AI agents with access to your systems: the security problem nobody is solving

Today’s most important AI news

The day was dominated by a question engineering and security teams should be asking right now: how well do we control what AI agents can do on behalf of our users? Two independent studies point in the same worrying direction: frontier models have real capabilities to operate in production environments, but the infrastructure around them has serious security holes. There’s also an interesting geopolitical story about where the future of technology is being built.

AI agent frameworks don’t check whether they have permission to act

An audit published today on arXiv reviewed three of the most widely used frameworks for building tool-using agents — LangChain/LangGraph, LlamaIndex and the Stripe Agent Toolkit — and found that all three make the same fundamental mistake: they confuse exposing tools with authorization to use them.

The problem is called “confused deputy failure” and it works like this: an agent has access to tools that affect the real world — payments, emails, infrastructure APIs, CRM — and at the same time reads untrusted content from outside. If that content contains malicious instructions (what’s known as prompt injection), the agent can execute them using the tools it has access to, without verifying whether the request was actually authorized by the user. The researchers tested this on public commits and found that none of the three frameworks re-authorizes each individual call before executing it.

For a product manager or developer building an agent today that touches customer data or processes transactions, this is urgent. The problem isn’t in the language model but in how the frameworks around it are designed. The practical implication is direct: if your agent can read external input and also has tools with production effects, you need an explicit authorization layer between the model and every call to those tools, regardless of what the framework offers by default.

Frontier LLMs in cybersecurity: capable, but not enough on their own

An exhaustive benchmark evaluated six frontier models — GPT-5.4, Codex 5.3, Claude Opus 4.7, Claude Sonnet 4.6, Gemini 3.1 Pro, among others — in two security modes: vulnerability detection in code (in C, Java and Python) and security testing on web applications with 118 real vulnerabilities spread across more than 20 CWE families. The results show that generalist models have notable but inconsistent capabilities, leading the authors to argue in favor of vertical models specialized in cybersecurity.

What makes this study relevant isn’t just the model ranking but the dual methodology: white-box (the model sees the code) and black-box (the model interacts with the application without seeing the source). In black-box mode, which simulates real pentest conditions, general-purpose models show their greatest weaknesses. This suggests that for security teams evaluating adding AI to their workflow, the generic model they already use probably isn’t enough for advanced detection tasks.

For development teams that use AI for code review, the practical reading is more nuanced: current models can be useful as a first detection layer in controlled environments, but assuming they replace a serious security review would be a mistake. The full benchmark, including the test applications, will be published as open source, which makes it a reference worth monitoring.

The world’s most discreet R&D hub is in a city of 400,000 people

MIT Technology Review published a profile today of a city that hosts research centers for Apple, Anthropic, Disney Research, Google, Meta, Microsoft, NVIDIA and OpenAI — practically the entire top tier of the tech industry — in a geographic area half the size of San Francisco. The story doesn’t reveal the name in the available summary, but the fact itself is striking: the concentration of AI R&D is no longer exclusive to Silicon Valley or the big urban centers you’d expect.

This has concrete implications for Latin American entrepreneurs and executives thinking about where the innovation that will define the tools of the next five years is happening. The geography of AI talent is redistributing, albeit selectively, toward places that combine favorable regulation, competitive costs and a concentration of specific technical talent.

The pattern MIT Tech Review describes — two decades of gradual building that ended up attracting all the big players to the same place — is also a lesson about how tech ecosystems form. They don’t happen by decree or by one-off tax incentives, but through sustained accumulation of technical capacity and structural conditions.

In a nutshell

What today’s news shows together is a tension that will define the next stage of enterprise AI adoption: models are ready for complex, high-impact tasks, but the infrastructure around them — the frameworks, the authorization patterns, the security assumptions — was built for simpler systems. We’re taking Formula 1 engines and putting them in chassis designed for another category. The risk doesn’t come from the model but from everything we built around it without revisiting the assumptions. For any team taking agents to production today, the question isn’t “what can the model do?” but “what have we given it permission to do without realizing it?”

---

Sources used: https://arxiv.org/abs/2606.28679, https://arxiv.org/abs/2605.23243, https://www.technologyreview.com/2026/06/30/1139661/building-tech-in-the-worlds-secret-rd-hub/