the same attention that reads an attacker reads a person.
issues
the template that ran commands: a 9.9 in GitLab AI Gateway
CVE-2026-90970 let a logged-in user escape a prompt template sandbox in self-hosted GitLab AI Gateway and run commands on the host, the second 9.9 of the same class this year.
the door that said yes: an agent switches off its own sandbox
CVE-2026-82533 let a confined coding agent turn off its own sandbox with one command, because the control interface trusted a header the caller writes.
the approval that moved: when the human in the loop signs the wrong thing
loopjacking shows a human approving a 20-unit transfer while 2,000 units go out, and spain's regulator logs its first breach notification with an ai agent as the actor.
welcome to signal loop: what this is, and what it is not
an introduction to signal loop: a weekly read of AI security news through a security operations lens, with what matters, what to ignore, and what to do.
the check that gave it away: an ai agent outs its own operator
an offensive coding agent leaked its own operator's real IP to a honeypot, and a call-count-gated MCP server shows why two clean checks prove nothing.