Which of the 2026 incidents should force a policy update in my organization?

The LiteLLM CVEs and the Microsoft "Prompts become shells" disclosure both merit a policy review. The LiteLLM CVEs affect the gateway architecture choice. The Microsoft disclosure affects the agent framework selection and the prompt-pattern classifier configuration. The Marimo incident merits a forensic capability review: does the AI audit log satisfy the chain-of-custody properties the incident case would require?

Do I need to run against AISVS 1.0 immediately?

AISVS is a verification standard rather than a regulation. Enterprises with AI systems in production benefit from mapping their controls to the AISVS chapters and identifying gaps. Pen test scope and third-party assessment reports increasingly reference AISVS starting in the second half of 2026.

How does the Colorado SB 26-189 change affect enterprises outside Colorado?

The direct obligation applies to Colorado deployments. The pattern of similar state laws (California AB 2013, Texas TRIPA, Illinois AI in employment decisions) means enterprises operating across states face a patchwork with common themes: disclosure, consequential decision testing, and audit trails.

What is the practical difference between OWASP LLM Top 10 and OWASP Agentic Top 10?

The LLM Top 10 catalogs risks that apply to LLM applications generally. The Agentic Top 10 catalogs risks that apply specifically to agentic applications that use LLMs as decision-making components with tool use, memory, and planning. Enterprises deploying agentic systems need both.

How often does the regulatory picture change?

Rapidly. In the first half of 2026, the EU Commission published GPAI guidelines, Colorado signed SB 26-189, and multiple state and federal regulators opened inquiries. A quarterly review of the regulatory picture with the compliance team is the working cadence for enterprises with meaningful AI deployments.

Agentic AI News in 2026: The Incidents, Regulatory Actions, and Framework Releases That Changed the Threat Model

Agentic AI shifted from a research topic to a production security concern across the first half of 2026. Microsoft published its "Prompts become shells" disclosure on May 7 documenting remote code execution paths in three major agent frameworks. The Marimo pre-authentication RCE (CVE-2026-39987) became the first widely-reported incident where attackers ran an LLM as their post-exploitation tool inside a victim AWS environment. LiteLLM disclosed seven CVEs in June alone, one of them (CVE-2026-12773, CVSS 7.3) an authentication bypass in the gateway itself. OWASP published two frameworks: the Top 10 for Agentic Applications in the first half of the year and AISVS 1.0 on June 24. The threat model most SOCs held at the end of 2025 does not describe the risks agentic AI carries in mid-2026.

I want to walk through the specific incidents, the regulatory actions, and the framework releases that have changed how security teams evaluate agentic AI deployments in 2026, and what the changes imply for enforcement architecture at the AI request layer.

Microsoft: Prompts become shells (May 7, 2026)

Microsoft's Security Blog documented remote code execution paths in three mainstream agent frameworks: LangChain, AutoGen, and Semantic Kernel. The disclosure walked through how a crafted prompt could reach a code-execution path in the framework and run attacker-supplied code on the host.

The finding reframed the risk model for agent middleware. The pre-2026 model treated agent frameworks as data-processing components with a narrow risk surface. Microsoft's disclosure demonstrated the frameworks are code-execution surfaces from the attacker's perspective.

For SOCs, the reclassification changes the response category for agent framework alerts. A LangChain instance flagged by network monitoring is now treated the way a web application under active exploitation is treated: high-priority containment, forensic collection, and root cause analysis. The prompt-to-shell path also expanded the applicable regulatory reporting obligation. SEC 8-K, EU AI Act Article 26.4, and state breach notification laws all apply when the RCE succeeds.

The mitigation approach the security team runs sits at two layers. The framework provider patches the code paths that produce the RCE. The deployer's AI gateway blocks the specific prompt patterns that reach the RCE and produces the audit record that supports post-incident investigation.

Marimo CVE-2026-39987: The first LLM as post-exploitation tool (May 10, 2026)

The Hacker News reported the first widely-covered incident where attackers operated an LLM as their post-exploitation tool inside a victim AWS environment. The initial access vector was pre-authentication RCE in Marimo (versions ≤0.20.4). After landing, the attackers harvested AWS credentials from the environment and used an LLM to drive Secrets Manager calls, IAM enumeration, and lateral movement.

The incident changed the forensic status of AI audit logs. Pre-2026, an LLM interaction log was operational data with limited legal or regulatory weight. Post-Marimo, the LLM call log is potential evidence in a breach investigation. The chain-of-custody properties the log has to carry now match the chain-of-custody properties other security-relevant logs carry.

The finding also validated the case for per-decision audit records at the AI request layer. When the attacker used the LLM as their tool, the deployer's audit record of each LLM call became the record series the investigator sampled to reconstruct the incident. Without the record series, the investigation cannot reconstruct what actions the attacker took through the model.

LiteLLM: Seven CVEs in June 2026

BerriAI disclosed seven CVEs in the LiteLLM proxy across June 2026. The most consequential was CVE-2026-12773 (CVSS 7.3), an authentication bypass in the UserAPIKeyAuth function that let an attacker reach proxied AI services without valid credentials. CVE-2026-42271 (added to CISA's Known Exploited Vulnerabilities catalog on June 8) was the RCE that preceded the June wave.

The disclosure clarified the architectural stakes for AI gateways. A gateway that terminates client credentials, holds provider API keys, and forwards requests to LLM providers concentrates value on a single component. When the gateway's authentication or authorization has a bypass, the attacker reaches everything the gateway proxies without needing to compromise the underlying application.

