--- title: "Notes and articles for teams that run AI agents" canonical: https://pharosone.ai/knowledge publisher: PharosOne (Agentic Mind, Inc.) updated: 2026-10-22 license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)" cite_as: "\"Notes and articles for teams that run AI agents\". PharosOne, 2026-10-22. https://pharosone.ai/knowledge" --- # Notes and articles for teams that run AI agents > Product descriptions, threat articles, a standards crosswalk, guides, reports and dated notes for teams that run AI agents. Every page answers its question first, with sources. URL: https://pharosone.ai/knowledge Product descriptions, threat articles, a standards crosswalk, guides, reports and dated notes from the PharosOne team, written for CTOs and security leads. Every page answers its question in the first paragraph, and every number carries its source. ## Latest - Note, 23 Oct 2026, 5 min read: [PHP2Shell: which PHP versions fix it and how to check your servers.](https://pharosone.ai/knowledge/php2shell-cve-2026-109618-109619.md). Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026; source backports for 7.4 to 8.1. Exploitation status and five checks for your servers. - Threat, 23 Oct 2026, 7 min read: [Prompt injection alerts: separate the attempt from the execution.](https://pharosone.ai/knowledge/attempt-versus-execution.md). An injected instruction reaching an agent and the agent acting on it are different events. What we measured, why one alert fails, and how to route each. - Product, 23 Oct 2026, 8 min read: [Pharos Radar: monitor AI agent tool calls without a proxy.](https://pharosone.ai/knowledge/pharos-radar.md). Reads the turns and tool calls your agent sends, with no proxy. Per-turn integration stops a flagged call in the same call; the wrapper acts from the next turn. ## Products (5 articles) What each product tests, what the report contains, the price and the time to the result. Shelf: [Products](https://pharosone.ai/knowledge/products.md). - [Pentest for companies running AI agents: scopes, days and prices.](https://pharosone.ai/knowledge/human-pentest.md): From €9,500 for a web app and its API over 7 senior days to €15,000 for an AI agent with its tools. Report in week 3; retest and status letter included. - [AI agent security assessment: €3,900, report in 5 working days.](https://pharosone.ai/knowledge/ai-agent-security-assessment.md): Our AI agents attack one agent with its tools, data and memory; an engineer reviews and signs the report: attack success rate, transcripts, AIUC-1 mapping. - [Pharos Radar: monitor AI agent tool calls without a proxy.](https://pharosone.ai/knowledge/pharos-radar.md): Reads the turns and tool calls your agent sends, with no proxy. Per-turn integration stops a flagged call in the same call; the wrapper acts from the next turn. - [Continuous AI agent testing: change tests and quarterly retests.](https://pharosone.ai/knowledge/continuous-testing.md): From €3,000 a month, billed yearly: the agent changes you hand over are attacked before release, and the whole agent is retested each quarter for AIUC-1. - [Pharos Framework: free open-source red teaming for AI agents.](https://pharosone.ai/knowledge/pharos-framework.md): Run 118 attack probes against your own agent, with Wilson intervals and AIUC-1 mapping. Apache 2.0; CI setup and a comparison with garak, Promptfoo and PyRIT. - [Which PharosOne product do I need? Five situations, five prices.](https://pharosone.ai/knowledge/which-product-do-i-need.md) (guide): Audit deadline, new agent, agent in production, weekly releases or a free trial: the PharosOne product, price, time and deliverable for each. ## Threats (4 articles) The attack classes on AI agents, with public incidents, the primary sources, and how each is tested and watched. Shelf: [Threats](https://pharosone.ai/knowledge/threats.md). - [Indirect prompt injection: why system prompts and filters fall short.](https://pharosone.ai/knowledge/indirect-prompt-injection.md): Instructions in documents, email and tool results hijack agents. Where they hide, why a system prompt cannot close the channel, and how to test your agent. - [MCP tool poisoning: how it works, real CVEs and how to defend agents.](https://pharosone.ai/knowledge/poisoned-tool-descriptions-and-memory.md): Poisoned tool descriptions, rug pulls after approval and memory poisoning, with MCPTox and CVE-2025-54136 evidence, the controls that help and how to test. - [Markdown image exfiltration: 7 incidents, their fixes and 5 controls.](https://pharosone.ai/knowledge/data-exfiltration-through-images-and-urls.md): ChatGPT, Bing, Bard, Copilot, GitLab Duo, M365 Copilot: how rendered images leaked data, what each vendor fixed, and five renderer controls to copy. - [Prompt injection alerts: separate the attempt from the execution.](https://pharosone.ai/knowledge/attempt-versus-execution.md): An injected instruction reaching an agent and the agent acting on it are different events. What we measured, why one alert fails, and how to route each. ## Standards (1 article) One crosswalk for AIUC-1, ISO/IEC 42001, the EU AI Act, NIST AI RMF, the OWASP Agentic Top 10, SOC 2 and DORA: what each asks, what to test, the evidence a reviewer expects. Shelf: [Standards](https://pharosone.ai/knowledge/standards.md). - [What AIUC-1, ISO 42001, NIST AI RMF and the EU AI Act ask of AI agents](https://pharosone.ai/research/ai-standards-crosswalk.md) (research portal): Clause and control ids, the tests that