Glossary

The vocabulary, in plain English

Every term here came up while reporting the briefing, so every definition is written for someone who has to make a decision about agents, not pass a quiz about them. Three sentences at most, no vendor's framing, no product named as the answer. It grows as the field's vocabulary does.

50 terms in 5 groups. Last updated October 13, 2026.

Each definition has its own link. Use the # beside a term to grab it and point someone at exactly the one you mean.

The basics

AI (artificial intelligence) #: Software that performs tasks that normally require human judgment: reading, writing, classifying, deciding. Today's wave is built on large language models.
LLM (large language model) #: The engine behind modern AI: a model trained on huge amounts of text that predicts language. GPT, Claude, and Gemini are LLMs. You pay for them by the token.
Token #: The unit LLMs read and write, roughly three-quarters of a word. API pricing is per million tokens, which is why AI costs scale with how much your agents read and write, not how often you call them.
AI agent #: An LLM given tools and permission to act (browse, write code, query databases, send messages) in a loop, working toward a goal with limited human supervision. The subject of this newsletter.
Agentic AI #: The umbrella term for systems built around AI agents. When vendors say "agentic," they mean software that takes action rather than only answering questions.
Agent harness #: The scaffolding that runs an agent: the loop, the tools, the memory, and the approval logic wrapped around the model. Benchmarks show containment depends on the harness and model together, not the model alone, so two deployments of the same model can carry very different risk.
Agent skill #: A packaged file of instructions and tool wiring an agent loads to learn a workflow, installed like a plugin. In published testing, poisoned skill files got some agents to run hidden commands in nearly 9 of 10 attempts. Treat skill installs like a software supply chain: scan, allowlist, log.
Agent plugin / extension #: Third-party code an agent loads to gain tools or connectors, installed from a marketplace or repository much as a browser installs an extension. In September 2026 a flaw called Plugin4Shell let a repository owner swap malicious code underneath a version pin in four major coding agents, and one browser extension was shown to hijack the AI assistants in five products. Treat plugins as a software supply chain: review the source, confirm the installed code matches the pin, and allowlist what may install.; Read the explainer
Agentic browser (computer-use agent) #: A browser or desktop driven by a built-in agent that reads pages, clicks, and types for you. Everything on screen becomes untrusted input, which is why zero-click hijacks work against this class. Its risk profile is different from a chatbot with a search tool.
Coding agent #: An agent that writes and runs code inside a developer's environment, inheriting the developer's files, credentials, and repository access. That inheritance is the risk: in 2026 a hijacked coding-assistant session spread the Shai-Hulud worm across about 100 of one company's repositories, and an agent in full-access mode deleted users' home directories through an ordinary bug. Decide up front which modes are allowed, what the agent may reach, and whether its approval prompts can be switched off.
Agent swarm (multi-agent system) #: Many agents running at once and coordinating with each other toward one goal, whether that goal is yours or an attacker's. In 2026 a single actor's hundreds of agents compromised at least 440 installations of PaperCut print software in 48 countries, and OpenAI's research agents exchanged 15,000 or more posts on an abandoned public wiki over about 3 months before anyone noticed. Every message between agents is untrusted input, and a kill switch has to stop the whole swarm, not one agent.

The briefing

Get the briefing these terms come from

New terms land here after they show up in the briefing, usually attached to the news that made them matter. At least once a week, five-minute read, free.

You confirm by email. Unsubscribe in one click.

