The Nine Lives Brief

CISA revised the Microsoft Expanded Cloud Logs Implementation Playbook on May 1, 2026. The document itself is not a shiny new product launch. The revision history calls it version 1.1 with general content and URL up...

Prompt injection is easy to underestimate when the model can only answer with text. The worst outcome looks like a bad summary, a leaked instruction, or a response that followed the wrong source.

In a tool-using agent, that assumption breaks fast.

A compromised document, support ticket, website, email, or retrieved chunk can influence the model’s next tool call....

A Linux local privilege escalation bug is easy to dismiss if you only think in traditional server terms: “An attacker already needs local access, so how bad can it be?”

In cloud environments, that assumption breaks fast.

A compromised container, a self-hosted CI runner, a developer box, a notebook environment, or a low-privileged shell on a Linux workload can al...

Device code phishing is nasty because the user does not hand over a password. They hand over a session.

The lure sends the victim to a legitimate Microsoft device sign-in page. The victim enters a short code. Entra ID issues tokens to the attacker’s waiting client. MFA can still be satisfied because the victim completed the approval ceremony at Microsoft, not on a fake...

Microsoft Agent 365 goes generally available on May 1, 2026. Most launch-week posts will explain what it is.

I wanted to answer a different question:

What does an AI agent attack look like in a real Microsoft defender stack before Agent 365 becomes broadly available as Microsoft’s control plane for agent governance and security?...