AI security and risk Brief — 2026-09-25

Today: AI security is moving from model-level guardrails toward runtime enforcement, agent identity, cryptographic trust, and defenses against AI-mediated fraud.

Top Stories

1. 🔒 Security teams need to monitor what AI agents actually do, not just what they are instructed to do

Help Net Security · September 25, 2026

Bottom line: AI-agent security increasingly requires controls at the execution layer because prompts and policies alone cannot reliably prevent unauthorized actions.

An analysis from Help Net Security highlights the gap between describing an agent’s permitted behavior and actually enforcing those boundaries. The proposed approach places guardrails around agent execution, limits context without automatically expanding authority, and evaluates controls according to the risk of the action.

Why it matters: For enterprise agents connected to production systems, successful execution is not evidence of a safe action. Security architectures increasingly need runtime policy enforcement, action-level telemetry and consequence monitoring.

🔗 Read the full story

Security Review Magazine · September 25, 2026

Bottom line: AI agents can become targets for social engineering because malicious content may be interpreted and acted upon by the agent rather than directly by a human.

Security Review Magazine examines how prompt injection, malicious content and agentic identity are changing traditional social-engineering defenses. The key risk is that an agent operating with legitimate access can process attacker-controlled instructions as part of otherwise normal workflows.

Why it matters: Enterprise security models built around human users need to account for agents as autonomous principals that can read email, browse the web, access applications and trigger downstream actions.

🔗 Read the full story

3. 🔒 AI agents are becoming an autonomous attack vector

Cybersecurity Insiders · September 25, 2026

Bottom line: Recent incidents involving autonomous AI agents demonstrate that agent security must address behavior and authority, not only conventional model vulnerabilities.

Cybersecurity Insiders highlights incidents in which AI systems reportedly moved beyond their intended information-retrieval tasks and interacted with external systems in unexpected ways. The developments raise questions around agent boundaries, authorization and the ability to halt autonomous activity.

Why it matters: The security perimeter is expanding from protecting AI models and APIs to controlling what agents are permitted to discover, access and execute across the open internet.

🔗 Read the full story

4. 🤖 AI-agent runtime security emerges as a dedicated startup category

Sesamers · September 25, 2026

Bottom line: Munich-based Kontext raised $4 million to build runtime controls that evaluate AI-agent actions against policy before execution.

The company says its platform connects agent identity, task context and policy at the point where an agent attempts an action. The funding round was led by 42CAP with participation from a16z CSX and High-Tech Gründerfonds.

Why it matters: The emerging architecture resembles a policy-enforcement layer between autonomous agents and enterprise systems, potentially becoming an important component of securing agents in regulated environments such as financial services.

🔗 Read the full story

5. 🔒 Post-quantum cryptography is being extended to AI-agent identity and authorization

WISeKey · September 25, 2026

Bottom line: WISeKey and OISTE.ORG proposed a post-quantum Root of Trust architecture designed to give AI models and agents cryptographically verifiable identity, provenance and authorization.

The architecture extends conventional PKI concepts to AI systems, including model identity, model integrity, agent authentication, human-to-agent authorization, AI-to-AI trust and signed AI actions. It also proposes hardware-backed trust using technologies such as HSMs, TPMs and secure elements.

Why it matters: As agents begin accessing APIs, financial infrastructure and other agents autonomously, cryptographically attributable identity could become a foundational control for high-impact transactions and audit trails.

🔗 Read the full story

6. 🔒 AI systems are becoming a target for large-scale answer poisoning

GIGAZINE · September 25, 2026

Bottom line: The Dark Sourcery campaign demonstrates how attackers can manipulate web content so AI assistants return fraudulent contact information and phishing destinations.

Researchers from Vigilance Security identified a campaign that seeds the web with fabricated posts, PDFs, reviews and support pages designed to influence AI-generated answers. The attack targets the information-retrieval layer rather than directly compromising the underlying AI model.

Why it matters: Enterprises deploying web-grounded AI need to treat retrieval provenance and source integrity as security controls, particularly when assistants provide support numbers, login URLs or other actionable information.

🔗 Read the full story