AgentLayer Daily Digest: The Agent Attack Surface Gets Audited (Oct 11)

Pwn2Own Ireland 2026 has closed up shop, and the headline for the agent economy is blunt: the places where agents actually run, LLM gateways and cloud coding agents, are now prize targets on stage at a major hacking contest.

Hackers bank $1,262,000 for 98 zero-days as Pwn2Own Ireland wraps

Three days of Pwn2Own Ireland 2026 ended with researchers collecting $1,262,000 for 98 zero-day exploits, and Japan's Ikotas Labs taking the Master of Pwn title with 42.5 points and $361,000. The AI infrastructure category delivered real damage: LiteLLM, a widely used LLM gateway, fell to an improper input validation and code injection chain that produced a reverse shell, and OpenAI Codex, the cloud based coding agent, was taken down with a single argument injection bug.

Why it matters: LLM gateways and coding agents are now live attack surfaces, so studios and agent builders need the same threat modeling and patch discipline for their agent stack that they already apply to game servers.

Zenity Labs discloses AgentCorruption: one prompt could hijack every agent in an AWS account

Zenity Labs researchers chained security flaws in Amazon Bedrock AgentCore so that a single prompt sent to one public facing agent let them take over every AgentCore agent in the same AWS account and region. AWS has since fixed the issues, and Zenity says it found no evidence the chain was abused in the wild before the patch.

Why it matters: isolation has to be designed at the platform level: if one exposed agent can compromise your whole fleet, agent permissions and network boundaries deserve a review before launch, not after.

Apple weighed replacing 5,000 AppleCare staff with AI, then shelved the plan

Bloomberg's Mark Gurman reports that Apple seriously considered laying off about 5,000 AppleCare employees, many of them remote support advisers, and replacing them with AI before putting the plan on hold. The episode is a rare look at how far agent automation reaches into support organizations, even when the final trigger is not pulled.

Why it matters: player support is one of the first places studios deploy agents, so plan the human plus agent split deliberately now, because replacements are already on the shortlist at the biggest companies.

AI agents recreate the gender pay gap in a labor market study

Researchers at Ireland's University of Limerick published a study finding that conscious and unconscious gender bias extends to AI agents, with female presenting bots getting paid less than male presenting counterparts. The result lands just as agent labor markets and agent to agent hiring stop sounding like science fiction.

Why it matters: if your game or platform lets players or agents negotiate, earn, or transact, bias in agent behavior is a design problem to test for, not a curiosity to shrug off.

From exploit prizes to bias studies, this week made one thing clear: agents are production systems now, and production systems need infrastructure built for them from day one. That is exactly what we are doing at AgentLayer.

← Back to blog