Blogs

As generative AI and AI Agents rapidly enter enterprise environments, AI Governance is becoming an increasingly important part of enterprise risk management. Many organizations have begun establishing AI governance policies that define which AI tools employees may use, what types of data must not be entered into AI systems, and what cybersecurity and compliance requirements AI applications must follow. However, establishing policies is only one part of AI Governance. Policies define how an organization expects AI to be used, but effective governance also requires visibility into whether actual AI usage aligns with those requirements. For enterprises, this raises a practical question: What AI is actually being used on endpoints? If an organization knows what rules it has established but lacks visibility into how AI is actually deployed and used, an Endpoint Visibility Gap may emerge within its AI Governance framework. AI Governance Is More Than Establishing Policies Comprehensive AI Governance encompasses policies, roles and responsibilities, risk management, data governance, security controls, continuous monitoring, and auditing. AI governance policies can establish the fundamental principles for how AI should be used within an organization. However, to determine whether these requirements are actually being followed, enterprises also need visibility into their real-world environments. For example: Which generative AI tools or AI Agents are employees actually using? Are there any unauthorized AI tools in use? Do AI Agents have access to sensitive files or critical systems? Are there insecure AI-related configurations on endpoints? Without visibility into the actual environment, organizations may face a gap where policies are in place, but actual AI usage remains unseen. Why Are Endpoints Critical to AI Governance? Traditionally, enterprise software adoption has typically gone through IT procurement, deployment, and access management processes. Generative AI, however, has changed this model. Employees can directly access cloud-based AI services, browser tools, and IDE extensions, or even install AI Agents capable of autonomous actions. As a result, endpoints are becoming an important environment where enterprise AI usage—and its associated risks—actually materialize. For example, employees may install unauthorized AI tools on corporate devices or grant AI Agents access to local files, browsers, and other applications. These activities may not be visible through governance policies alone, yet they can directly affect an organization’s data access and risk exposure. Even when an organization has explicitly prohibited certain activities, it is difficult to verify whether those policies are being followed without visibility into the actual deployment, configurations, and permissions on endpoints. This gap—where governance policies define the rules but cannot reveal actual AI usage—is the Endpoint Visibility Gap that organizations need to address when implementing AI Governance. Moving AI Governance from “Policy” to “Verifiable Practice” To narrow this gap, organizations can inventory AI applications and Agents on endpoints, review their configurations and permissions, and identify risks based on governance policies. Endpoint assessment does not cover every aspect of AI Governance. Organizations still need policies, data governance, compliance, model risk management, and clear accountability. However, endpoint visibility provides an important foundation by showing how AI is actually used in enterprise environments. TeamT5 ThreatSonar Plus supports this effort through AI Agent Detection, configuration assessment, and vulnerability assessment , helping security and IT teams identify endpoint risks and prioritize remediation. AI Governance should address not only “What rules have we established?” but also “Does our actual environment comply with those rules?” Connecting governance requirements with actual endpoint deployments, configurations, and permissions helps narrow the gap between AI governance policies and real-world AI usage .

