OpenAI’s Your AI Agent Is Now Your Biggest Attack Surface

For three weeks running, I've written about agents moving into production, enterprises embedding AI, and the governance work that separates winners from the rest. This week, a piece of security research landed that makes all of that urgent in a way I didn't fully anticipate.

It's called Agentjacking. And if your developers use AI coding agents, Claude Code, Cursor, Codex, any of them, you need to understand it.

What Actually Happened

Researchers at Tenet Security disclosed a new attack class in June. Here's the mechanism, simplified.

Many development teams connect their AI coding agent to Sentry, the popular error-tracking tool, through MCP, the protocol that lets agents pull in external data. A developer says, "fix the unresolved Sentry errors," the agent reads the error reports, and acts on them. Convenient. Normal. This is exactly the workflow everyone's been racing to adopt.

Every tool you connect an agent to is now a potential injection point. The convenience of "my agent can read my error logs / my tickets / my docs / my database" is exactly the surface that attackers exploit. The more autonomous and connected your agents, the larger this surface grows.

This doesn't mean stop. It means the governance conversation I've been having with you needs a security dimension that most organizations haven't built yet. "What can the agent access?" was always the right question. Now there's a sharper one underneath it: "What untrusted data flows into the agent through the things it can access?"

Your AI Will Only Ever Be as Good as the Data Underneath It

Let me give you the most important number in enterprise AI right now.

Read that again. After all the investment, all the pilots, all the executive attention, 93% of enterprises do not have data that’s fully ready for the AI they’re trying to build.

And here’s the part that should concern you most: most of them don’t know it. The same body of research describes what’s called the “AI readiness illusion”: organizations believe they’re prepared to scale AI even as critical data problems remain unsolved beneath the surface. In one survey, 84% of leaders felt confident in the accuracy and completeness of their data, while the underlying reality revealed persistent silos, inconsistent quality, and limited access.

This edition is about closing that gap, in language you can act on without a data science degree.

Why Data Decides Everything

Here’s the simplest way I explain this to leadership teams:

The data backs this up. Across multiple 2026 surveys, data quality consistently ranks as the single biggest barrier to enterprise AI success, ahead of talent, integration, cost, and governance. Deloitte put it at 62%. The reason AI projects fail is almost never the model. It’s the foundation the model is standing on.

Think of it this way: the model is the engine. Your data is the fuel. The most powerful engine in the world produces nothing but noise and smoke if you put contaminated fuel in it. And right now, most enterprises are pouring contaminated fuel into very expensive engines and wondering why they’re not moving.

Five Data Myths That Stall Enterprise AI

In my conversations with enterprise leaders, the same misconceptions come up again and again. Each one quietly undermines AI initiatives. Let me name them:

Myth 1: “We have a lot of data, so we’re data-rich.”

Volume is not value. Most enterprises have enormous amounts of data that is duplicated, outdated, inconsistent, or trapped in systems nobody can access. Having 150 petabytes of data isn’t an asset if half of it is “dark data” you can’t use. The question isn’t how much data you have. It’s how much you can actually access, trust, and use.

Myth 2: “Our data is in the cloud, so it’s AI-ready.”

Moving data to the cloud changes where it lives, not its state. Messy data in the cloud is still messy data. Cloud is a necessary infrastructure, but it doesn’t clean, govern, or organize your data for AI. That’s separate work.

Myth 3: “Agentic AI will solve our data quality problems.”

Nearly half of enterprise leaders in one survey said they believe agentic AI can solve their data quality issues. This is dangerous wishful thinking. Agents need clean data more than any other AI pattern, not less, because they take autonomous action on what they retrieve. Expecting AI to fix the data it depends on is circular logic. The foundation comes first.

Myth 4: “Data quality is the data team’s problem.”

Data quality is a business problem with business consequences. When the data team owns it alone, they can fix the technical symptoms but not the root causes, which usually live in business processes, incentives, and ownership. Who is accountable for the customer record being accurate? That’s a business decision, not a technical one.

Myth 5: “We’ll clean the data once and be done.”

