In December 2025, OWASP released the 2026 edition of its Agentic Applications Top 10 [1], consolidating the threats to agentic applications into a standard list; the derivation below uses it as a reference. The first article took the agent runtime apart into six layers and two components and left behind two structural facts: structural fact 1 is that all external content converges at assembly into one flat token stream with no provenance markers, and structural fact 2 is that the permission checkpoint covers only the model-to-action segment, so content ingestion and configuration loading never pass through it. Derived along that structural diagram, the attack surfaces differ from the threat list: their value lies in testability, in that any new vulnerability or new technique can be located on one of the attack surfaces, while whatever fails to locate exposes a gap in the structural diagram, and both outcomes advance understanding. Once the derivation is done, the ten OWASP categories are placed back onto the seven attack surfaces one by one, and the relation between the threat list and the structural diagram becomes clear. ...
AI Agent Security Series: 1. Taking an AI Agent Apart
Since 2025, mainstream coding agents have entered a period of frequent severe-vulnerability disclosures: Claude Code, Codex, Cursor, Gemini CLI, and GitHub Copilot have each produced vulnerabilities that a malicious repository can trigger remotely. In Claude Code’s CVE-2025-59536, once the user clicked through the trust dialog, hooks configuration shipped by a malicious repository executed without any per-command confirmation [1]; in Codex CLI’s CVE-2025-61260, project-local MCP configuration was auto-loaded, so cloning a single repository handed over execution and the GitHub token [2]; in Cursor’s DuneSlide (CVE-2026-50548/49), the sandbox write allowlist was built from model-supplied parameters, letting injected content point the allowlist at the sandbox executor itself [4]. ...
Analysis of DirectComposition Binding and Tracker object vulnerability
DirectComposition introduction Microsoft DirectComposition is a Windows component that enables high-performance bitmap composition with transforms, effects, and animations. Application developers can use the DirectComposition API to create visually engaging user interfaces that feature rich and fluid animated transitions from one visual to another.[1] DirectComposition API provides COM interface via dcomp.dll, calls win32kbase.sys through win32u.dll export function, and finally sends data to client program dwm.exe (Desktop Window Manager) through ALPC to complete the graphics rendering operation: ...
Analysis of Chromium issue 1196683, 1195777
On April 12, a code commit[1] in Chromium get people’s attention. This is a bugfix for some vulnerability in Chromium Javascript engine v8. At the same time, the regression test case regress-1196683.js for this bugfix was also submitted. Based on this regression test case, some security researcher published an exploit sample[2]. Due to Chrome release pipeline, the vulnerability wasn’t been fixed in Chrome stable update until April 13[3]. Coincidentally, on April 15, another code commit[4] of some bugfix in v8 has also included one regression test case regress-1195777.js. Based on this test case, the exploit sample was exposed again[5]. Since the latest Chrome stable version does not pull this bugfix commit, the sample can still exploit in render process of latest Chrome. When the vulnerable Chormium browser accesses a malicious link without enabling the sandbox (–no-sandbox), the vulnerability will be triggered and caused remote code execution. ...
Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample
The general method of browser render process exploit is: after exploiting the vulnerability to obtain user mode arbitrary memory read/write primitive, the vtable of DOM/js object is tampered to hijack the code execution flow. Then VirtualProtect is called by ROP chain to modify the shellcode memory to PAGE_EXECUTE_READWRITE, and the code execution flow is jumped to shellcode by ROP chain finally. After Windows 8.1, Microsoft introduced CFG (Control Flow Guard)[1] mitigation to verify the indirect function call, which mitigates the exploitation of tampering with vtable to get code execution. ...