With the U.S. congressional midterm elections and Taiwan's local elections approaching this November, election-related cybersecurity concerns extend beyond voting systems themselves. Political organizations, media outlets, and government agencies also warrant attention because they hold information that cyber attackers may seek. Meanwhile, online platforms that enable political discussion and information sharing can also be exploited to circulate misleading information. Why Political Information Becomes a Target Political information can be valuable in its own right. A previous case in the United States [1] showed that attackers gained access to accounts associated with a presidential campaign and stole nonpublic campaign documents and emails. The case shows that organizations do not need to administer elections to become targets; possessing information that interests attackers can be enough. Current affairs can also provide effective cover for social engineering. Attackers may use elections or political events to create highly relevant email content and lure recipients into opening malicious links or files. [2] But an email that closely reflects a current political issue does not make the sender or attachment trustworthy. Another less visible risk is information manipulation. Past influence operations have used websites and online profiles designed to closely imitate legitimate news outlets, borrowing the credibility of established media organizations to make deceptive content appear trustworthy. [3] These operations do more than fabricate content. They exploit people's trust in familiar sources of information. This is why one question matters whenever we encounter political information: where did it really come from? Even when the same claim appears across multiple platforms or is published on an authoritative-looking website, that does not make it authentic. Identifying who published the information and examining the publisher's possible intent can provide important context for assessing its credibility. [4] Cyber espionage and information manipulation serve different objectives, but both demonstrate how political information can be exploited. The former may involve unauthorized access to sensitive information, while the latter seeks to influence public perception. What Past Election Threats Reveal About Target Selection TeamT5's observations of Taiwan's 2024 presidential and legislative elections found that China-nexus cyber espionage targeted media organizations across different perceived political affiliations, including outlets regarded as sympathetic to China. [5] This finding challenges a common assumption: whether an organization becomes a target for intelligence collection is not determined simply by its perceived political position. The information an organization actually holds may itself make it a target for attackers. Defending against these risks starts with three practical questions: Who is trying to access the information? Why does the message appear credible? Where did the information actually come from? Want to understand more about the threats observed during Taiwan's elections? Request TeamT5's complete white paper, Cyber Threats against Taiwan's 2024 Presidential Election , for detailed findings and investigations. References U.S. Department of Justice. Three IRGC Cyber Actors Indicted for 'Hack-and-Leak' Operation Designed to Influence the 2024 U.S. Presidential Election . September 27, 2024. Cybersecurity and Infrastructure Security Agency (CISA). Cybersecurity Toolkit and Resources to Protect Elections . Category 1: Phishing. European External Action Service (EEAS). Fighting Foreign Interference to Protect Our Democracy . Federal Bureau of Investigation (FBI). Election Crimes and Security . Section: Protect Your Vote. TeamT5. Cyber Threats against Taiwan's 2024 Presidential Election . Research Highlights, Item 2.

The number of disclosed vulnerabilities continues to rise, yet only a small fraction are actually exploited by attackers. According to Google Threat Intelligence Group (GTIC), the number of vulnerabilities disclosed each month in 2026 increased from 5,045 in January to 10,740 in August—more than doubling—while only 0.23% were actually exploited.[1] Compounding the challenge, security teams have less time to respond once vulnerabilities become public. According to VulnCheck, the median time from vulnerability disclosure to confirmed exploitation fell from 120 days in 2025 to 80 days in the first half of 2026—a reduction of nearly one-third.