Data readiness isn’t a project with an end date. It’s an ongoing capability. Data decays. Sources change. New systems get added. The enterprises that succeed treat data quality as a continuous discipline, not a one-time cleanup before the AI project starts.

What “AI-Ready Data” Actually Means

When I assess an organization’s data foundation, I look at five dimensions. You don’t need to be technical to ask these questions, and asking them will tell you more about your AI readiness than any vendor demo:

If you can’t confidently answer “yes” to all five, you’ve found the work that needs to happen before or alongside your AI initiatives, not after they’ve already struggled.

What Leaders Should Actually Do

You don’t need to become a data expert. But there are five moves only leadership can make, and they matter more than any technical decision your data team will make:

1 Treat data as a product, not a byproduct

The most mature organizations treat key datasets like products: with owners, quality standards, documentation, and consumers. This is a leadership decision about how data is valued and resourced, not a technical implementation detail.

2 Assign data ownership to named people

“The data team owns the data” is not ownership. Each critical dataset, customer, product, financial, and operational needs a named, accountable owner in the business. Without this, quality is everyone’s problem and therefore no one’s.

3 Fund the unglamorous work

Data foundation work has no demo. It doesn’t impress the board. It’s pipelines, governance, cataloging, and quality monitoring. And it is the single highest-leverage investment you can make in AI success. Leaders who fund the boring foundation outperform those who fund exciting models on weak foundations. Every time.

4 Sequence data readiness with use cases - don’t wait for perfection

This is the balance. Don’t boil the ocean trying to perfect all your data before doing any AI. But don’t launch AI on data you haven’t assessed. The right move: pick your first use cases, assess the specific data they need, and get that data AI-ready. Build data readiness use case by use case, not all at once.

5 Make data literacy a leadership competency

You don’t need to write SQL. But you do need to understand enough to ask the right questions and challenge the answers. A leader who can’t question the data behind an AI recommendation is a leader who will be misled by it confidently.

Where This Fits in the GenAI Maturity Framework

Data & Infrastructure is Dimension 2 of the GenAI Maturity Framework, and in my experience, it’s the dimension that most often becomes the bottleneck. Remember the core principle: your overall maturity equals your weakest dimension. An organization with a brilliant AI strategy and talented engineers, but with a Level 1 data foundation, is, functionally, a Level 1 organization.

The hard truth: you cannot buy, hire, or model your way out of a weak data foundation. It is the one part of enterprise AI with no shortcut.

Your Action Plan for This Week

SpaceX Acquires Cursor for $60 Billion. In the largest VC-backed startup acquisition in history, SpaceX (now home to xAI) acquired the AI coding company behind Cursor. Combined with the xAI integration, it signals an aggressive consolidation play in the developer tools layer and concentrates more of the coding-agent market under a single owner.

OpenAI unveiled "Jalapeño," a custom AI inference chip built with Broadcom, targeting 50% lower inference costs, a bid to reduce dependence on Nvidia. source​

NAVER and NVIDIA announced an expansion of sovereign AI infrastructure in South Korea, starting at 55MW and scaling toward gigawatt capacity for HyperCLOVA X. source​

Favorite Tip Of The Week:

Treat Every MCP Connection as Untrusted Input

The single most useful security habit to adopt this week: before connecting any AI agent to an external tool, ask whether that tool returns data that someone outside your organization could influence. If yes, that data should be treated as untrusted - the same way you'd treat user input to a web form.

Practically, this means: prefer read-only scopes where possible, require human confirmation for any agent action that executes code or touches credentials, and maintain an explicit list of what each agent can access. The convenience of connected agents is real, but the security model hasn't caught up, so your habits have to compensate until it does.

Use Case of The Week:

Photonic AI for Medical Diagnostics

Researchers at Shenzhen University built an all-fiber photonic AI platform that processes medical images using light instead of electrons. It achieved expert-level accuracy in diagnosing retinal detachment and liver cancer while operating dramatically faster and using less energy than conventional electronic systems.

It's a reminder that the AI frontier isn't only in larger language models. Some of the most consequential advances are happening at the hardware-and-physics layer, where new compute substrates could make specialized AI dramatically cheaper and faster for narrow, high-value tasks like diagnostics.

