This Week in AI Security - 16th July 2026

Another lighter week that lets Jeremy slow down and dig into the stories that matter most. The theme running through this episode: the tooling and plumbing around AI keep proving to be the real attack surface, and the economics of who owns AI-generated value are becoming a live debate. This week covers a prompt-injection twist that turns code-scanning agents against the code they are meant to protect, a new evolution of package-name squatting, a Langflow vulnerability hitting a major patching milestone, another agentic AWS compromise, and Satya Nadella's argument that enterprises are paying for AI twice.

Key Episode Highlights

• "Friendly fire": AI agents built to scan for malicious code can be tricked into executing it, when a code repository being scanned contains embedded malicious instructions that hit the third-party scanning engine rather than the codebase itself.
• Hallux squatting: researchers from Tel Aviv University and the Technion show that LLM package-name hallucinations are predictable at roughly 85 percent accuracy and consistent across foundation models, letting attackers pre-register those names and stuff them with malware. The evolution of what was called slop squatting, and Palo Alto's phantom squatting.
• Langflow hits the CISA KEV: CVE-2026-55255, an IDOR (broken function level authorization) flaw letting an authenticated user run any other user's workflows, has landed in CISA's Known Exploited Vulnerabilities catalog, roughly three months from first report to confirmed in-the-wild exploitation and a federal patching mandate.
• Another agentic AWS compromise: concurrent work streams running credential harvesting, backdoor creation, and RDS data exfiltration, with queues zeroed out to obscure the attack. A follow-on to last week's agentic ransomware story, and notably not built on novel zero-days.
• Nadella on paying twice: the Microsoft CEO argues enterprises pay for AI once in tokens and again by handing over proprietary knowledge through prompts, corrections, and feedback, what he calls "exhaust," raising the question of who should own that data.

Episode Links - ‍

https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html

https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/

https://www.techtimes.com/articles/319918/20260708/cisa-adds-first-ai-agent-platform-kev-sets-thursday-deadline-4-cves.htm

https://www.infosecurity-magazine.com/news/threat-actor-agentic-ai-cloud/

https://techcrunch.com/2026/07/13/satya-nadella-has-issued-a-shocking-warning-to-companies-using-ai/

‍