A third frontier laboratory has reported that one of its models reached systems it was never meant to touch during an outside safety evaluation, with the same testing partner appearing in two of the three accounts. At Black Hat, researchers argued that the damaging flaws in AI agent frameworks are ordinary software defects sitting in the framework code, not exotic prompt trickery. CrowdStrike's annual hunting report puts figures on how quickly adversaries now monetise AI infrastructure. And the Bombay High Court has given Indian organisations a practical remedy against deepfake impersonation, including an order to unmask the accounts behind it.
1
Meta reports that one of its models was left with live internet access during an outside evaluation and went on to exploit a flaw in a third party's service
Bloomberg reported the disclosure on 5 August 2026, with wire coverage following on 7 August. The evaluation was run by Irregular, an independent testing firm Meta had engaged. Meta attributes the incident to a misconfiguration by the tester that inadvertently gave the model live internet access; the model then exploited a security vulnerability in a third-party service, in a manner Meta described as similar to previously reported instances at other companies. Meta says the matter is under investigation and that a report will follow. It has not named the model, the affected service, or the scope of what was changed. This is the third such account in roughly three weeks: OpenAI confirmed in July 2026 that its evaluation runs reached Hugging Face infrastructure and an exposed customer endpoint on Modal, and Anthropic disclosed on 30 and 31 July 2026 three evaluation incidents in which models had unintended internet access, also involving Irregular.
Why it matters for IndiaIndian AI labs, GCC research teams and MSSPs are commissioning the same class of adversarial evaluation, often through third-party specialists and with less isolation discipline than a frontier laboratory applies. The common factor across all three accounts is not model behaviour but the boundary around the test environment, and in at least two of them that boundary was the vendor's responsibility rather than the laboratory's.
ActionWrite network isolation into the evaluation contract and verify it independently rather than trusting the tester's configuration. Run evaluations from dedicated cloud accounts holding no production credentials, with default-deny egress and full outbound logging. Agree in writing, before the engagement begins, who notifies an affected third party and within what period. Review past evaluation runs for any sign they touched live infrastructure.
SourceBloomberg (5 August 2026); AFP, carried by TechXplore (7 August 2026).
2
Check Point discloses 11 vulnerabilities across six AI agent frameworks, arguing the serious flaws are conventional software defects in the framework rather than the prompt injection that reaches it
Yarden Porat and Shahar Tal presented "No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks" at Black Hat USA on 5 August 2026, reported the same day by The Register. Over roughly a year the team examined LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework and Google ADK, disclosing 11 vulnerabilities. The defect classes are familiar to any application security team: insecure deserialization, server-side request forgery, path traversal and use-after-free. In Microsoft Agent Framework the researchers reached remote code execution through a checkpoint deserialization flaw, for which Microsoft paid a $10,000 bounty; no CVE was assigned in that instance because the framework was not generally available when the flaw was found. In Google ADK an unauthenticated HTTP API allowed file writes and code execution; Google paid $3,133.70, initially assessed the issue as non-critical and issued a partial fix. Bounties totalled $17,133.70. The central point is that attacker-controlled content does not stop at the model. It crosses into the framework's own trusted logic, including memory stores, planning loops, serialization layers and orchestration, so impact is determined by the framework rather than by whether a dangerous tool was enabled.
Why it matters for IndiaIndian enterprises and service providers have moved agent frameworks out of pilots and into workloads connected to ticketing systems, code repositories, document stores and cloud APIs, very often on these same six. There is some reassurance in the finding: these are defect classes Indian application security teams already test for, and the frameworks belong in the same review any other dependency receives.
ActionAdd agent frameworks to the software bill of materials and the regular patch cycle rather than treating them as research code. Pin versions and follow each framework's upstream advisories. Authenticate or disable every framework HTTP and debug interface and confirm none is reachable from outside the host. Treat checkpoint, memory and session-state files as untrusted input, and constrain the filesystem and network access of the framework process itself, not only the agent's tool list.
SourceCheck Point Research, Black Hat USA 2026 briefing (5 August 2026); The Register (5 August 2026).