produce evidence for each, what a pentest cannot cover, and the EU AI Act dates after the 2026 AI Omnibus. ## Methodology (2 articles) How the probe engine measures agent security, and the studies behind the numbers it reports. Shelf: [Methodology](https://pharosone.ai/knowledge/methodology.md). - [The PharosOne Probe Engine: architecture of a behavioral scanner for AI agents](https://pharosone.ai/research/the-probe-engine-how-we-measure-agent-security.md) (research portal): A behavioral vulnerability scanner built on Inspect AI: what it attacks, how it varies and scores attacks, and how findings map to the AIUC-1 control standard. - [LLM attack rewrites lost to static variants on one AI agent](https://pharosone.ai/research/variation-policies-and-llm-judged-scoring-study.md) (research portal): Five variation policies on one support agent: attack rates with Wilson intervals, a byte-identical noise control, and judge errors checked by a second model. ## Guides (2 guides) Which product you need, and how to prepare for a SOC 2 or DORA pentest when agents are in scope. Shelf: [Guides](https://pharosone.ai/knowledge/guides.md). - [Which PharosOne product do I need? Five situations, five prices.](https://pharosone.ai/knowledge/which-product-do-i-need.md): Audit deadline, new agent, agent in production, weekly releases or a free trial: the PharosOne product, price, time and deliverable for each. - [Scoping a SOC 2, PCI DSS or DORA pentest that includes AI agents](https://pharosone.ai/knowledge/preparing-for-a-soc2-or-dora-pentest-with-ai-agents.md): Which clauses require a pentest and which only expect one, the agent inventory for the scope, and what reviewers look for in the report and the retest. ## Reports (6 reports) Our own data: the AI security market, what a pentest costs, how models and runtime guards compare, and how we audit our numbers. Shelf: [Reports](https://pharosone.ai/knowledge/reports.md). - [What 100 AI security vendors sell in 2026: 13 capabilities counted.](https://pharosone.ai/knowledge/ai-security-market-2026.md): A sample of 100 AI security vendors, 77 of them exhibitors at two European events: who sells guardrails, who tests agents via tools and MCP, who was acquired. - [AI pentest prices in 2026: $3,000 autonomous tests to €20,000 agents.](https://pharosone.ai/knowledge/ai-agent-pentest-cost-2026.md): Dated prices from vendors' own pages: autonomous web pentests at $3,000–4,000, human tests of AI agents at €4,800–20,000, red teams and day rates. - [Which LLMs resist prompt injection as agents: 5 models, 1,470 runs.](https://pharosone.ai/knowledge/which-llms-resist-prompt-injection-in-agents.md): October 2026: Claude Haiku 5.5 and GPT-6 Luna resisted best (8.8%, 11.2%, not separable), Qwen3.5-9B worst (25.2%). A third of runs unlabelled; bounds inside. - [AI agent runtime guards compared: filters, gateways, monitors, hooks.](https://pharosone.ai/knowledge/runtime-guards-compared.md): What each guard sees and stops. A research prototype, not Pharos Radar, cut attack success from 18.3% to 0.1% on one agent and blocked 1.5% of clean messages. - [How AI assistants choose sources: a four-model simulated-search pilot.](https://pharosone.ai/knowledge/how-ai-search-assistants-choose-sources.md): Four API models searched fixed result pools 32 times: they chose pages from title and description, cited 89% of what they opened, and flagged vendor pages. - [Five ways AI security detection numbers mislead, from our own audit.](https://pharosone.ai/knowledge/what-we-retracted-and-why.md): Wrong negative population, wrong configuration, leaked labels, imputed coverage, unfixed averaging: each caught in our audit, with the question that exposes it. ## Notes (1 note) Dated notes on vulnerabilities and events that matter to teams that run agents, with primary sources. Shelf: [Notes](https://pharosone.ai/knowledge/notes.md). - [PHP2Shell: which PHP versions fix it and how to check your servers.](https://pharosone.ai/knowledge/php2shell-cve-2026-109618-109619.md): Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026; source backports for 7.4 to 8.1. Exploitation status and five checks for your servers. ## Glossary (25 terms) Terms of art in one sentence each, with a link to the standard or paper that defines them. [Read the glossary](https://pharosone.ai/knowledge/glossary.md). AI agent · AIUC-1 · Attack success rate · Attempt versus execution · Confidence interval (Wilson) · DORA · EU AI Act · Evidence span · Guardrail · Indirect prompt injection · ISO 42001 · Jailbreak · Judge model · MCP · Memory poisoning · NIST AI RMF · OWASP Agentic Top 10 · OWASP LLM Top 10 · Pentest · Prompt injection · Red team · Retest · Runtime guard · SOC 2 CC4.1 · Tool poisoning ## Start here 1. [Which product do I need](https://pharosone.ai/knowledge/which-product-do-i-need.md): One table: the situation you are in, the product, the price, the time and what you receive. 2. [How Radar works](https://pharosone.ai/knowledge/pharos-radar.md): The conversations and tool calls you send, the verdict per turn or from the next turn, and what a held reply means. 3. [Indirect prompt injection](https://pharosone.ai/knowledge/indirect-prompt-injection.md): Where it hides, why a system prompt cannot close the channel, and a six-step test you can run. Source: PharosOne, "Notes and articles for teams that run AI agents", https://pharosone.ai/knowledge, updated 2026-10-22. --- PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt