{
  "schema_version": "newruntime-topic-hub-v0.1",
  "type": "topic_hub",
  "slug": "agent-security",
  "title": "Agent Security - New Runtime",
  "description": "A New Runtime topic hub collecting signals, patterns, field notes, and public sources about agent security.",
  "answer": [
    "Agent Security is tracked here as an evidence-linked topic, not as a static glossary entry.",
    "The page connects raw observations to pattern hypotheses, longer analysis, and public sources.",
    "Use it as the canonical landing page before drilling into individual records."
  ],
  "search_intents": [
    "agent security",
    "agent security AI agents",
    "agent security software"
  ],
  "status": "tracked",
  "last_updated": "2026-07-22",
  "counts": {
    "total": 6,
    "signals": 3,
    "patterns": 0,
    "posts": 3,
    "atlas": 0,
    "sources": 8
  },
  "routes": {
    "html": "https://newruntime.com/topics/agent-security/",
    "markdown": "https://newruntime.com/topics/agent-security.md",
    "json": "https://newruntime.com/topics/agent-security.json"
  },
  "top_sources": [
    "https://arxiv.org/abs/2607.06595",
    "https://github.com/nvidia/skillspector",
    "https://github.com/role-confusion/prompt-injection-as-role-confusion",
    "https://huggingface.co/blog/security-incident-july-2026",
    "https://openai.com/index/hugging-face-model-evaluation-security-incident/",
    "https://role-confusion.github.io/",
    "https://www.pillar.security/blog/the-week-of-sandbox-escapes",
    "https://x.com/mitchellh/status/2067970516951150721"
  ],
  "patterns": [],
  "field_notes": [
    {
      "kind": "Field Note",
      "slug": "openai-hugging-face-security-incident",
      "title": "OpenAI's Hugging Face Incident Makes Agent Sandboxes a Production Risk",
      "description": "OpenAI's model-evaluation incident with Hugging Face shows that cyber-capable agents need containment, monitoring, and evaluation controls that survive long-horizon behavior.",
      "date": "2026-07-22",
      "topics": [
        "agent-security",
        "sandbox",
        "cybersecurity"
      ],
      "source_count": 2,
      "url": "https://newruntime.com/posts/openai-hugging-face-security-incident/"
    },
    {
      "kind": "Field Note",
      "slug": "pillar-sandbox-escapes",
      "title": "Coding Agent Sandboxes Break in Places Teams Do Not Expect",
      "description": "Pillar shows that agent sandboxes must be assessed not only around the agent process, but around files, configs, allowlisted commands, and local daemons the host later trusts.",
      "date": "2026-07-21",
      "topics": [
        "agent-security",
        "coding-agents",
        "sandbox"
      ],
      "source_count": 1,
      "url": "https://newruntime.com/posts/pillar-sandbox-escapes/"
    },
    {
      "kind": "Field Note",
      "slug": "ghostwriter-agent-memory-poisoning",
      "title": "GhostWriter: One Email Can Poison Long-Term Agent Memory",
      "description": "GhostWriter shows a new risk class for agent systems: malicious content can enter long-term memory and later activate as trusted context.",
      "date": "2026-07-21",
      "topics": [
        "agent-security",
        "memory",
        "prompt-injection"
      ],
      "source_count": 1,
      "url": "https://newruntime.com/posts/ghostwriter-agent-memory-poisoning/"
    }
  ],
  "raw_signals": [
    {
      "kind": "Raw Signal",
      "slug": "agents-md-can-become-an-instruction-injection-surface",
      "title": "AGENTS.md Can Become an Instruction-Injection Surface",
      "description": "Repository instructions can manipulate low-effort automated pull requests, showing that agent context files are both useful capability layers and trust boundaries.",
      "date": "2026-06-28",
      "topics": [
        "agent-security",
        "agents-md",
        "code-review"
      ],
      "source_count": 1,
      "metric": "notable",
      "url": "https://newruntime.com/signals/agents-md-can-become-an-instruction-injection-surface/"
    },
    {
      "kind": "Raw Signal",
      "slug": "role-confusion-explains-prompt-injection",
      "title": "Role confusion helps explain prompt injection",
      "description": "Activation probes suggest instruction-like style can override architectural role labels when models interpret user, tool, and assistant text.",
      "date": "2026-06-28",
      "topics": [
        "prompt-injection",
        "agent-security",
        "model-behavior"
      ],
      "source_count": 2,
      "metric": "structural",
      "url": "https://newruntime.com/signals/role-confusion-explains-prompt-injection/"
    },
    {
      "kind": "Raw Signal",
      "slug": "skillspector-adds-a-security-gate-for-agent-skills",
      "title": "SkillSpector Adds a Security Gate for Agent Skills",
      "description": "NVIDIA's scanner treats installable agent instructions as executable supply-chain artifacts that require inspection before use.",
      "date": "2026-06-02",
      "topics": [
        "agent-security",
        "skills",
        "supply-chain"
      ],
      "source_count": 1,
      "metric": "notable",
      "url": "https://newruntime.com/signals/skillspector-adds-a-security-gate-for-agent-skills/"
    }
  ],
  "atlas_records": []
}