CloudSecurityAlliance

Every code deploy runs through a pipeline with security gates built in — SAST, dependency scans, sign-off steps. Every agent deploy runs through whoever finished configuring it first. We spent a decade engineering speed and safety into software releases. Agent capability ships with neither: new tool access, new API scopes, a wider blast radius, no gate in between. CSAI built the missing gate — AICM's 243 controls across 18 domains, mapped to the agentic control plane. #AgenticAI

A hotel keycard doesn't ask why you're still trying to get in after checkout — it just stops working, because trust was never permanent to begin with. Most corporate systems still grant access once and let it linger indefinitely until someone remembers to revoke it. Zero Trust runs on the hotel keycard model, not the one-time badge. CCZT teaches you how to build that in: cloudsecurityalliance.org/education/cczt

Your team shipped an internal AI tool last quarter. Security later asked "what controls did we actually apply?" and got a shrug — because everyone was improvising with checklists built for infrastructure, not autonomous systems. AICM v1.0.3 just won the 2026 CSO Award for closing that gap: 243 control objectives, 18 domains, purpose-built for AI. Stop retrofitting. cloudsecurityalliance.org/artifacts/ai-c… #AISecurity

Jacob Wohl and Jack Burkman -- yes, the securities-fraud-and-election-disinfo duo -- launched a startup soliciting zero-days with payouts advertised up to $7M, building a social following of thousands before anyone verified they had the legal standing or technical chops to buy an exploit at all. Krebs's reporting shows the real gap: nothing in today's exploit-broker market checks a buyer's legitimacy before money changes hands. labs.cloudsecurityalliance.org/research/csa-r… #threatintel

Plenty of teams still think migrating to the cloud means the provider is handling their security. Reality: they secure the infrastructure — your misconfigured storage bucket or overly permissive IAM role is still entirely on you. That gap between assumed and actual protection is where most breaches start. CCSK maps out exactly where the provider's job ends and yours begins: cloudsecurityalliance.org/education/ccsk

Every new cloud vendor means another custom security questionnaire built from scratch, another round of "wait, did we ask about data residency last time?" That's hours lost to reinventing the same wheel. CCM v4.1 ends that: 207 controls, 17 domains, vendor-neutral, free. Use it as your baseline for every vendor review. cloudsecurityalliance.org/research/cloud… #CloudSecurity

AI coding agents are hallucinating malware installs for attackers, no phishing required. CSA's HalluSquatting research found agent skill installations hallucinate fake package names 100% of the time — attackers just pre-register those names with prompt-injected payloads and wait. One resulting package, react-codeshift, spread into 237 GitHub repos before anyone caught it. It's untargeted and pull-based: any agent that hallucinates the same name gets pwned. labs.cloudsecurityalliance.org/research/csa-r… #AIsecurity

Every postmortem template has a field for "root cause" and one for "owner." Both assume a human made the call. Run that template on an incident caused by an autonomous agent and watch teams start guessing — the agent's designer? the team that deployed it? whoever approved its permissions? That gap is why CSAI is building an accountability model for agentic AI, not retrofitting one built for humans: csai.foundation #AIsecurity

How many access decisions get made in your environment today based on actual verification, versus just an assumption that yesterday's trust still holds? Nobody audits that until something goes wrong. CCZT is where you learn to ask it before that happens: cloudsecurityalliance.org/education/cczt

Zero trust means "never trust, always verify" — for your network, your identity provider, your APIs. But what about the retrieved document, the plugin output, the third-party API response your LLM ingests mid-conversation? Most stacks trust all of it by default. That's exactly where prompt injection lives. CSA's Zero Trust guidance for LLM environments extends the model to cover it: cloudsecurityalliance.org/research/publi… #ZeroTrust #LLMSecurity

