Prompt injection hits coding agents, OpenAI and Anthropic race to arm defenders, 29 million secrets say your credential hygiene is still a mess.. Oh my.
Several things were converging at once in April, and the common thread is simple: the tools you're adopting faster than you can govern them are becoming attack surfaces faster than you can defend them.
Comment and Control: Your Coding Agent Is a Threat Vector
A researcher has disclosed a prompt injection technique called "Comment and Control" that affects Claude Code, Gemini CLI, and GitHub Copilot Agents. The attack vector is comments. Ordinary source code comments. A malicious comment embedded in a pull request, a dependency, or a scraped documentation file can instruct the coding agent to exfiltrate data, write backdoors, or modify build configurations. The agent reads the comment, treats it as a legitimate instruction, and acts on it.
This is not a theoretical risk. These agents are being wired directly into CI/CD pipelines with write access to production code. A prompt injection via a comment is functionally equivalent to giving a junior developer system-level permissions and then letting anyone on the internet whisper instructions at them through the air vent.
If your organisation has adopted AI coding agents without reviewing what trust boundaries they operate within, you need to do that now. Not next quarter.
The Cyber Model Arms Race: GPT-5.4-Cyber vs Claude Mythos
OpenAI expanded its Trusted Access for Cyber programme in April, making GPT-5.4-Cyber available to thousands of vetted security professionals and organisations. The model is a variant of GPT-5.4, fine-tuned for cybersecurity use cases with a lower refusal boundary for legitimate defensive work. Access is gated through Know-Your-Customer verification and identity checks.
This lands one week after Anthropic launched Project Glasswing, which provides Claude Mythos Preview to major tech companies for vulnerability discovery. Anthropic has described Mythos as too dangerous for commercial release. OpenAI, meanwhile, is scaling access to a similar capability and explicitly framing it as widely available to defenders.
Two things are true at once. These models genuinely improve vulnerability discovery and defensive capability. And the dual-use problem is real: "Cyber capabilities are inherently dual use," as OpenAI itself noted. The question every CISO should be asking is not whether these tools work, but whether their access controls will hold when nation-state operators inevitably figure out how to get verified accounts. The KYC process is good. It is not magic.
29 Million Secrets: AI Agents Are Leaking Credentials at Double the Rate
GitGuardian's State of Secrets Sprawl Report dropped in April. The headline number: 28,649,024 new secrets exposed in public GitHub commits during 2025. That is a 34% year-over-year increase, the largest annual jump in the report's history.
The AI angle is worse. Commits co-authored by Claude Code leaked secrets at roughly double the baseline rate. AI-generated code looks production-ready before it is production-ready. The gap gets filled with hardcoded API keys. Integration velocity increases by 10x, credential governance does not scale at the same rate.
The data on AI-service credential leaks is stark: 1.2 million AI-service secrets exposed, 81% year-over-year growth. Twelve of the top fifteen fastest-growing leaked secret types were AI services. Database platforms designed for AI applications saw leak rates jump nearly 1,000%. Agent-building platforms with broad account-level permissions grew 500 to 600%.
If you have developers using AI coding tools, you need automated secret scanning in your CI/CD pipeline right now. Not as a recommendation. As a gate.
IBM Autonomous Security: Meeting Machine-Speed Attacks With Machine-Speed Defence
IBM announced a new cybersecurity assessment for frontier model threats and IBM Autonomous Security, a multi-agent service designed to automate vulnerability remediation at machine speed. The pitch is straightforward: attackers using AI agents can discover and exploit vulnerabilities faster than human defenders can respond, so defence needs to be automated and coordinated too.
IBM Autonomous Security deploys interoperable AI agents across identity, risk, governance, and operational technology functions. The idea is to rearchitect security programmes so they act as a system rather than a collection of disconnected tools that each need human hands on them.
The framing is right. Fragmented tools and manual processes are outmatched by agentic attacks. The question is whether yet another platform play actually solves the coordination problem or simply adds another pane of glass. Watch the early deployments closely.
EU AI Act: Logging Requirements for AI Agents
The EU AI Act doesn't mention "AI agents" by name, but if your agent scores credit applications, filters resumes, decides healthcare benefits, or prices insurance, it falls under Annex III as high-risk. Article 12 requires automatic logging over the lifetime of the system. Not manual documentation. Automatic recording of events.
Here is the gap: standard application logs can be silently altered, which destroys their evidentiary value. Article 12 doesn't say "tamper-proof," but if your logs can be edited without detection, they are worthless to a regulator. Penalties run up to 15 million euros or 3% of worldwide annual turnover.
Annex III obligations currently take effect August 2, 2026. The Commission proposed a delay through the Digital Omnibus package, possibly pushing to December 2027, and trilogues are underway. But nothing has passed into law yet, so August 2026 remains the enforceable date. Plan for August.
Also Worth Noting
n8n webhook abuse has been active since October 2025, with attackers abusing legitimate automation webhooks to deliver malware via phishing emails. If you run n8n instances exposed to the internet, audit your webhook endpoints now.
CVE-2026-33032, a critical remote takeover vulnerability in Nginx UI, is being actively exploited. Patch your Nginx management interfaces immediately.
Reliaquest reported a credential-stealing campaign called DeepLoad that used AI to build evasion "at every stage" of the attack lifecycle. When the attacker is using AI to obfuscate and the defender isn't using AI to detect, the asymmetry only goes one way.
The Bottom Line
The attack surface is shifting from infrastructure to the AI agents operating on top of it. Prompt injection in coding tools, credential sprawl from AI-assisted development, dual-use cyber models with scaled access, and regulatory deadlines for agent logging are all hitting at the same time.
The organisations that treat AI agents as part of their attack surface now will be fine. The ones that still think of AI as a productivity layer will find out the hard way that their most trusted new tool was also their most exposed entry point.
,-
Sources: SecurityWeek, CyberScoop, Infosecurity Magazine, Help Net Security, IBM Newsroom, GitGuardian, The Hacker News, SecurityWeek RSS, 21 feeds monitored