The mitigation architecture the disclosure recommends is a stateless proxy that binds every call to a verified identity and holds no long-lived provider keys. The design constrains what an authentication bypass can reach: without long-lived provider keys, the attacker gains no persistent path to the model provider even if the identity binding is bypassed transiently.

OWASP Top 10 for Agentic Applications 2026

OWASP published the Top 10 for Agentic Applications separately from the LLM Top 10 in the first half of 2026. The Agentic Top 10 introduces the "agentic skills" intermediate behavior layer as a distinct vulnerable component alongside the model, the retrieval corpus, and the tool-calling interface.

The categories cover: authorization bypass in agent skills, insecure agent-to-agent communication, unbounded resource consumption, unsafe tool invocation, information leakage through agent memory, unauthorized escalation of agent privilege, insufficient action lineage, unsafe planning output, insecure agent hosting, and supply chain compromise of agent components.

For enforcement architecture, the categories that map most directly to gateway controls are: authorization bypass (identity-bound policy at the request layer), unsafe tool invocation (per-tool allowlist enforcement), unauthorized escalation (per-agent capability limits), and insufficient action lineage (per-decision audit records the investigator reconstructs).

OWASP AISVS 1.0 (June 24, 2026)

OWASP shipped the AI Security Verification Standard 1.0 on June 24, 2026. Unlike the Top 10 (a catalog of common risks), AISVS is a verification standard: 514 testable requirements across 14 chapters modeled on the ASVS pattern that has served the AppSec community since 2009.

The chapters cover model inputs, outputs, training and fine-tuning, agentic behavior, MCP server authentication, retrieval-augmented generation, secure integration, secrets and credentials management, incident response, and more. Each requirement is a testable proposition an auditor, pen tester, or CI/CD pipeline can evaluate against a specific AI system.

The requirements that describe runtime controls on AI request and response traffic (identity and authorization of AI calls, prompt-injection input handling, output filtering, per-request logging) map to a policy gateway's operational scope. The requirements that describe model, training, and supply-chain properties sit outside a gateway's enforcement scope.

The standard positions itself as a verification checklist the way ASVS positions itself for web applications. Security teams can use AISVS as the reference document for penetration testing scope, third-party AI system assessments, and CI/CD pipeline security testing.

EU AI Act: GPAI guidelines and August 2 approach

The EU Commission published GPAI guidelines on May 19, 2026. The guidelines set concrete signals for the high-risk classification under Article 6 and Annex III. With the August 2 enforcement date for high-risk system rules 75 days out at time of publication, the guidelines gave the AI compliance community the operational form for the risk classification.

The regulatory activity in EU member states has picked up. National market surveillance authorities in France (CNIL for data protection, ANSSI for cybersecurity), Germany (BfDI, BSI), the Netherlands (Autoriteit Persoonsgegevens), and Italy (Garante) have all opened preliminary inquiries into GenAI deployments in 2026.

For enterprises with EU exposure, the August 2 deadline focuses attention on the Article 12 log, the Article 13 transparency, and the Article 26 deployer obligations. The compliance architecture that satisfies each of these requirements starts at the AI request layer.

Colorado SB 26-189 signed May 14, 2026

Governor Polis signed SB 26-189 on May 14, 2026, scaling back the Colorado AI Act's original scope. The HIPAA covered-entity exemption from the original bill no longer carries over in the scaled-back version. Clinical AI deployers in Colorado face the new "consequential decision" test on top of their HIPAA obligations.

The law takes effect January 1, 2027, with a 60-day cure period from the Attorney General for identified violations. Clinical AI operators in Colorado have a bounded window to map their current deployments against the new test and produce the required documentation.

What the incidents and frameworks imply for enforcement architecture

The 2026 pattern points to five architectural properties enforcement layers have to carry.

Statelessness at the gateway. The LiteLLM CVEs showed the risk of long-lived provider keys concentrated at a single component. A stateless gateway that binds credentials to a verified identity per request avoids the persistent-key value the attacker gains from a gateway compromise.

Per-decision audit records with legal weight. The Marimo incident showed the forensic value of the AI call log. The record has to sit outside the application under investigation and carry integrity properties the court accepts.

Prompt-pattern awareness. The Microsoft disclosure showed the RCE path runs through specific prompt patterns. The gateway's classifier has to recognize the patterns and deny the requests that carry them.

Framework-specific policy. The OWASP Agentic Top 10 shows the agentic skill layer is a distinct control surface. The gateway's policy has to address the agent's specific capabilities.

Verification against a standard. AISVS 1.0 gives security teams a checklist to run periodically. The gateway's evidence pack has to satisfy the AISVS requirements the standard makes testable.

DeepInspect

The DeepInspect gateway implements the stateless proxy architecture the LiteLLM disclosure endorsed. The gateway holds no long-lived provider credentials at rest, binds every request to a verified identity at request time, and produces the per-decision audit record the Marimo forensic scenario requires. The gateway's classifier addresses prompt patterns the Microsoft disclosure catalogued, and the policy engine addresses the agentic skill layer the OWASP Top 10 introduced.

If your team is running the assessment against AISVS or is preparing for the August 2 EU AI Act deadline, take the AI readiness self-assessment at deepinspect.ai/ai-readiness.