Håkon Måløy demonstrates a cross-domain prompt-injection chain in Microsoft 365 Copilot for Word: hidden instructions in an external document alter a generated report and copy themselves into the output, which becomes a trusted carrier in later drafting sessions. Microsoft confirmed the behavior and deployed payload-specific mitigations, but Måløy reproduced the attack class after 144 days of coordinated disclosure; each hop still requires another Copilot drafting or editing operation.
OpenAI’s Enterprise and Edu release notes describe Codex updates including goal mode, browser improvements, locked computer use, app-window context, admin analytics, and plugin sharing status.
Explore how the EU is deploying trustworthy AI in healthcare, manufacturing, mobility and agriculture to boost competitiveness.
Play video
This AI Explained video reviews a major AI development through the lens of governance and responsible deployment. It is useful context for AI engineering, evaluation, governance, and operational risk.
Google DeepMind and partners announce a $10M funding call for multi-agent safety research.
Gemma 4: Our most intelligent open models to date, purpose-built for advanced reasoning and agentic workflows.
Gemini 3 Flash offers frontier intelligence built for speed at a fraction of the cost.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
This AI Explained video reviews a major AI development through the lens of agentic workflows and tool-use risk. It is useful context for AI engineering, evaluation, governance, and operational risk.
Play video
Jim Clark’s architecture separates research, fact-checking and publishing into stages with different permissions. Sandboxed agents use permitted tools through a gateway, while credentials remain outside the agent environment; signing authority belongs only to the stage that needs it. The design aims to reduce persistent secrets and limit what a compromised stage can do. A gateway still grants consequential capabilities, so credential separation must be paired with enforced tool and network policy. The talk presents an architectural pattern, not proof that any default installation provides these guarantees.
Play video
Melanie Warrick models a human decision as an asynchronous signal to a durable workflow. External model and tool calls belong in activities, while replayable orchestration records progress and waits for approval without keeping a worker occupied. In the demonstration, a worker stops while an approval is pending; the approval is recorded and processing resumes after restart, while other orders can continue. This tests a worker interruption, not failure of every infrastructure component or the correctness of every possible approval integration.
Play video
Ivan Leo explains the distinction between conversation continuity and a persistent execution environment in Gemini’s managed-agent APIs. An interaction identifier carries conversational state; an environment identifier selects the sandbox and its files. Primary documentation adds explicit environment lifecycle controls and a network proxy that can attach credentials to configured destinations without placing those secrets inside the sandbox. These are separate controls: reusing files does not recreate conversation context, and hiding a credential does not prevent an agent from misusing the authority it grants. Network destinations, token scope, retained state, and environment cleanup still need deliberate configuration.
Play video
Charlie Holtz describes Conductor’s approach to coordinating coding agents through shared cloud workspaces and organizational context. His examples include CI-enforced human review for migrations, carefully maintained agent instructions, and a database of working information queried by agents. The presentation combines workflow advice with product demonstrations; it does not measure a general productivity advantage.
Play video
Cody Menefee proposes an AI-assisted pasture-rotation system combining grazing knowledge, field observations and GPS-collar controls. Cameras, drones or satellite imagery could supply changing pasture conditions, while an LLM recommends moves for a farmer to accept or reject. The talk identifies unresolved data and hardware-integration needs; improved farm capacity is a project goal rather than a demonstrated outcome.
CVE-2026-65105 combines NemoClaw's non-loopback Ollama binding with DNS rebinding and an unauthenticated model API. A malicious page can reach the local runtime and alter a model's chat template so hidden instructions persist across later agent conversations; the disclosure reported platform-specific remediation limitations.
Learn more about how Google Cloud empowers you with the tools, governance, and infrastructure you need to securely deploy workloads and maintain long-term trust.
Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems.
Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, and our reception.
Francis deSouza explains the crucial role that deep context plays in creating an AI advantage for defenders.