AI Agents Just Had a Rough Patch Tuesday

August's disclosures made one thing concrete: AI agents are now a first-class attack surface, and the flaws share a pattern. Across Microsoft's Patch Tuesday and a large Spring release, the same weakness showed up: an agent was told what it could do, but the system underneath didn't enforce it.

Microsoft's August update fixed 421 CVEs, including a zero-day already exploited in the wild (CVE-2026-68820, a use-after-free in the WinSock driver that escalates a local attacker to SYSTEM). But two of the most severe flaws sat inside Microsoft's own agents. Per CrowdStrike, CVE-2026-62830 in Azure SRE Agent, an AI service that autonomously diagnoses and remediates Azure infrastructure, scored 9.9: a missing-authorization flaw letting a low-privileged remote attacker elevate privileges with no user interaction. CVE-2026-59118 in Copilot Cowork scored 9.3 on a similar improper-authorization bug.

Same week, same bug class, different stack

Days earlier, Broadcom disclosed 91 Spring CVEs. One, CVE-2026-59318, hits Spring AI's tool-calling: a prompt-injection attack can make the framework invoke a tool that was never made available to the request, opening a path to privilege escalation. Spring rates it Medium, but the mechanism is the point. As Sonatype put it, telling an AI agent what it cannot do is not the same as enforcing what it is actually allowed to touch.

That sentence describes all three CVEs. An agent's instructions (its system prompt, its tool list, its "you may not do X") are guidance, not a boundary. If the runtime still exposes the capability, a missing authorization check or a crafted injection walks right through.

Why this is landing now

Two forces are colliding. Agents are being wired into privileged systems (SRE automation, cloud remediation, collaboration tools with real data access), and vulnerability discovery has gone into overdrive: Broadcom's Spring advisories jumped more than 1,700% between March and April, from roughly 6.5 reports a month to 482 across 65 projects, a spike it attributes to AI-assisted scanning. More agents in more sensitive places, found faster than ever.

What to actually do

The fix is old advice with new urgency: authorization belongs in the system, not the prompt. Enforce tool access at the boundary with scoped credentials, per-request allowlists, and a policy layer the model can't talk its way past, and assume prompt injection will happen. Give agents least privilege with separate identities: an SRE agent that reads metrics shouldn't hold the keys to change infrastructure without a human in the loop. And patch the agent supply chain like the privileged code it is; Spring AI is a dependency in your build.

The through-line from this summer's rogue-agent incidents to this month's CVEs is consistent: an agent you can instruct is not an agent you have contained.