Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
An attacker stole an AI agent's signing keys through email injection in under five minutes, per a prior incident this design cites.
Why now: The design posted August 6, as other new agent-security research argues these exposures need a formal tracking process since most have no CVE record.
A new design pulls AI agents' signing keys out of plaintext storage and locks them inside physical hardware, per an August 6 arXiv paper. The paper cites a production incident where email injection exfiltrated keys from a widely deployed framework. The theft took under five minutes and gave the attacker power to sign commits or authenticate API calls as the agent.
The fix routes every key through a PKCS#11 interface to an HSM, TPM, or smart card. The agent's host process only ever touches an opaque handle, never the key itself. That's wrapped in five checks: session identity, scope bounds, semantic validation, taint tracking, and a hardware boundary.
Researchers tested the setup against 12 injection scenarios from AgentDojo's ImportantInstructionsAttack template, across four models and 192 trials. The unprotected baseline succeeded 19.3% of the time, with a range of 14.3% to 25.4%. The protected version hit zero successes, with a 95% statistical ceiling of 2%, and produced no false positives on legitimate tasks.
Each link below shares sources, entities, or timing with this story.
Same source domain / Semantically similar
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.79).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.77).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.77).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.76).
Same source
Cite the same source (arXiv 2608.06130).
Same source domain / Semantically similar
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.75).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.74).
Reported by the same outlet (arxiv.org); covers closely related ground (similarity 0.73).