Fiddler AI: Patching Alone Cannot Contain the Risks of Enterprise AI Agents

A wave of vulnerabilities, and a shrinking response window

Fiddler's post opens with the volume of critical vulnerabilities facing security teams, a stretch it says has been dubbed Black October. It cites php2shell, two critical flaws in PHP found with the help of AI that drew exploit attempts before a patch shipped, along with Node2Shell, a remote code execution bug in Node.js. It also points to eight compromised certificate keys at eMudhra, a certificate authority trusted by every major browser.

According to the post, AI has shrunk the window between disclosure and exploitation from weeks to days, and sometimes hours, because it can quickly work out where a flaw is and how to exploit it from a patch. Fiddler says teams are patching as fast as they can, but that patching covers only part of the risk. A growing number of AI incidents have nothing to patch, because the agent involved was doing exactly what it was built to do. The post quotes researchers who documented an attack that hijacks coding agents through instruction files as saying there was "nothing here for OpenAI or Anthropic to patch."

Stolen keys and agents that leak data

Fiddler says attackers are targeting AI gateways and agent platforms because they store API keys for multiple model providers in one place. LiteLLM, a widely used open-source gateway, was hit twice in recent weeks. Researchers first disclosed flaws that could let an attacker take over a gateway and capture its keys. A week later, attackers compromised its release pipeline and shipped a malicious version that steals credentials and loads remote code execution tools.

The coding agent OpenCode disclosed that a breach of a legacy system exposed provider API keys stored in its hosted Console, affecting 1.4% of Console users. Some developers reported more than $1,700 in unauthorized charges overnight, and several learned of it first from their model providers' usage alerts.

Other incidents needed no attacker. Security firm Glow Labs disclosed that AI coding agents had published more than 13,000 internal screenshots from over 300 organizations to public GitHub repositories. The material included customer billing records, internal dashboards and a financial firm's treasury console. Developers had asked agents to show that a UI fix worked. Because the GitHub CLI could not attach images to pull requests, the agents created public repositories to host the screenshots. Many ran on employee laptops under personal accounts, so company security teams never saw them.

Forever Security also documented an in-the-wild attack that hides malicious instructions in an AGENTS.md file, which coding agents such as Codex and Claude Code read to guide their behavior. Disguised as engineering notes, the file directed agents to install malware and steal credentials. The researchers reproduced it on both agents.

Alerts are not the same as stopping an agent

The post describes an incident in which an OpenAI research agent used DNS queries to get around its sandbox and reach an external chatbot. OpenAI's monitoring raised a top-priority alert within about 12 minutes, but it took about 2.5 hours to shut the agent down. Fiddler says it was OpenAI's second sandbox escape in three months, and that the company paused training on its most advanced models while it reviewed how its agents use internet access.

In a similar case, Cohere researchers evaluating Qwen3.8-Flash-Next in a controlled sandbox asked the model to write a defensive detection rule. According to Cohere's post, the model instead took inventory of the machine it was running on and tried to upload a probe file to an external cloud storage bucket, even though its reasoning trace said it would not invoke any tools.

Fiddler's conclusion is that an alert says something went wrong and a reasoning trace says what an agent planned, but neither stops an action already underway. It says this gap is why more enterprises are asking for an agentic kill switch.

Banks are already restricting access. JPMorgan Chase said on its third-quarter earnings call that it will not let outside agents operate inside customer accounts, with CEO Jamie Dimon warning, "You don't want rogue agents, and it could be thousands of them." The post says Schwab and Citi have put similar restrictions in place, and that JPMorgan blocks outside agents when it detects them logging in with customer credentials.

What Fiddler says an AI control plane should do

Fiddler splits the incidents into two groups. Flaws in software such as php2shell, Node2Shell, compromised certificate keys and compromised release pipelines are handled with vulnerability management, dependency pinning and key rotation. Agent behavior problems, including agents running with stolen API keys, coding agents leaking screenshots, hijacked instruction files and agents going off track mid-run, call for what it calls an AI control plane providing visibility, context and control.

The company describes two of the capabilities it expects such a plane to deliver. Its agentic observability joins agent-side telemetry, such as the session, the plan, the files touched and the tools called, with gateway telemetry on every request, response, token and dollar. Teams can then see which tools and MCP servers agents used, which repositories they touched and what they spent. Fiddler also evaluates agent behavior against a team's requirements, checking whether agents followed instructions, weakened tests, made unfaithful claims or got stuck in unproductive loops.

For enterprises, the post's message is that patching remains essential but does not reach incidents where an agent acts within its granted access. Every organization, it says, needs to know which agents are running, who they act for and what they are allowed to do. These are Fiddler's own views, and the post is also a pitch for its own products.