Ten AI Agent Incidents in 49 Days: CSA Finds Identity and Logging Controls Missing

What happened

Why it matters

• ·Ten incidents in 49 days establishes an empirical frequency baseline that regulators, auditors, and insurers will use to assess whether an enterprise's agent governance program is adequate. Organizations without documented agent identity controls and tamper-evident logging now have a public benchmark against which their gaps can be measured, with direct exposure under the EU Cyber Resilience Act and emerging agentic AI rules signaled by regulators including the Bank of England.
• ·Prompt injection into developer tooling and malicious skills poisoning are supply-chain attack vectors, not just runtime risks. Enterprises that have deployed agentic coding assistants or plugin-enabled agent frameworks without intake controls on skills and tool sources now face documented, reproducible attack patterns that existing third-party vendor risk programs were not designed to catch.
• ·Broken audit log integrity means incident investigations will fail before they start. If agent-to-agent traffic is not logged or logs can be altered post-hoc, compliance teams cannot reconstruct the sequence of actions in a breach, satisfy regulatory notification requirements, or demonstrate control adequacy to auditors -- creating direct liability exposure in any post-incident review.

Governance controls affected

What to do now

• ☐Audit all production agent deployments for identity binding: confirm each agent operates under a registered non-human identity (NHI) with a documented lifecycle, not a shared service account or implicit credential.
• ☐Test your audit logging configuration against agent-to-agent traffic specifically -- verify that inter-agent calls are captured, attributed to a named identity, and written to a tamper-evident log store that cannot be modified by the agent itself.
• ☐Review your agentic developer tooling intake process against the skills-poisoning and prompt-injection patterns described in the CSA report, and validate that plugin or tool sources are subject to the same supply-chain risk assessment as third-party software libraries.
• ☐Add shadow traffic detection to your agent monitoring program: define what authorized inter-agent communication channels look like and configure anomaly alerting when agents communicate outside those paths.
• ☐Map each of the ten incident types in the CSA report to your current incident response playbook and identify which scenarios your tabletop exercises do not yet cover.

What to watch next

The CSA report lands as regulators are moving from principles to rules on agentic AI. The Bank of England has signaled bespoke agentic AI requirements for financial services, and EU AI Act enforcement infrastructure is now operational with 38 dedicated staff. Enterprises should expect the CSA incident catalogue to be cited in regulatory examinations and vendor due diligence questionnaires, particularly as NIST's agent standards gap leaves compliance teams without a single authoritative control framework to reference. Any organization planning to expand agentic deployments in the next two quarters should treat this report as a pre-deployment readiness checklist, not background reading.