Как агент сам откроет дверь хакеру? Разбираю три реальных пробоя AI-агентов и почему обычный ред-тиминг их не найдёт

A new analysis introduced a mode in the open-source scanner BarkingDog to attack LLM-based agent runtimes via their real production-style webhook and tool flows, not just the model responses. The testing against Agno, OpenAI CS Agents Demo, and LangGraph agent-service-toolkit found multiple classes of issues mapped to CVE identifiers in the OWASP ASI taxonomy: ASI03 (Confused Deputy in Agno), ASI08 (Trust Exploitation in LangGraph agent-service-toolkit), and ASI06 (Agentic DoS in OpenAI CS Agents Demo), where the service becomes unresponsive through recursive text prompting. The takeaway is that traditional red-teaming that focuses on prompt/model refusals can miss failures in orchestration, authorization delegation to tools, and runtime resource exhaustion—so agent security requires end-to-end testing.