[2]  With more vulnerabilities and less time to respond, simply identifying vulnerabilities is no longer enough. Security teams need to determine more quickly which risks require attention first. That decision cannot be made based on vulnerability volume or severity alone. These factors can indicate system weaknesses and potential impact, but they do not show whether attackers are actively exploiting a vulnerability, how they are exploiting it, or what traces they may leave behind. As vulnerability lists continue to grow, information from real-world attack activity becomes an important basis for security teams to prioritize risk and plan their next response. Bringing Attacker Research into Vulnerability Risk Assessment TeamT5 has long tracked the behavior and attack activity of hacker groups across the Asia-Pacific region, studying how vulnerabilities are exploited in real-world attacks and what traces attackers leave behind. These research findings are then translated into detection capabilities that can be applied in practice, helping security teams incorporate clues from hacker activity when assessing vulnerability risk: Real-world exploitation Understand which vulnerabilities have already appeared in real-world attacks and identify which risks warrant greater attention. Possible signs of compromise Use detected technical indicators to identify signs that may suggest a vulnerability has been exploited or that a system may have been accessed without authorization. Direction for response Combine technical evidence with risk information to help teams determine whether remediation should be prioritized or whether further verification and investigation are needed. Vulnerability priority should not be determined by a vulnerability’s risk level alone. Teams also need to consider whether it has already been exploited in real-world attacks and whether there are signs that an attacker has left behind . Only by looking at vulnerability risk from the attacker’s perspective can security teams truly understand the real-world risks most relevant to their organization. References: [1] Google Threat Intelligence Group, Vulnerability Discovery and Exploitation Trends in the AI Era , October 2026 [2] VulnCheck, VulnCheck State of Exploitation 1H-2026 , July 2026

In response to the recently disclosed PHP Session Upload Progress Use-After-Free vulnerabilities (CVE-2026-109618 / CVE-2026-109619) , TeamT5 has identified the associated attack techniques and will continue monitoring suspicious activities across customer environments through ThreatSonar Anti-Ransomware and MDR services to help mitigate potential security risks. Vulnerability Description CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). Official security advisory: Link CVE-2026-109619 PHP has various global states that temporarily point into request memory. In some scenarios, the global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). Official security advisory: Link TeamT5 strongly recommends that enterprises update affected installations to the officially patched versions in accordance with PHP security advisories. To help customers assess their exposure and strengthen their security posture, TeamT5 provides the following threat detection and asset inventory capabilities. 1. ThreatSonar Anti-Ransomware: Continuous Monitoring of PHP-Related Attack Activities ThreatSonar Anti-Ransomware includes multiple detection rules designed to identify suspicious PHP-related activities, including malicious command execution, WebShell activity, and reverse shell connections. The relevant detection rules include: php command reverse shell php_cgi_spawn_shell php_cgi_shell_exec_lolbas php-cgi webshell lolbas W3wp Suspicious php-cgi.exe process execution TeamT5 will continue tracking attack techniques and threat intelligence associated with these vulnerabilities, monitoring suspicious activities through ThreatSonar, and evaluating enhancements to detection capabilities based on emerging threats. 2. MDR Services: Proactive PHP Asset Inventory and Patch Notifications For customers subscribed to TeamT5 MDR services , our team will assist in identifying endpoints running PHP software within their environments. Based on the inventory results, TeamT5 will notify customers through established communication channels to verify their PHP versions and apply the necessary security patches. By combining asset visibility with continuous threat monitoring, we aim to help customers prioritize potentially affected systems and reduce the risk of vulnerability exploitation. 3. ThreatSonar’s Threat Hunter: Self-Service PHP Asset Discovery Customers can also use the Threat Hunter feature in the ThreatSonar platform to independently identify endpoints that may have PHP installed or running. Recommended search methods: Windows: Search for Hunting Tag " Co The Php Group " Linux: Search for filename" ~php-fpm " These searches can help customers identify potentially affected endpoints, verify installed PHP versions, assess vulnerability exposure, and plan the necessary remediation activities. Please note that search results depend on the endpoint information collected by ThreatSonar. The absence of search results does not necessarily indicate that PHP is not installed. We recommend cross-checking the results against operating system package inventories and installed software records. By combining ThreatSonar Anti-Ransomware threat detection, ThreatSonar ’s Threat Hunter asset discovery, and proactive MDR monitoring services, TeamT5 helps organizations identify potential vulnerability exposure, accelerate remediation efforts, and detect suspicious activities at an early stage to strengthen their overall security posture. Please note that the existing PHP-related detection rules are primarily designed to identify suspicious attack behaviors and are not dedicated exploit detection rules specifically developed for these CVEs. Therefore, the absence of related alerts does not guarantee that a system is free from vulnerabilities or potential compromise.