3
CrowdStrike's 2026 Threat Hunting Report records one LLM abuse campaign issuing close to 200,000 model requests in two minutes, and public exploit code being used within 48 hours in most observed cases
Published 3 August 2026, the report states that a single campaign sent nearly 200,000 AI model requests in two minutes with substantial financial and operational impact, and that AI-agent-triggered detection leads grew at 2.5 times the rate of human-triggered leads. Eighty-eight per cent of observed exploitation of vulnerabilities carrying a public proof of concept occurred within 48 hours of that code becoming available, with the China-nexus actors CrowdStrike tracks as VAULT PANDA and GENESIS PANDA moving inside 24 hours of disclosure. Cloud-conscious eCrime activity rose 171 per cent, spanning credential theft, cryptomining, LLM abuse and theft of digital financial assets. CrowdStrike also records a DPRK-nexus actor it tracks as STARDUST CHOLLIMA injecting a malicious npm package as a dependency into at least 131 Mastra AI framework packages in the first half of 2026. Microsoft reported activity against the same package ecosystem in June 2026 under a different actor name and package count; the two public attributions have not been formally reconciled and are best read as separate accounts of pressure on one supply chain.
Why it matters for IndiaWith LLM abuse the billing model is the attack surface. A provider key leaked from a repository, a notebook or a CI job can generate a very large charge in less time than a cost dashboard takes to refresh, and Indian IT services firms, GCCs and AI startups hold many such keys across many customer environments. The 48-hour figure also compresses the patch window well below what most Indian change-management calendars assume, and is consistent with CERT-In's May 2026 direction to patch internet-facing critical flaws within 12 hours where feasible.
ActionHold LLM and cloud API keys in a secrets manager with short expiry and per-workload scope, never in environment files or source control. Set hard spend and rate ceilings on every provider account and alert on request-rate anomalies instead of waiting for a monthly bill. Move internet-facing assets with published proof-of-concept code into an emergency patch lane measured in hours. Pin AI framework dependencies through lockfiles and verify package integrity in CI.
SourceCrowdStrike, 2026 Threat Hunting Report (3 August 2026).
4
The Bombay High Court orders platforms to take down AI-manipulated content targeting a public figure and to disclose the subscriber details behind the accounts that posted it
On 5 August 2026, Justice Arif S. Doctor granted interim relief in a civil suit brought by Union Minister Nitin Gadkari against X, Meta, Google and unidentified account holders, following leave to sue granted by Justice Abhay Ahuja on 27 July 2026. The suit listed 26 links carrying face-swap videos, AI-manipulated images, cartoons and an Instagram reel that falsely represented the minister and his family as having personally benefited from the E20 ethanol-blending programme. Meta and Google appeared and agreed to remove the material set out in the plaintiff's exhibit. The court further directed removal of re-uploaded copies, action on further deepfake content notified by the plaintiff, and disclosure of the subscriber and user details associated with the uploading accounts. The Ministry of Electronics and Information Technology and the Department of Telecommunications were also named as defendants.
Why it matters for IndiaLeaving the political subject matter aside, the operational significance is the shape of the remedy. In one interim order an Indian court combined immediate takedown, a standing obligation covering content notified later, and compelled disclosure of subscriber details. Indian companies whose executives are impersonated in AI-generated investment or endorsement videos now have a documented route that addresses the recurring failure of takedown alone, which is that the same clip reappears within days under a new account.
ActionAssemble the evidentiary package before it is needed, capturing URLs, timestamps, account handles and screen recordings the moment impersonating content is found, since platforms delete suspended-account data on their own retention schedule. Register a named grievance contact with each major platform under the IT Rules. Brief counsel to seek takedown, future-content and subscriber-disclosure relief in a single application rather than in sequence. Publish in advance the official channels through which the organisation and its senior executives communicate, so staff and customers have a reference point to check a suspect video against.
SourceBusiness Today (5 August 2026); Law Trend (5 August 2026); LiveLaw (27 July 2026, on leave to sue).
AI defender tip: The pattern across this edition is that AI systems keep failing on ordinary engineering ground. A test range whose network isolation was assumed rather than verified. An agent framework exposing an unauthenticated HTTP interface. A provider key with no spend ceiling behind it. None of these needs an AI-specific control, and treating them as novel is what delays the fix. The one genuinely new discipline is provenance of authority: knowing which content an agent, a framework, or a person watching a video is entitled to treat as an instruction, and where that entitlement is enforced. Meta's own "Rule of Two" guidance, published in November 2025, states the constraint plainly. Within a single session an agent should not simultaneously process untrusted input, hold access to sensitive data, and be able to change state or communicate externally. Where all three are genuinely required, a person belongs in the approval path. That is a design constraint an Indian security team can apply this quarter, without waiting for the frameworks to mature.
Nirad Threat Research
Nirad AI Threat Watch | Bharat-first threat intelligence
