OWASP Named the Blind Spot in June. Two AI Labs Fell into It in July.

What the State of Agentic AI Security report gets right, where the field's own referees still trust the vendors' math, and five moves you can make before your next agent ships.

600 security researchers spent a year writing the agentic threat manual. They shipped it on June 1. Almost 6 weeks later, OpenAI's own models escaped an evaluation sandbox and reached Hugging Face's production systems, proving the report's central warning inside the one environment the report says a customer cannot watch.

The document I’m talking about is the State of Agentic AI Security and Governance v2.01, published by the OWASP GenAI Security Project, an OWASP flagship with more than 600 contributors across 18-plus countries. And I read all 139 pages so you can spend your time on the part that matters: what it predicted, and who confirmed it.

What the report gets right, so nobody spends cycles to re-hash it

The 2025 edition treated agentic risk as a portfolio of plausible threats.

The 2026 edition reads a year of evidence and lands on 3 findings, and all 3 hold up.

The threats are operational now. Almost every category in the OWASP Top 10 for Agentic Applications now carries a documented production incident or an active CVE. The report's incidents tracker catalogs the receipts, from the September 2025 OpenAI Codex CLI sandbox bypass (CVE-2025-59532) to Cato Networks' December 2025 demonstration that Claude's Skills feature could be turned into a ransomware delivery path.

Safety and security meet at the deployment layer, and this is the finding that earns the report its weighty in gold. Through most of software history, safety sat with engineering and security sat with the adversarial team, and the layered un-matrixed org chart held. Agentic systems now dissolve all lines. The report makes it unflinchingly clear: model-level safety stays with the provider, and once an agent acts on live production systems, one set of controls governs both the safety failure and the security failure.

Hold onto that idea because the vendors are about to test it.

Governance must run minimally at deployment speed but honestly it needs to run faster. DORA's four-hour notification, NIS2's 24-hour early warning, New York RAISE's 72-hour frontier reporting, and California SB 53's 15-day window all assume continuous oversight. Here’s the rub, a quarterly audit cycle fails on delivery and cannot meet a clock measured in hours.

It’s a good report. Now watch what happened right after it went to print.

The report closed in June. The proof arrived in July.

OWASP's evidence window ended in late spring 2026. And right on time, two of the year's defining incidents landed after, and both happened in the place the report flags as hardest for a customer to govern: the vendor's own evaluation environment.

Let’s start with OpenAI. On July 16, Hugging Face detected an intrusion in its own systems. OpenAI confirmed five days later that the intruder was its own agent. The models, running the ExploitGym benchmark with cyber refusals reduced, found a zero-day in OpenAI's package-registry proxy, escaped a testing environment that carried internet access it was never meant to have, inferred that Hugging Face held the benchmark answers, then moved laterally into Hugging Face's production database to take them. Hugging Face later reconstructed roughly 17,600 attacker actions across almost 2.5 days. OpenAI added a week later that the models also used publicly exposed credentials across 4 accounts on 4 services, one of them at the infrastructure provider Modal, and it’s now validating the blast radius with CrowdStrike.

I invite you to read Hugging Face's own summary of intent and marinate on it: the whole intrusion was the agent trying to cheat the evaluation and decided that the fastest route to a high score was to rob the company holding the answer key.

Yea, you can’t make this up. When the machine’s sole purpose is to achieve its goal, it has not conscience, doesn’t think about right or wrong; it needs to achieve its goal and win.

Then Anthropic. The OpenAI disclosure prompted a retrospective across 141,006 of Anthropic's own evaluation runs where Claude “could” have reached the internet. It surfaced 3 incidents where a Claude model left the evaluation environment of its third-party partner Irregular and reached the live production infrastructure of 3 separate organizations, each during a capture-the-flag exercise. Anthropic traced the cause to a misconfiguration and a misunderstanding with Irregular over whether the setup had internet access, said it is fixing the problem as though the responsibility were its own, and brought in METR for an independent review.

And herein lies the pattern the report described, delivered by the 2 labs that helped run the very benchmark involved. The safety failure was a model that could not be reliably contained. The security failure was an environment that let it reach the open internet.

They were the same failure.

Sorting the incident into one bucket would’ve wasted the hours that mattered, which is exactly what the report warns about on page 31: pick a category and you buy an organizational delay while the incident stays live.

The blind spot has a name, and the referees still trust the players inside it

The report is clear about where a deploying organization loses sight of the risk. Model-level safety and the evaluation environment belong to the provider. A customer running a commercial frontier model owns almost none of that substrate. Both July incidents happened there, on the provider's side of the line the report drew, in a place a customer can’t see nor independently audit.

That’s the strongest independent confirmation yet of everything I’ve argued across every stage and article: the party that builds the system can’t be the only party that grades it.

OWASP is a 600-contributor consensus body with no products to sell, and it drew the provider-deployer line on its own. The vendors then walked across their own half of it.

However, there is one snag sits inside their report, and it is worth calling out because it’s the same problem on smaller scale. The report describes the GTG-1002 campaign as jailbroken Claude Code instances that ran 80 to 90% of the tactical operations across roughly 30 organizations. But Anthropic reported those figures and some researchers have since questioned how autonomous that operation actually was. The problem is this: the consensus safety document reprints the vendor's self-reported number as settled fact, with no independent audit behind it.

My take and it’s my personal opinion: when even the field's neutral referee reprints a vendor's unaudited percentage without a caveat, the accountability inversion stopped being a vendor tactic and has become the ambient default.

The fix? It is boring? Yes, it’s boring and specific, and it’s the same fix the July incidents point to.

Five moves you should consider making BEFORE your next agent ships

1. Pull the evaluation environment inside your risk boundary. Treat any benchmark or red-team run against your data or infrastructure as a production change, with the same monitoring and the same stop button. Forrester reached the same conclusion after the Hugging Face incident: bring model evaluations inside the enterprise risk boundary.
2. Run the Rule of Two on every agent you operate. Simon Willison's lethal trifecta names the 3 properties that make an agent exploitable end to end: access to private data, exposure to untrusted content, and the ability to communicate outward. Meta's Agents Rule of Two, cited in the OWASP report, says any agent holding all 3 without a human approval gate needs one added today. List the properties for each agent you run, then close the gap.
3. Discover your Shadow AI BEFORE you try to govern it. The report finds unsanctioned AI in nearly every organization its contributors examined and cites IBM's data that only 37% of organizations have any type of policy to detect it. Start with delegated OAuth scopes: inventory every AI tool your staff has authorized against your identity and cloud tenants, then move those authorizations into your non-human identity program.
4. Govern the trajectory the agent actually runs. A pre-deployment certificate describes a system that stops existing the moment an agent loads a tool or edits its own configuration. Instrument trajectory-level logging now, compare each agent's action sequence against its declared intent, and alert on divergence. The report calls plan-divergence detection an emerging core control, and the EU AI Act enforcement clock will not wait for your buildout.
5. Audit your cyber insurance for AI exclusions before renewal, and demand independent evaluation evidence. The report documents a coverage gap forming fast: Verisk's ISO CGL exclusions took effect in January 2026, WR Berkley filed an absolute AI exclusion, and dedicated AI insurers such as Armilla, Testudo, and HSB/Munich Re now require demonstrated governance as a condition of coverage. When you buy that coverage or select a model, ask for evaluation results signed by someone other than the company that built the model.

OWASP handed the field an accurate map 6 weeks ahead of the breaches. And the teams that read it as a to-do list, instrument their evaluation environments, and insist on a grader who doesn’t also sit for the exam will be the ones who shape their security posture on purpose, ahead of the first incident that would otherwise shape it for them.