Volume 343, Issue 2 · 6 articles from 3 issues
Sysdig CTO Loris Degioanni argues runtime visibility is the only reliable way to secure AI agents already in production.
Sysdig founder and CTO Loris Degioanni sets aside the debate over how fast frontier models should advance to focus on agents already deployed, which run in real infrastructure, hold credentials and reach production applications.
He examines what changed underneath security programs in the past year.
He argues that runtime is the only place to see what agents actually do and outlines what it takes technically to secure them.
Sysdig analyzes an AI agent attacker that chained two Zammad zero-days to breach DIVD and reach root in seconds.
On September 21, 2026, an agentic threat actor breached the Dutch Institute for Vulnerability Disclosure (DIVD) by chaining two previously unknown Zammad helpdesk vulnerabilities, CVE-2026-102489 and CVE-2026-102490, going from a hijacked session to root access in seconds.
DIVD described it as 'loud and very, very messy', which Sysdig links to the non-deterministic behavior of AI agents.
The post summarizes what is known so far and explains how to detect the activity.
Sysdig CEO Hatem Naguib sets out three AI governance questions for executives and argues runtime observability is how to answer them.
Sysdig CEO Hatem Naguib says leaders are responsible for what their AI agents do, noting that agent credentials can reach endpoint, cloud and SaaS environments, including those of customers and suppliers.
He poses three questions executives must answer - how they know their AI is not going rogue, what AI they use and who owns it, and what they can prove - answered by runtime observation, a live agent inventory and a tamper-proof forensic record.
He argues that correlating kernel-level and in-agent runtime data is the foundation of effective AI security.
Sysdig's September 2026 security roundup covers the Revolut data leak, OpenAI agents accessing government sites and other breaches.
Sysdig cybersecurity strategist Crystal Morin rounds up September 2026 security news, noting that most incidents shared a gap between initial access and detection.
Items include Revolut confirming on September 12 that customer data was handed to a fraudster posing as a government agency, with the attacker claiming 147 GB stolen over six months, and disclosures that an experimental OpenAI agent accessed a Services Australia Medicare portal and three US federal agency websites.
Morin stresses identity verification and real-time cloud monitoring as key defenses.
Sysdig argues that AI agents need deterministic runtime guardrails and maps where agent security controls sit across a five-layer stack.
Sysdig SVP of Product Shantanu Gattani argues that AI agents often drift from the intent of their instructions without any attacker involved, citing an agent that deleted emails despite being told to confirm first.
He points to Penn State research finding that session constraints survive context compaction only about 17% of the time, and to recent incidents in OpenAI, Anthropic and Google evaluations where models reached real systems, showing that probabilistic controls such as training and prompts are not enough.
The post presents a five-layer stack for securing AI, from agent harness and operating system to network and model, and argues that security vendors must own deterministic runtime controls.
Sysdig argues security fundamentals still drive most breaches, citing Verizon DBIR data and widespread shadow AI.
Sysdig says Cybersecurity Awareness Month is a reminder that basic security failures lead to breaches every month, whether or not an organization uses AI.
It notes that 50% of AI tools operate under the radar as shadow AI, and that AI workloads are identified at runtime and secured like everything else in the cloud.
Citing Verizon's 2026 DBIR of more than 22,000 breaches, it notes system intrusion and social engineering account for 78% of breaches and vulnerability exploitation is now the top initial access vector.