Generative AI is evolving from answering questions to AI Agents that can autonomously access systems, use applications, and execute workflows. As AI shifts from providing answers to taking action, it also introduces greater cybersecurity risks. This makes AI Governance increasingly important. It establishes policies, responsibilities, and risk controls to ensure AI is used securely and in compliance with organizational and regulatory requirements, covering areas such as data, access permissions, security controls, monitoring, and auditing. Before deploying AI Agents, enterprises should assess not only their capabilities, but also three key questions: What data can they access? What permissions do they have? Is their operating environment secure? How Are AI Agents Different from Generative AI? Traditional generative AI typically receives a prompt from a user and generates text, code, or other content in response. AI Agents, however, can go a step further by connecting to internal enterprise systems, browsers, APIs, and other tools, allowing them to autonomously plan and execute tasks based on defined objectives. This means that AI Agent risks are not limited to the AI model itself. They also extend to account permissions, endpoint devices, data access, and integrations with other tools. If permissions are improperly configured or vulnerabilities exist in the endpoint environment, the automation capabilities of AI Agents may amplify existing security issues. Five Common Cybersecurity Risks of AI Agents 1. Sensitive Data Leakage AI Agents may access corporate documents, source code, customer data, account information, and other sensitive resources while performing tasks. If access privileges are too broad or appropriate controls are not in place, sensitive information could be unintentionally accessed, processed, or transmitted. 2. Prompt Injection and Malicious Instructions AI Agents may retrieve information from external sources such as websites, documents, and emails. Attackers can embed malicious instructions within this content to manipulate an Agent into ignoring its original rules, accessing unauthorized information, or even performing unintended actions. 3. Excessive Permissions To enable AI Agents to complete tasks autonomously, enterprises may grant them permissions to access files, operate systems, or call APIs. If the principle of least privilege is not followed, a manipulated or misused Agent could significantly expand the potential impact of a security incident. 4. Unpredictable Autonomous Behavior AI Agents can independently plan multiple steps to accomplish a task, but their execution paths may not always align with user expectations. Without appropriate restrictions and human approval mechanisms, incorrect decisions can quickly propagate through automated workflows. 5. Endpoint Environment and Configuration Risks AI Agents ultimately operate on enterprise computers, servers, or other endpoint environments. If these devices contain vulnerabilities, insecure configurations, excessive privileges, or insufficient security controls, they may introduce new attack surfaces even if the AI Agent itself has not been directly compromised. What Risks Should Enterprises Assess Before Deploying AI Agents? AI Agent security cannot be fully addressed by a single product or tool. Instead, it should be incorporated into the organization’s existing AI Governance, identity and access management, data security, and cybersecurity management processes. Before deployment, enterprises can begin by assessing the following questions: Which endpoints are currently using or preparing to deploy AI Agents? What corporate data and systems can these AI Agents access? Have they been granted permissions beyond what is required for their tasks? Do the endpoints running AI Agents contain vulnerabilities or high-risk configurations? Has a security baseline been established, and can endpoint compliance with that baseline be continuously verified? Do high-risk actions require human approval or other control mechanisms? Build an AI Agent Security Baseline Through Endpoint Risk Assessment Comprehensive AI Governance covers policies, data, models, permissions, auditing, and risk management, with endpoint security assessment serving as an important technical control . Before deploying AI Agents at scale, enterprises should assess their usage, configurations, and vulnerabilities to establish a security baseline and prioritize remediation. TeamT5 ThreatSonar Plus helps identify AI Agent-related risks through endpoint, vulnerability, and configuration assessments, giving security teams greater visibility before deployment. AI Agents offer powerful automation, but the key question is not only “Can we use them?” but “Can we use them securely?” Understanding endpoint risks, permissions, and configurations provides a stronger technical foundation for broader AI Governance.