Potential of AI:

A quieter research finding this month deserves attention: scientists gave top AI models a classic psychology attention test and found performance held up on short tasks but deteriorated sharply as tasks grew longer and more complex. It's a useful counterweight to benchmark hype; the models that ace standardized tests still have real limits on sustained, complex reasoning. For leaders, the lesson is to validate AI on your actual long-horizon workflows, not on leaderboard scores.

​ScienceDaily AI research​

Things to Know...

Grounding with Google Maps for Gemini API

While working on a few use cases, a requirement for a location-aware Gen AI assistant emerged; achieving this has been difficult until now. The model would confidently claim a restaurant was open when it was closed, or describe a “quiet café” that turned out to be a lively nightclub. Now, the feature allows Gemini-powered models to pull live geospatial data from Google Maps, covering over 250 million places worldwide, including details such as current business hours, user reviews, and walking time estimates.

Why it matters: For professionals building real-world Gen AI assistants across travel, retail, and location-based services, this isn’t just a nice add-on. It’s a necessity. Without grounding, agents make declarations; with it, they act like trusted local experts.

Where You Can Use It

• Real estate agents: Generate neighborhood summaries with nearby parks, schools, and transport.
• Retail planners: Create personalized in-store experience maps based on live customer context.
• Travel services: Offer dynamic recommendations (“Best cafe within 10 min walk now”) with verification.

Capability Is No Longer Your Differentiator - Trust Is

Every business is deploying AI. As models converge on capability and June has shown they're plateauing on the release treadmill, your differentiator shifts to how trustworthy, secure, and accountable your AI-powered products and processes are. If you're competing on "we use the latest model," that edge is evaporating. If you're competing on "our AI is governed, secure, and reliable," that's the durable advantage.

The Opportunity...

Podcast:

• This week's Open Tech Talks episode 192 is "AI Can't Replace Your Brand Story with Mona Bavar".

Apple | YouTube​

AI Can't Replace Your Brand... Jun 28 · OPEN Tech Talks: AI wort... 26:16   ​

Courses to attend:

• ​AI Agent Security & Red Teaming — Increasingly essential given this week's Agentjacking research; covers prompt injection, tool-use risks, and agent hardening.
• ​Securing AI Systems — Foundations of threat modeling for ML and agentic systems.
• ​MCP: Build Rich-Context AI Apps with Anthropic — Understand how MCP works under the hood, including its trust boundaries.

Events:

• ​World AI Expo Dubai 2026 - 1,200+ AI leaders, 500+ entrepreneurs, 100+ investors from 20 countries.
• ​AI Everything, Abu Dhabi, 6-7 Oct, 2026
• ​AI Summit, Barcelona, 22-23 Sep, 2026
• ​Dubai AI Festival, Dubai, 26-27 Oct 2026

Tech and Tools...

• ​agent-jackstop: Tenet Security's open-source, drop-in hardening configs for Cursor and Claude Code that reduce the risk from untrusted telemetry ingestion. Worth deploying if your team uses coding agents.
• ​Gemini 2.5 Pro Deep Think: Google's new reasoning-mode model topping the science and reasoning leaderboards — strong for graduate-level analytical tasks.
• ​Microsoft Foundry Local: On-device AI inference for Windows, macOS (Apple Silicon), and Linux - no data leaves the device, no per-token billing. Useful where data residency or latency rules out cloud inference.

The Investment in AI

• SpaceX acquired Cursor for $60 billion - the largest VC-backed startup acquisition on record, consolidating frontier developer tooling under the xAI/SpaceX umbrella.
• Qualcomm is in early talks to acquire AI chip designer Tenstorrent for $8-10 billion, a move to secure a seat at the AI hardware source​

That's it for this week - thanks for reading!

Reply with your thoughts or favorite section.

Found it useful? Share it with a friend or colleague to grow the AI circle.

Until next Weekend,

Kashif

The opinions expressed here are solely my conjecture based on experience, practice, and observation. They do not represent the thoughts, intentions, plans, or strategies of my current or previous employers or their clients/customers. The objective of this newsletter is to share and learn with the community.