This issue highlights the challenge of aligning an LLM’s “latent ontology” with a company’s “structural ontology” to avoid agent errors, and warns that unmanaged shadow AI magnifies existing governance and security gaps. It also covers Zscaler’s new zero-trust platform for AI agents, Salesforce’s acquisition of m3ter for usage-based billing, and Ivanti’s patch for Sentry vulnerabilities.

Attackers are exploiting CVE-2026-5027, a path traversal bug in Langflow’s file upload API, to write arbitrary files on exposed servers without authentication. The flaw, caused by unsanitized filenames, was patched in langflow-base 0.8.3 and Langflow 1.9.0 (upgrade to 1.10.0).