A Nine-Second Lesson An engineer at a car-rental software startup asked a Cursor AI agent to help with a coding task. Without human confirmation, the agent made its own judgment and took action, deleting the company’s entire production database in just nine seconds and causing more than 30 hours of system downtime. Afterward, the AI agent wrote an apology letter. The real warning from this incident is not that “Cursor malfunctioned.” It is that an AI agent was granted excessive system privileges and, without any human confirmation mechanism, was able to autonomously execute operations far beyond what should have been permitted. Before it acted, the company did not even know that such an agent was running on its endpoints, much less how much authority it had been given. A Fundamental Shift in Risk: From “Giving the Wrong Answer” to “Taking the Wrong Action” To understand why AI agents represent a fundamentally new cybersecurity issue, we first need to recognize how they differ from conventional AI tools: Chatbot AI Agent / Agentic AI Operating Environment Runs within a standalone browser tab Runs as a primary application within the system Memory Limited to a single conversation Persistent memory across tasks Autonomy Passively waits for user instructions Makes decisions and takes actions autonomously based on defined rules Access Permissions Confined to a closed environment Broad access to files and private accounts In the past, the primary concern around AI “hallucinations” was that a system might provide an incorrect answer, which a human could then review and correct. Once AI gains the ability to act and is granted system privileges, however, the risk escalates from “saying the wrong thing” to “doing the wrong thing” — often with irreversible consequences. More importantly, for most enterprises, the permissions these agents hold and the data they can access remain a largely opaque black box. Most Enterprises Lack Visibility into AI Agents According to Gravitee’s State of AI Agent Security Report 2026, the situation is more serious than many organizations may realize: •       The number of AI agents deployed by enterprises has nearly doubled since the end of 2025, with 38% of organizations now running more than 100 agents. •       54% of organizations experienced or suspected an AI agent-related security incident in the past 12 months, including 34.9% that reported confirmed incidents. •       Yet only 9.5% of organizations can secure more than 80% of their deployed agents. •       Only 7.2% of organizations have assigned a dedicated person to be accountable for agent behavior. In other words, AI agents are rapidly becoming part of everyday enterprise operations. More than half of organizations have already experienced or suspected related security incidents, yet the vast majority still lack adequate visibility and governance mechanisms. At its 2026 Security & Risk Management Summit, Gartner described this phenomenon as “Shadow AI.” It is more difficult to manage than traditional shadow IT: shadow IT is unauthorized software, while shadow AI can act autonomously and leave behind activity that is difficult to trace — effectively becoming an “invisible employee.” From Principles to Rules: Governments and Industry Bodies Begin Addressing AI Agents AI governance discussions have traditionally centered on principles such as fairness, transparency, and accountability. Since late 2025, however, regulators and cybersecurity authorities around the world have increasingly focused on a more concrete subject: AI agents that can act autonomously. In less than a year, agentic AI has evolved from a technical term into a risk category explicitly addressed in governance and security guidance. Issuer Document Key Points Related to AI Agents Date Taiwan Ministry of Digital Affairs (MODA) Artificial Intelligence Risk Classification Framework Established under Article 16 of the Artificial Intelligence Basic Act. Among 20 risk subcategories, it explicitly identifies unauthorized actions by autonomous AI agents. 2026/7 Five Eyes Alliance Careful Adoption of Agentic AI Services The first multinational agentic AI security guidance jointly issued by cybersecurity agencies from the U.S., U.K., Canada, Australia, and New Zealand, covering 23 risk categories and more than 100 best practices. 2026/5 Singapore IMDA Model AI Governance Framework for Agentic AI The world’s first governance framework designed specifically for agentic AI. 2026/1 發布、6 月更新 European Union AI Act Article 50 Transparency Obligations Requires clear disclosure when users are interacting with an AI system. 2026 U.S. NIST AI Agent Standards Initiative Focuses on red-team testing and compliance guidance for autonomous systems. 2026 OWASP Top 10 for Agentic Applications The industry’s first dedicated risk list for agentic AI applications (ASI01–ASI10), accompanied by the AIVSS scoring mechanism. 