#26: Nobody Owns the Skill Layer

About this episode

Top Story: OWASP put a name and a risk list on the layer nobody governs — A "skill" is packaged expertise you hand an AI agent: instructions and scripts that turn a general assistant into one that knows how to build a landing page, close a support ticket, or run a deployment. A backdoor that starts when code is loaded, not when it is installed. — Developers have been taught for years to watch what happens during installation, because that is where malicious packages historically fired. Rust's turn came the same week, one layer deeper. — Someone got into the account of a maintainer whose code sits inside a large share of Rust projects and republished three of his libraries with one line added: a dependency on a package named one character off a near-universal one. Five federal agencies say AI is writing exploit code for the machines that run water plants. — The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on August 19 about Siemens S7 controllers, the small industrial computers that physically open valves and run pumps. 🏛️ OpenAI stopped testing for two weeks and started rewriting its safety rulebook. — Axios reported on August 19 that OpenAI could not rule out that an unreleased model, Astra, had crossed the "critical" cybersecurity line in its own Preparedness Framework. 💰 Fortinet bought Virtue AI, and what it bought says where enterprises admit they are blind. — The August 17 deal folds agent discovery, continuous red-teaming of AI systems and runtime guardrails into Fortinet's security platform, per Fortinet's own account of what it bought. 🔬 A proposal to stop hand-writing agent defenses one rule at a time. — An August preprint argues runtime protection for AI agents cannot be hand-written fast enough, because the ways an agent can be pushed off task are open-ended while the rulebook defending it is finite. CSA AI Security Summit 2026: State of Trust, September 16–17. — A free two-day virtual event from the Cloud Security Alliance "exploring where cloud, AI, and Zero Trust converge.". Curator's Corner: Nobody Owns the Skill Layer

      Curated by Asaf Nakash. Voices by AI. Opinions by human.
      Show notes: https://contextwindowsec.com/episodes/2026-08-24.html