CloudSecurityAlliance

Something I keep noticing in security conversations lately: people are quick to say they're "using AI," but much slower to say who is accountable when an AI system makes a decision on their behalf.

The tooling is moving fast. The ownership questions are catching up more slowly, and that gap is where the risk tends to live.

TAISE is a solid way to build a shared vocabulary for it. 🤖 cloudsecurityalliance.org/education/taise

You gave an AI agent access to your ticketing system, your inbox, and a code repo. Did anyone ask what happens if someone poisons the data it reads?

Traditional threat models weren't built for agents that plan, call tools, and act on their own.

MAESTRO is CSA's framework for threat modeling agentic AI systems, layer by layer. Start there before your agent ships.

cloudsecurityalliance.org/research/publi…

#AgenticAI

One Subaru STARLINK admin-panel flaw meant a single employee account takeover could give an attacker control of arbitrary vehicles.

Separately, APsystems microinverters used credentials derived from serial numbers, exposing ~100,000 reachable devices to firmware injection and coordinated shutdowns.

The vendor cloud is the command channel. It passes customer firewalls with no inbound exposure. Compromise the vendor and you hold every unit in the field.

labs.cloudsecurityalliance.org/research/csa-r…

CISO Daily Briefing: cPGuard's hijacked update channel (5.88.12–5.88.19) ran as root on ~2,950 hosting servers; the patch removes the backdoor, not the stolen credentials. OpenSSH on Alpine/musl (CVE-2026-123158, CVSS 8.1) lets 257–1,024-byte passwords into no-password accounts; fix is 10.6p2. UK's Cyber Security and Resilience Bill puts AI-agent incident accountability on deployers. Li Auto hijacks show vendor-cloud off switches are fleet risk.
labs.cloudsecurityalliance.org/research/ciso-…

Microservices taught us a hard lesson: once services call services, no single team understands the system anymore. We answered with distributed tracing, service catalogs, and named owners.

Agents calling agents is the same problem, except the callers now improvise.

Where's the trace? Where's the catalog? Who's on call?

That's the gap CSAI Foundation is working on: csai.foundation

#AgenticAI