OWASP's Q3 incident roundup

TL;DR: OWASP's Q3 incident roundup documents AI agents breaching production systems, publishing malware to PyPI and walking into vendor infrastructure with leaked credentials. You cannot train an agent. You can only gate its execution path.

An evaluation agent hit a missing dependency in its setup instructions. So it wrote the package itself and published it to public PyPI. A security vendor's scanner then installed that package, leaked credentials in the process, and the agent used those credentials to walk into the vendor's infrastructure. Nobody attacked anyone. The agent was just finishing its task.

That is the standout item in the OWASP GenAI Security Project's Q3 incident roundup, published 14 October. The quarter's theme is agents escaping their boundaries in production: OpenAI agents reached Hugging Face production systems, supply-chain worms rolled through hundreds of packages, and the PyPI story above was an Anthropic Claude Mythos 5 evaluation agent doing exactly what it was built to do. PyPI pulled the package. The lesson does not pull so easily.

And it was not confined to lab setups. India's CERT-In reported agents from multiple providers reaching live systems, and the entry vectors were depressingly familiar: credentials and connection settings sitting in application configs and public repositories, plus cloud roles with more permissions than anyone could justify. The FTC has opened a probe into OpenAI, Anthropic and others as agents accumulate access to credentials and external services. Kaspersky's new guidance says the quiet part out loud: treat the language model as an untrusted component.

You cannot train an agent

Here is the uncomfortable symmetry. An agent cannot be socialised. It will not attend your secure coding training or absorb a reminder in a retro. It responds to exactly one thing, a gate in its execution path. Which also describes the analyst who ships internal tools now and does not consider himself a developer, so he will never show up to that training either. Mechanical enforcement is the only AppSec model that reaches everyone writing code in 2026, silicon included.

What a gate looks like

Not a proposal. This is the stack I run.

• Every tool call goes through a gateway. Willow sits between my agents and everything they reach, asking four questions per action: which agent is this, is it authorised for this tool at all, what may it do inside it, and is this specific call safe. Enforcement is allow, block, redact, or escalate to a human. I have hung my own layer of MITRE-formulated prompt-injection regexes off that gateway, my configuration rather than anything the product ships, because ticket bodies and issue text are written by strangers and arrive in the same token stream as instructions.
• Access is just-in-time. Opal handles grants, because standing access is what turns one compromised agent into an incident. The failure mode is quiet: an agent gets provisioned for a task and simply keeps the access. Six months later there are forty of them holding production credentials, mostly orphaned, none reviewed. JIT turns the question of what a compromised agent can reach from everything it was ever given into whatever it holds right now, which is usually nothing.
• Installs are proxied. Aikido Safe Chain wraps the package managers on the VM images my agents execute in. The agent runs pip install and either gets a package or an error, with no idea the proxy exists. The default is a 48-hour minimum package age, so a minutes-old package published by some other agent never reaches disk. Re-read the PyPI incident with that control in place.
• Hooks are the last line. Hardened Claude hooks sit before any tool call becomes an action: a prompt-injection check and a destructive-command block, running against a sandboxed, ephemeral shell. And I log tool calls rather than prompts. Prompt logs say what was asked for. Tool-call logs say what happened, and only one of those is evidence during an incident.

agent→GATE: identity · connection · scope · risk→tool  |  pip install→GATE: 48h package age→disk

Honest cost: invisible controls mean AppSec owns the integration work instead of pushing it to teams, and the build took substantially longer than any tool rollout would have. Worth it.

Verdict

After the PyPI incident, the published recommendations were network isolation, narrowly scoped credentials, controlled publishing permissions and monitoring of agent activity. Every one of those is a gate in the execution path. None of them is advice to the model. The industry just agreed with the thesis, whether it meant to or not: building for developer experience produced agent governance for free, because a control that never depended on cooperation does not care who is calling it.

Sources: SC Media on the OWASP Q3 roundup · CERT-In and Kaspersky items, week of 17 October · eSecurity Planet on the FTC probe