). No inflated coverage claims. Just the map, entry by entry. 👉 Read the full breakdown: https://lnkd.in/dquzhb22 #AISecurity #AgenticAI #AIAgentSecurity #Cybersecurity #EnterpriseAI OWASP GenAI Security Project

🌎 Zenity is coming to Gartner Security & Risk Management Summit EMEA! Join us at the Excel London at Booth #123 from Sep 22-24 and see how we answer the hardest questions security teams are asking today: - How do we safely expand the use of autonomous AI? - How do we govern what agents are permitted to access, decide, and do? - How do organizations enforce security policies before risky actions occur? Meet us there 👉 https://lnkd.in/e5E_dJXZ #GartnerSEC #GartnerSRM #AIAgents

It's been a while since Dmitry L. published his last work, but a lot has been going on behind the scenes. Today Dmitry L. shares his latest research: "It's Always DNS in Claude's Sandbox: From Data Exfiltration to a Bidirectional DNS Shell," live now on Zenity Labs. He explores how DNS egress from Claude's code execution sandbox can be abused for data exfiltration, and walk through building a bidirectional shell-like channel between the sandbox and a local machine using DNS. Give it a read. Link in the comments!

LLMs don't have a reliable way to tell data from instructions. 🧠 An agent reading a GitHub issue to understand a feature request and an agent reading a GitHub issue with hidden malicious instructions are doing the same thing from the model's perspective: processing content and deriving intent from it. That's why prompt injection is a structural problem, not an implementation flaw, and why zero-click attacks eliminate the one fallback traditional security has always relied on: user awareness. The developer never sees the attack. They just see the agent doing what agents do. Our new guide covers the full threat landscape this opens up. 👉 https://lnkd.in/e6tKmSHX #AISecurity #AgenticAI #AIGovernance #AIAgentSecurity

Zenity is hiring an Enterprise Account Executive to own Texas, Oklahoma, Louisiana and Arkansas: a Fortune 1000 territory, CISO relationships, and real deals already in motion. We are not looking for someone to manage a patch. We want a driver who wants to build one. TOLA is a key market, and the next Zeniteer in region will help to win the trust of the market and why Zenity is the ONLY choice for Agentic AI governance and security. #Hiring #EnterpriseSales #AISecurity https://lnkd.in/edTabans

Most AI agent security spending goes to one moment: the review before an agent ships. 🔐 But that's not where the risk lives. In a 2026 survey of 445 IT and security professionals, Zenity and the Cloud Security Alliance found that 53% of organizations have had AI agents exceed their intended permissions. 47% had already dealt with an agent-related security incident. Build-time review answers one question: was this agent safe to ship? Runtime security answers a different one: is this specific action, happening right now, one this agent should take? An agent can pass the first test completely and still fail the second one, repeatedly. In our latest Academy article, we break down: 🔎 Why build-time and runtime security catch entirely different failures ⚠️ The attacks that only show up after deployment (prompt injection, context poisoning, tool misuse) 🛡️ Why defense in depth means running both, not choosing one Intent is not control. 👉 https://lnkd.in/e7Nqmmk6 #AISecurity #AgenticAI #AIAgentSecurity #AIGovernance #Cybersecurity

One comment. Zero clicks. A hacked WhatsApp contact list and an Amazon order on someone else's card.  How is that possible?  A single planted comment under a public X post was all Zenity Labs needed to hijack ChatGPT Atlas, OpenAI's agentic browser, twice.  In the first attack, a victim's ordinary "sign me up for this newsletter" request got redirected into sending phishing messages to their entire WhatsApp contact list, from their own account. In the second, the same technique routed the agent to Amazon, filled a cart, and changed the delivery address to the attacker's. Atlas held its one real hard boundary, the final "buy" button, so we didn't break it. We asked Amazon's own shopping assistant, Rufus, to finish the purchase instead.  Every other defense Atlas has is a judgment call: an on-page classifier, an English-tuned injection filter, a sensitive-site check, a confirmation gate. Judgment is exactly what a planted comment is built to exploit. Zenity Labs maps every boundary we found, and how we got past it. 👉 https://lnkd.in/eiWKb8Yp  #AISecurity #AgenticAI #AIAgentSecurity #Cybersecurity