Agentic AI Security: Access is Key, Not the Trick

Researchers at Noma Labs successfully tricked GitHub's new Agentic Workflows into leaking private data in July 2026. They used a public issue with instructions for the agent to retrieve information from other repositories. Adding the word "Additionally" to their prompt was enough to bypass GitHub's safeguards. The agent then fetched a private README and posted its contents publicly. What's interesting is that while the "trick" starts an incident, the actual damage depends on what the agent can access. Several incidents in 2026 highlight this. For example, in February, Check Point Research found vulnerabilities in Anthropic's Claude Code. One flaw, CVE-2026-21852, could expose a user's Anthropic API key directly to an attacker. While code execution flaws had higher severity scores, the stolen API key gave attackers lasting access and could redirect authenticated traffic. Similarly, in June, Wiz Research disclosed CVE-2026-12957 in the Amazon Q Developer extension for Visual Studio Code. This vulnerability allowed the extension to load malicious configurations without user consent. The bottom line is that the extent of a security breach often comes down to the credentials, permissions, and authority an agent possesses. This matters because it shows that limiting an agent's access is crucial for preventing severe outcomes.