InfoSecBulletin Cybersecurity for mankind
OWASP has released new guidelines for securing AI applications that use large language models. The guidance, released on July 28, provides technical recommendations for builders and developers of AI agents, particularly targeting AI/ML engineers, software developers, security experts, and AppSec professionals.
“As AI systems evolve toward more autonomous, tool-using, and multi-agent architectures, new security challenges emerge that traditional AppSec can’t handle alone. That’s why the OWASP Gen AI Security Project has published the Securing Agentic Applications Guide v1.0, the most comprehensive and actionable open source security resource yet for Agentic AI developers and defenders,” OWASP wrote on a LinkedIn post.
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
A new resource has been created due to the rising use of AI agents in organizations. AI agents can work independently and share data or results with other AI tools.
These tools function faster than older LLM-based systems and don’t require human prompts. They can adjust to changing environments automatically. The absence of human oversight raises serious security issues, particularly with AI applications in coding and system configuration.
Experts warn that technology will enable cybercriminals to automate more aspects of cyberattacks, including account takeovers.
Agentic AI Security Focus Areas
The OWASP guidance covers security across the full agentic AI development and deployment lifecycle.
Securing agentic architectures: The guidance highlights the importance of including security in the architecture, focusing on user permissions and authentication, such as asking for credentials when tasks require user interaction with their browser or computer.
Design and development security: This section focuses on steps to prevent AI models from being misused or behaving unexpectedly.
Enhanced security actions: Organizations are advised to add extra security tools and measures to their systems to reduce risks from AI agents, such as using OAuth 2.0 for permissions and authorization, managing identities to avoid storing passwords, and encrypting sensitive data.
Supply chain security: Organizations should reduce risks from third-party code in agentic AI by managing data access and checking for code vulnerabilities.
Assuring agentic applications: The guidance recommends conducting regular red teaming exercises to uncover vulnerabilities and potential attack vectors in agentic systems
Securing deployments: Basic security measures should be implemented in production environments to protect AI agents.
Runtime hardening: Security teams should mix standard VM security measures with specific controls like sandboxing, audit tracking, and runtime behavior monitoring