Windsurf's AI coding assistant wrote files to disk before the accept/reject buttons even rendered. GhostApproval, disclosed by Wiz, shows a decades-old Unix symlink trick makes six coding agents (Claude Code, Cursor, Amazon Q, Augment, Windsurf, Google Antigravity) display a harmless filename in the approval prompt while actually writing to your SSH authorized_keys file — planting an attacker's key for passwordless access. Only 3 of 6 vendors have patched. labs.cloudsecurityalliance.org/research/csa-r… #AIsecurity

Zero Trust assumes an identity that stays put for a session and a privilege boundary you defined in advance. Autonomous agents break both: they spawn sub-processes with new credentials mid-task, and their real capability is whatever chain of tools they assemble at runtime — not what you scoped on day one. You can't apply least privilege to a permission you never imagined. CSAI Foundation is rebuilding Zero Trust's core assumptions for agents that won't hold still. csai.foundation #ZeroTrust

postmark-mcp shipped 15 clean releases on npm — then one update quietly added a line that blind-copied every email it processed to an attacker's domain. ~300 orgs got hit, thousands of messages a day, and nothing flagged it because MCP tool descriptions are read by AI agents as instructions, not code, so they skip normal review. Every action the agent took was "authorized" — that's the whole problem. labs.cloudsecurityalliance.org/research/csa-r… #MCP #AIsecurity

CISO Daily Briefing: MCP tool descriptions can be silently edited post-deploy to hijack AI agents into data exfil (72.8% success rate; hit Cursor, GitHub, npm's postmark-mcp) — and an unpatched XQUIC/HTTP3 flaw crashes Alibaba's Tengine with ~260 bytes, no CVE, no fix after 90 days. Governance: Colorado's Chatbot Safety Act (HB 26-1263) lands Jan 2027 — disclosure, age checks, $20K/violation. Strategy: AI vuln clearinghouses (Chainguard's Athena, IBM/Red Hat's Lightwell) are consolidating patch pipelines as NIST scales back CVE enrichment — watch for single points of failure. labs.cloudsecurityalliance.org/ciso-daily-bri…

We spent a decade training security teams to ask "who has access to what." Multi-agent systems break that question completely: Agent A hands its output to Agent B, who feeds a decision to Agent C — and when something goes wrong, no one can trace which agent actually made the call, let alone who owns it. That's not an edge case, it's the default architecture now. CSAI's cross-domain approach exists for exactly this gap. csai.foundation #AgenticAI #ZeroTrust

Friday confession: someone in Slack just asked for "quick temporary access" to prod, and it's already been six months. Temporary is the most permanent word in IT. That's the whole reason continuous verification exists instead of one-time approvals people forget to revisit. If your access reviews are basically archaeology, CCZT is worth a look: cloudsecurityalliance.org/education/cczt

New hire joins your cloud security team Monday morning. What do you actually hand them? Most orgs improvise — a Slack channel, some old vendor decks, a Wiki nobody's updated since 2022. That's not onboarding, that's hoping. Security Guidance v5 is the reference that should exist instead: end-to-end cloud security, one document, actually current. cloudsecurityalliance.org/research/guida… #CloudSecurity

Anthropic and Google — xAI's own rivals — pay roughly $1.25B and $920M a month to rent AI compute from Colossus, the data center SpaceXAI now owns outright. That same corporate entity also holds Starshield's classified defense contracts, and its consumer chatbot already leaked 370,000 transcripts. CSA's take: stop treating SpaceXAI's launch, satellite, compute, model, and dev-tooling businesses as separate vendors — they're one concentration risk now. labs.cloudsecurityalliance.org/research/csa-r… #AIRisk #VendorRisk

Your vendor risk questionnaire covers data centers, encryption, SOC 2 reports. It never asks which model your agent is quietly calling underneath, who fine-tuned it, or what data shaped its weights. That's the supply chain that actually decides what your agent does — and almost no one has mapped it. CSAI Foundation is building the standards to close that gap. csai.foundation #AgenticAI

The scariest AI security failures won't come from some rogue model going off script — they'll come from an agent doing exactly what it was told, with far more access than anyone bothered to limit. That's a governance problem, not a sci-fi one. TAISE is built for exactly that gap: cloudsecurityalliance.org/education/taise