LIVE
Anthropic says Claude helped trace the origin of NIST's mysterious ECDSA seeds16/10/26 · Anthropic|Reflection AI unveils Beam, a 501-billion-parameter open model16/10/26 · Reflection AI|Meta releases Muse Spark Open, a mixture-of-experts model built for local Mac Studio inference15/10/26 · Meta|Meta releases Muse Spark Open, an open-weight multimodal model15/10/26 · Meta|Google DeepMind outlines safety measures behind Gemini 4 Argon13/10/26 · Google DeepMind|Tev-Gym: A Training Recipe to Fix Sparse Rewards in Long-Horizon Agents13/10/26|Google DeepMind references Gemini 4, code-named Argon13/10/26 · Google DeepMind|Google DeepMind unveils Gemini 4 Argon, a robotics-focused variant13/10/26 · Google DeepMind|Character.AI files for Chapter 11 bankruptcy, sells assets to Disney13/10/26 · Character.AI|Study Shows AI Models Can Provably Conceal Arbitrary Capabilities13/10/26|Websites are increasingly shutting out AI agents18/10/26|NVIDIA RTX Spark laptops bring local AI to premium Windows PCs17/10/26 · NVIDIA|Anthropic says Claude helped trace the origin of NIST's mysterious ECDSA seeds16/10/26 · Anthropic|Reflection AI unveils Beam, a 501-billion-parameter open model16/10/26 · Reflection AI|Meta releases Muse Spark Open, a mixture-of-experts model built for local Mac Studio inference15/10/26 · Meta|Meta releases Muse Spark Open, an open-weight multimodal model15/10/26 · Meta|Google DeepMind outlines safety measures behind Gemini 4 Argon13/10/26 · Google DeepMind|Tev-Gym: A Training Recipe to Fix Sparse Rewards in Long-Horizon Agents13/10/26|Google DeepMind references Gemini 4, code-named Argon13/10/26 · Google DeepMind|Google DeepMind unveils Gemini 4 Argon, a robotics-focused variant13/10/26 · Google DeepMind|Character.AI files for Chapter 11 bankruptcy, sells assets to Disney13/10/26 · Character.AI|Study Shows AI Models Can Provably Conceal Arbitrary Capabilities13/10/26|Websites are increasingly shutting out AI agents18/10/26|NVIDIA RTX Spark laptops bring local AI to premium Windows PCs17/10/26 · NVIDIA|
+ nAIvigateA SHEET FOR PEOPLE WITHOUT 2 HOURS
+ nAIvigate · fiches / securite-agents-ia
▣ fiche-003.md ×
□ index.md
☰ ContentsVerdictThreatsMarket signalsReference frameworksAction plan

AI agents: your new employees have no badge.

An AI agent is a process that acts: emails, databases, APIs, repos. It works with whatever rights it's been granted, with no identity of its own, often with no logs. The market has just acknowledged this, two dedicated launches on the same day in early August. Your agents, meanwhile, are already running. Who's watching them?

Verdict

the essentials in 10 seconds3 rows
IDENTITYYour agents act with your rights: borrowed human accounts, shared tokens, catch-all service accounts.BLIND SPOT
TRACEABILITYWho did what? The agent or the human? Without dedicated logging, it's impossible to prove.BLIND SPOT
REGULATORYThe omnibus deferred nothing here: transparency and AI literacy remain mandatory for your agents.MANDATORY

Threats

the 6 vectors you need to know6 rows
injectionPrompt injection: content read by the agent (email, web page, ticket) becomes an executed instruction.TOP RISK
exfiltrationLeak via tool: a poorly scoped MCP connector exfiltrates your data outward, cleanly.
shadow-agentsShadow agents: deployed by business units, unknown to IT. Shadow AI's active version.FREQUENT
privilègesPrivilege escalation: the agent accumulates the rights of its tools; the sum exceeds what any human would have.
poisoningContext poisoning: corrupted memory, RAG or documents durably steer its decisions.
supply-chainTool chain: a compromised third-party MCP server means direct access to the heart of the IS, under a trusted flag.

No badge required, in 6 steps

the sequence, and where to cut it6 links

The 6 vectors above don't strike at random: they chain together. Here is the sequence, and the control that breaks each link.

1 Entry How the malicious instruction arrives Indirect injection via tool MCP descriptor rug-pull Booby-trapped file / email Poisoned RAG context → Treat every tool output as untrusted input 2 Persistence How it survives the session Memory poisoning Stored instruction Cross-session leak Contaminated summary → Signed memory, TTL, per-tenant isolation 3 Action How it turns into an act Confused deputy Excessive permissions Command injection via tool Exfiltration via legitimate call → Tool allow-list + human validation on irreversible actions 4 Identity With what rights it acts Over-scoped token Orphaned non-human identity Delegation without mitigation Secret exposed in plain context → One agent = one identity, minimal rights, rotation 5 Propagation How it spreads Inter-agent trust (A2A) Third-party MCP server Unaudited plugin Agent as injection relay → Zero trust between agents, approved tool registry 6 Drift What breaks without an attacker Infinite loop Recursive action Goal misalignment Silent behavioural drift → Budgets, kill-switch, monitoring of deviations from baseline

Market signals

what has just moved4 rows
06.08.2026Rubrik Agent Identity: access control and monitoring of agent actions. The problem is becoming a market.LAUNCH
06.08.2026Mistral Shieldstral: natural-language control rules for generated or processed content.LAUNCH
13.04.2026ANSSI CERTFR-2026-ACT-016: official warning against autonomous agents on workstations.BULLETIN
tendanceAttackers are moving through trusted ecosystems (cloud, SaaS, AI) to remain invisible.

Reference frameworks

who covers what4 rows
ANSSIAutonomous agent recommendations: the French reflex, enforceable internally.FR
NIST-AI-RMFAI risk management framework: the common vocabulary for risks/tests/roles.US
ISO-42001AI management system: the certifiable building block, a cousin of 27001.CERTIF
AI-ActArticle 50 transparency + literacy: your agents talk to humans who must know it.MANDATORY

Action plan

to launch this week5 rows
01Inventory the agents, official AND shadow: what's running, where, connected to what.WITHIN 10 DAYS
02One identity per agent: a dedicated account, never a borrowed human account. Otherwise your logs are lying.
03Least privilege per tool: every connector scoped to read/write strictly as needed.
04Log the actions: who, what, when, on whose orders. Your evidence in the event of an incident.
05Human in the loop, mandatory validation for irreversible actions: payment, deletion, external sending.

Go deeper

fundamentals, in Learn2 links
→Agents IA autonomes : le bulletin ANSSI décrypté18 MIN→Architecture agentique : comprendre avant de déployer25 MIN
How many agents are running in your organisation, right now? Shadow AI Sentinel: 90 days to map your agents (declared and shadow) and put identities, privileges and logging in place.
REQUEST AN AI RADAR →
⎇ mainfiche #003 · securitesources: ANSSI CERTFR-2026-ACT-016 · NIST AI RMF · ISO/IEC 42001 · annonces éditeurs 06.08.2026
Follow nAIvigate | naivigate.com/en/fiches