WAF Weekly: AI Browser Exploits, Agent Security, and OWASP Rankings, Aug 3-7

This week in application security was defined by AI. Akamai published a deep report on AI-native browser attacks, researchers revealed agent SDK vulnerabilities across AWS, Google, and Vercel at Black Hat, and OWASP released its 2026 LLM Top 10 with real incident data for the first time. Cloudflare open-sourced its AI agent platform with a built-in security layer, and the Cloud Security Alliance kicked off a catastrophic risk framework for frontier AI systems.

Akamai Documents Three AI-Native Attack Vectors

Akamai's Enterprise AI Usage Risk Report names vibe hacking, CursorJacking, and CometJacking as three new attack classes. Each exploits the trust AI tools place in their environment. Vibe hacking manipulates project files that coding assistants read. CursorJacking targets browser extensions with excessive permissions. CometJacking embeds hidden instructions in web pages that AI agents retrieve. The report found that nearly half of enterprise AI use happens outside security visibility and 16.3% of AI browser extensions carry known CVEs. TechTimes

CoreBreak Opens Agent SDKs to Tool Misuse

At Black Hat USA 2026, Stealth researchers presented CoreBreak, a cross-platform attack pattern affecting AWS Bedrock AgentCore, Google ADK, and Vercel AI SDK. The flaws let untrusted instructions reach an agent's tools without the model running, bypassing system prompts, content filters, and model-level guardrails entirely. The attack paths differ by platform, but all three share a structural gap: the SDKs did not verify that a model turn authorized the tool call. AWS fixed the managed service, Google patched ADK 2.5.0, and Vercel updated two harness packages. The Hacker News

OWASP LLM Top 10 Gets a Data-Driven Update

OWASP released the 2026 edition of its LLM Top 10, and for the first time real incident data influenced the rankings. The list combines 75% practitioner consensus with 25% incident data from 6,639 real-world cases. Prompt Injection holds the top spot, but through a "defense effect" where active blocking makes incidents rare. Misinformation climbed two places because incident data contradicted voter expectations. This shift signals that the industry now has enough real-world data to challenge expert opinion. Help Net Security

Cloudflare Open Sources Its AI Agent Platform

Cloudflare rebuilt and open-sourced Cloudflare OS, the platform it uses internally to give every employee an AI agent. The architecture centers on "Gatekeepers," a security layer that replaces broad API keys with per-request resource authorization. Agents start with no access and request specific resources, making every tool call auditable. The platform bundles an agent workspace, a governance framework, and a way to ship personal apps as Cloudflare Workers. Decrypt

CSA Launches Catastrophic Risk Annex for AI

The Cloud Security Alliance announced two new initiatives this week. The Catastrophic Risk Annex is a framework for developing auditable controls around high-autonomy AI systems. The Frontier-Ready Cybersecurity Resource Center provides operational guidance for securing frontier AI deployments. Both initiatives bring together experts from AI safety, cybersecurity, academia, and national security. The annex targets the gap between theoretical AI risk discussions and practical, auditable control frameworks. Cloud Security Alliance

Also Notable

• Broadcom announced updates to VMware vDefend and Avi Load Balancer, adding AI-powered automation and multi-layer defense for private cloud workloads. Manila Times
• Cloudflare introduced programmable wallets for AI agents, supporting stablecoin payments via Coinbase's x402 protocol for agentic commerce. CoinTelegraph

WAFplanet Take

AI application security is moving from theoretical to measured. The Akamai and CoreBreak research show real attack paths, not hypotheticals. OWASP's shift to data-driven rankings and the CSA's risk annex signal that the industry is starting to treat AI security as a structural problem, not a set of edge cases. For WAF operators, the connection is direct. As AI agents become the consumers of APIs and web applications, the security model needs to account for agent-originated traffic that looks legitimate but carries hidden instructions. Traditional WAF rules that inspect payload content will not catch vibe hacking or CometJacking. The next layer of defense needs to be at the interaction level, not just the network edge.