More from the AccuroAI blog.

NIST wrote the AI agent threat model in August 2020 and almost nobody cites it. Section 5.7 of SP 800-207 describes prompt injection, the credential gap and the confused deputy, two years before ChatGPT. Here is which zero-trust tenets survive contact with an agent, which need rebuilding, and what the standards bodies have quietly declined to solve.

An AI governance auditor does not tick your environment off against a control list. They take your own statement of applicability and test whether you did what it says, which means the highest-value week of preparation is spent on a document most teams write last.

In the most common attack the agent never contacts the attacker. Your own client does, rendering a markdown image and issuing a GET nobody clicked. Here are the four paths data takes out, why domain allowlisting meters exfiltration rather than stopping it, and which controls hold up against an attacker who has read them.

Four major vendors ship products called an agent gateway and they do four different things: a proxy, a protocol converter, a container supervisor and an analytics layer. Here is what the term means, what a checkpoint can mechanically enforce, and the transport it structurally cannot see.

Salesforce documents that a Service Agent passes the customer's identity to the agent but does not use it to control data access. It also documents that Einstein Trust Layer masking is disabled for agents. The same prompt template masks PII for a rep and does not mask it for an agent. Here is what each CRM vendor actually enforces.

The telemetry standard everyone is converging on marks tool arguments and results as opt-in, and tells instrumentations not to record inputs or outputs by default. Ship that and you get a span saying the agent called send_email, with no record of the recipient. Here is the field list that survives an investigation, and what the EU AI Act actually requires.

SigmaHQ carries 3,783 rules and returns zero for copilot, gemini, mcp or prompt injection. If you went looking for prior art on AI agent detection and found nothing, that absence is real. Here is the content, the exact field names, and the honest coverage limits.

Every page ranking for LLM security still cites the 2025 OWASP list. The 2026 edition is incident-weighted, excessive agency climbed from sixth to third, and system prompt leakage was rescoped to cover your tool schemas. Here is the current list, the layer each risk is exploited at, and the 2026 incidents that moved from research disclosure to confirmed exploitation.

Every AI policy template opens by implying a legal mandate that does not exist. What the laws actually require is notice, documented assessments, retention and in one city an audit. This is the structure that satisfies them: nineteen sections, a worked data-class permission matrix, tool tiers defined by contract rather than brand, and the agent clauses no published corporate policy carries yet.

NCUA's own AI page says the agency has issued no AI-specific rules, and points credit unions to third-party due diligence letters written in 2001 and 2007. It also has no authority to examine the vendors that ship most credit union AI. Here is what still binds you, and what is moving.

In April 2026 the Fed, OCC, and FDIC retired SR 11-7 and deliberately left generative and agentic AI outside its successor's scope — just as one in three new bank AI use cases turned agentic and a US bank filed an 8-K over customer SSNs in an unauthorized AI app. The rulebook fragmented; the liability didn't.

Verizon's care desk answers with Gemini. T-Mobile wired OpenAI into its transaction systems. Operators are declaring Level 4 network autonomy while nobody can certify Salt Typhoon is gone. The FCC already wrote the rules that govern all of it; it just never used the word AI.