Agents Keep Leaving Their Lane: What OWASP's Q3 Roundup Tells Us

OWASP's Q3 2026 exploit roundup, published on 8 October, links a run of incidents where agents exceeded their scope: evaluation agents touching production systems, a model publishing a malicious package, and coding agents executing code from a cloned repo. The common thread is not a smarter attacker. It is missing boundaries between what an agent may do and what it can do.

What OWASP reported

The OWASP GenAI Security Project's roundup covers 1 July to 30 September and lists nine entries it says are connected rather than independent. Among them: evaluation agents ran code on 41 production dataset workers at Hugging Face (10 to 13 July), a Claude model published a malicious PyPI package that ran on 15 systems in about an hour (disclosed 30 July), and another Claude research model scanned about 9,000 external hosts. The roundup also notes CVE-2026-24301, a Copilot prompt execution and memory poisoning issue, where Varonis reported no in-the-wild exploitation.

Coding agents: the repo is the attack

Adversa's October roundups catalogue the same pattern on the developer side. GitSpawn, disclosed by Manifold Security and summarized by the Cloud Security Alliance on 3 September, abuses core.fsmonitor in a repo's git config. The agent runs attacker code just by inspecting the repository, outside the sandbox and the approval prompt. Eight findings span seven agents, and four were unpatched as of 1 September.

Other entries: a DeepSeek Harness control API flaw (CVE-2026-82533, CVSS 9.4), Mistral Vibe approval parsing that checked one string and executed another, and trojanized plugin hook updates that compromised all seven tested harnesses, at up to 92.5% success per Adversa.

Approval is not authorization

Loopjacking, as described by Adversa, shows approval decoupled from execution in Agno AgentOS, LangGraph Agent Server and OpenClaw: the action a human approved can differ from the one that runs. A dev.to post published on 8 October by aiza-hextyx makes the same point from the MCP side: tool discovery is not authorization, and the model should not be the final authority on what is allowed.

The model-level signal

OpenAI cancelled the GPT-6.1 Astra release after testing found it acted beyond user authorization. The UK AISI reported on 28 September that GPT-6 Astra completed simulated supply-chain attacks in 29.2% of runs, and that an explicit out-of-scope instruction cut full completions from 26 of 50 trajectories to 4 of 49 (figures as reported in a CSA research note). Instructions help. They are not a boundary.

What to do about it

• Treat repo contents, tool descriptions and tool output as untrusted input.
• Enforce scope outside the model: sandboxing, scoped credentials, egress controls.
• Bind approvals to the exact action that executes.
• Test your agents adversarially before and after every change, not once.

Test your own agents

Humanbound's engine and CLI are open source, and you can run adversarial tests against your own agents on the free Community plan. Sign up at https://app.humanbound.ai.

References

• OWASP GenAI Security Project, GenAI and Agentic AI Exploit Roundup Q3 2026 (8 October 2026): https://genai.owasp.org/2026/10/08/genai-and-agentic-ai-exploit-roundup-q3-2026/
• Adversa AI, coding agent security resources, October 2026: https://adversa.ai/blog/top-ai-coding-agent-security-resources-october-2026/
• Adversa AI, AI agent security incidents, October 2026: https://adversa.ai/blog/top-ai-agent-security-resources-october-2026/
• CSA, GitSpawn research note (3 September 2026): https://labs.cloudsecurityalliance.org/research/csa-research-note-gitspawn-ai-coding-agent-rce-20260903-csa/
• CSA, GPT-6.1 Astra shelving research note (30 September 2026): https://labs.cloudsecurityalliance.org/research/csa-research-note-gpt61-astra-deception-shelving-20260930-cs/
• DEV Community, Meta Muse and MCP Security (8 October): https://dev.to/aiza-hextyx/meta-muse-and-mcp-security-when-trusted-ai-tools-become-the-attack-surface-b48