The Target Is No Longer the Model. It’s the Agent.
Analysis maps recent AI security research onto MITRE ATLAS, showing AI agents, poisoned skills and prompt injection form a full attack chain.
Pierluigi Paganini maps February 2026 AI security research onto MITRE ATLAS, arguing that AI agents with persistent memory, skills, protocols and tool access—not models alone—are the new attack surface. A large study of roughly 98,380 marketplace skills found 157 confirmed malicious skills, mostly data stealers and agent hijackers. He links research to real CVEs, including EchoLeak (CVE-2025-32711) zero-click Copilot data exfiltration via prompt injection and CurXecute (CVE-2025-54135/54136) remote code execution through an IDE's MCP implementation.
- Study of 98,380 marketplace skills found 157 confirmed malicious skills, mainly data stealers and agent hijackers
- Prompt injection is industrialized via reinforcement learning and automated red-teaming frameworks
- Research translates into real CVEs like EchoLeak (CVE-2025-32711) and CurXecute (CVE-2025-54135/54136)
- Jailbreak research shows structural defenses can be bypassed, including prefill attacks on open-weight models
- Vendors
- Microsoft
- Products
- CopilotModel Context Protocol
- Organizations
- MITRE ATLAS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-32711 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network | 7.5 | 7% | ||
| CVE-2025-54135 | Cursor: Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a dotfile, editing it… | 9.8 | 2% |
From the original article
8 min read at securityaffairs.com
AI agents are becoming the new attack surface, exposed to poisoned skills, prompt injection, jailbreaks and attacks through connected tools. I read the AI security research published in a single month, February 2026, and when you put it all together, it’s not a list of curiosities. It’s a field guide to a new attack surface.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.