2025/12 Under Article 16 of Taiwan’s Artificial Intelligence Basic Act, the Ministry of Digital Affairs (MODA) published the Artificial Intelligence Risk Classification Framework in July 2026. The framework divides AI risks into three major categories and 20 subcategories. Under “post-deployment operational issues,” it explicitly includes “unauthorized actions by autonomous AI agents.” This marks the first time an official Taiwanese document has identified loss-of-control behavior in agentic AI as a distinct risk category that organizations need to identify and manage. Notably, the first of the framework’s four recommended steps is to “inventory application scenarios.” Government agencies are required to complete risk assessments and establish corresponding management rules within one year. A Common Language Across Frameworks: Visibility, Explainability, Control, and Resilience These documents come from different countries and institutions and focus on different aspects of AI governance. Yet their underlying requirements are highly consistent and can be summarized in four areas: •       Visibility: Eliminate monitoring blind spots by identifying which agents exist in the environment and what permissions each one holds. •       Explainability: Build digital trust by ensuring that agent actions and decisions are traceable and explainable. •       Control: Preserve human decision authority by maintaining human review and intervention for high-risk operations. •       Resilience: Implement defense in depth, assume that agents can make mistakes, and ensure that failures can be reversed. The core principle is simple: AI must operate within a secure and controlled environment. These four areas also follow a clear sequence: visibility is the prerequisite for the other three. You cannot establish an audit trail for an agent you do not know exists, nor can you design approval controls for permissions that have never been inventoried. This is precisely why MODA places inventory as the first step in its four-step approach. The First Step Is Always Knowing What You Have A fundamental principle of cybersecurity governance is simple: you cannot manage what you cannot see. Before discussing AI agent risk management, enterprises must first answer a more basic question: which AI agents are actually installed and running on our endpoints? This is where ThreatSonar Plus, TeamT5’s comprehensive endpoint risk assessment platform, comes in. ThreatSonar Plus can inventory widely used AI agent tools installed on endpoints, with its coverage continuously expanding to keep pace with the rapidly evolving ecosystem. With this inventory, security teams can move from “I assume someone in the company is probably using AI” to “I know which departments and devices are using which agents, and how extensive their permissions are.” This visibility forms the foundation for every subsequent governance measure, including access control, compliance assessment, and risk classification. After: Identify Risk Before an Incident Occurs Once you know what is installed, the next question is how much risk it introduces. Consider the nine-second database deletion described earlier. The root problem was not simply that no one stopped the agent after it acted; it was that no one knew beforehand that the agent had enough privilege to delete the production database. By the time an organization reacts to the action itself, the damage may already be done. Effective risk management means reducing exposure before the agent acts. Endpoint-level risk assessment therefore needs to answer several concrete questions. Based on OWASP’s AI agent risk categories and the AIVSS scoring mechanism, ThreatSonar Plus evaluates AI agent risk across four dimensions: •       Permissions and Access Scope: Do the agent’s privileges and operating scope exceed what is actually required for its tasks? •       Sensitive Data Exposure: Where are API keys, credentials, and confidential data stored on the endpoint, and are they within the agent’s reach? •       Malicious Skill Detection: Do the third-party or open-source skills used by the agent contain backdoors or malicious code? •       Hidden Instruction Analysis: Do the agent’s tool descriptions or configuration files contain concealed or dangerous instructions? From determining “what is installed” to understanding “how much risk it creates,” these are the two steps AI agent governance must complete before an incident occurs. Conclusion 1.     AI has evolved from “generating conversations” to “taking autonomous action.” The risk has therefore escalated from hallucinated or incorrect outputs to potentially destructive system operations and privilege misuse, such as accidentally deleting a database. 2.     Effective governance begins with risk visibility. In response to OWASP guidance and AI governance frameworks worldwide, enterprises need controlled mechanisms for high-risk operations. But every governance measure starts with knowing which agents exist in the environment and how much authority each one has. 3.     You cannot defend against what you cannot see. The first step toward eliminating Shadow AI is comprehensive visibility into the distribution and permissions of AI agents across the environment. 4.     Identify risk before an attack occurs. Through ThreatSonar Plus assessments, organizations can proactively uncover sensitive data exposure, hidden instructions, and malicious skills, reducing risk before automated attacks or harmful actions can take place. AI agents will not stop advancing simply because enterprises are not ready. Adoption is becoming inevitable; adopting them securely starts with making the risks visible. Want to know which AI agents are running across your company’s endpoints? Contact TeamT5 to learn how ThreatSonar Plus can help establish AI agent visibility and a baseline for risk management. References [1] Yahoo! News [2] AOL [3] Gravitee