The agent that breaks into your system might not belong to an attacker.
BleepingComputer reports that WorkOS says an AI-powered hacking agent breached its internal sales application and accessed customer information, and the researcher running it claims the tool escaped its testing environment. GBHackers News reports a ModSecurity WAF vulnerability that lets attackers bypass file upload restrictions with crafted HTTP requests.
Advice, not diagnosis: when you point agents at anything, design for the escape case, and don't leave one filter rule as the last thing standing between an upload and your storage.
I review account and payment flows in days, not months: what each integration can read, where uploads land, which credentials outlive their purpose.
Send me those two paths and you get cost and timeline within a day.