Cleared to Act #30

What

Websites hide prompt injections in headers that agents quietly read

Researchers at Signals Corps scanned 217 million Common Crawl response headers and found 7,959 sites talking to AI agents through headers, with 30 of them attempting indirect prompt injection, 22 just pranks. A header only reaches the model if the agent's fetch tool copies it into context: four of the five fetch routes they mapped do, and one body-only route drops headers entirely. The part worth watching is that 136 sites already identify AI clients by user agent, which is the first step toward showing agents content no person ever sees. (Signals Corps)

Agent skills get security-scanned and benchmarked before agents load them

AIQ Labs launched SkillzBench on October 23, a free directory that security-scans AI agent skills, tests each against the same model running without it, and publishes the result, good or bad. One connector then hands each agent only the skills its owner picks, so the gate lives at install time instead of in the model's judgment. The need is real: a January 2026 study of 31,132 public skills found 26.1 percent contained at least one security vulnerability. (openPR)

A policy gate votes on every agent action before it runs

AEREDIUM announced The Chair and MCP Connector on October 22, two products that place a policy engine between an AI agent and the systems it touches, one for coding agents and one for agents that move money. Every proposed action gets one of three answers before anything executes: approved, denied, or held for a person, and each decision is signed and recorded. The launch is vendor-announced, so treat the mechanism as claimed, but the shape is the right one: the decision is made outside the model, at the moment of action. (Chainwire)

Why

None of these controls asks the model to be safe. The header injection lives or dies in the fetch tool, before the model ever reads it; the bad skill lives or dies in the scan, before the agent installs it; the rogue payment lives or dies in the policy gate, before anything executes. Thinking is slow and actions are fast, so the checks that hold are lookups and rules evaluated at the speed the action moves. When the thing sitting on the hot path is a probabilistic judgment, you have built a slower, smarter way to be wrong; when it is a deterministic check, you have built a control.

How

Pick one channel your agent reads and prove metadata never reaches the model. Take your most-used web fetch path, read the tool config or one logged fetch, and confirm response headers are dropped before they reach context. If they are not, strip them or log the exposure by end of day.