Protocols and plumbing

MCP (Model Context Protocol) #: The standard way an agent connects to tools and data, often described as "USB for agents." The July 2026 spec made the protocol core stateless, hardened authorization, and moved enterprise features into a formal Extensions framework under vendor-neutral governance. Ask any vendor which spec version they implement; the answer changes how their gateway has to work.
MCP server #: One connector speaking MCP: it advertises tools an agent may call. Each server your team connects is a new door into your systems, which is why MCP security is a category now.
MCP gateway #: A control point that sits between agents and MCP servers. This is where you enforce which agents may reach which tools, log every call, and block malicious instructions hiding in tool output.; Read the explainer
A2A (Agent-to-Agent protocol) #: The open protocol for agents talking to other agents, sitting alongside MCP. It passed 150 member organizations in its first year and now carries Google's payments protocol as a transaction layer. Every agent-to-agent hop is a trust boundary.
AP2 (Agent Payments Protocol) #: The protocol Google created for letting an agent pay for things under signed mandates that record what the human approved, donated in April 2026 to the FIDO (Fast Identity Online) Alliance, the body behind passkeys. Version 0.2 added payments with no human present at the moment of purchase, and a formal analysis of that version found 48 threats across the payment lifecycle, 8 rated high. A valid signature does not guarantee true user intent.
LLM gateway (AI gateway) #: A proxy between your applications and the model providers, the MCP gateway's counterpart one layer down: the central place for API keys, rate limits, spend tracking, and failover across models. That concentration makes it a target: in 2026 an unauthenticated flaw in the Bifrost gateway scored 9.8 out of 10 and let one HTTP request run commands, and a LiteLLM gateway flaw was confirmed exploited in the wild. Patch turnaround on the gateway belongs in the vendor evaluation.; Read the explainer
Model routing #: Automatically choosing which model handles each request. Simple tasks go to a cheap, fast model; a frontier model gets the ones where judgment matters. The single biggest lever on an AI bill.
ACS (Agent Control Standard) #: An open specification from OWASP (the Open Worldwide Application Security Project), published September 1, 2026, for controlling agents while they run: the agent platform exposes 19 hooks at moments such as a tool call about to happen or a skill loading, and an outside policy engine answers each one with allow, deny, modify, ask, or defer. The specification is still at version 0.1.0 (the project's latest release, 0.1.3, came out in October 2026), version 0.2.0 targets March 2027, and no date is set for 1.0. Design against it now; it is not something to deploy yet.; Read the explainer

Access and identity

Permissions #: What an agent is allowed to touch: which files, systems, tools, and actions. The central question of agent governance is who grants these, how narrowly, and who can see what was done with them.
Least privilege #: The security principle that anything, human or agent, should get the minimum access needed for its task and nothing more. Old idea; newly urgent now that agents acquire and chain permissions fast.
Excessive agency #: An agent holding more permissions, tools, or autonomy than its task needs, so one hijack or mistake does outsized damage. It jumped from number 6 to number 3 in the 2026 LLM Top 10 from OWASP (the Open Worldwide Application Security Project), the biggest move on the list. Permission scoping exists to bound exactly this.
RBAC (role-based access control) #: Granting permissions by role ("support engineer") rather than individually. Works for humans; strains for agents, which don't fit neatly into roles and may act on behalf of many users.; Read the explainer
Confused deputy #: A classic security failure in which a program holding more authority than its caller is tricked into using that authority on the caller's behalf, and now the standard shape of an agent attack: a prompt injection reaches an agent with broad permissions and spends them for the attacker. A 2026 study of three popular agent frameworks and the Model Context Protocol's authorization model found that 3 of the 4 had no built-in confinement against it. Make the agent's effective access the intersection of its own permissions and the requesting user's, enforced outside the agent.
Non-human identity (NHI) #: Identity and lifecycle management for software actors such as agents, service accounts, and workloads, rather than people. In a January 2026 survey, 92 percent of IT and security professionals said their legacy identity systems cannot manage AI and NHI risk, and 78 percent have no policy for creating or retiring agent identities. The umbrella term for the gap agents open in enterprise identity.; Read the explainer
Service account #: The classic non-human identity: a machine login used by software. Agents are often bolted onto service accounts today, which hides who actually did what.; Read the explainer
OAuth #: The standard way software gets permission to act on your behalf without holding your password ("Sign in with Google" is OAuth). MCP adopted it so agents authenticate like modern apps do.
Allowlist / denylist #: An allowlist permits only what's explicitly approved; a denylist blocks only what's explicitly forbidden. For agent tools and MCP servers, allowlists are the defensible default.
IAM (identity and access management) #: The systems that decide who gets access to what: directories, single sign-on, permission grants, and the audit trail behind them. Agents land here as a problem because IAM was built around humans who log in, not software that spawns copies of itself.
PII (personally identifiable information) #: Data that identifies a person: names, emails, addresses, account numbers. It matters for agents because an agent given broad data access can move PII somewhere it was never approved to go, which is the event regulators and your customers actually care about.

Risks

Shadow IT / Shadow AI #: Tools employees adopt without approval or oversight. Shadow AI is the current wave: unsanctioned copilots, agents, and API keys doing real work with no inventory, no policy, and no audit trail.; Read the explainer
Prompt injection #: Attacks that hide instructions in content an agent reads, such as a web page, an email, or a code comment. The hidden text hijacks the agent into actions its operator never intended. The signature vulnerability class of the agent era.
Indirect (zero-click) prompt injection #: Prompt injection delivered through content the agent fetches on its own, such as a web page, an email, or a social post. The user clicks nothing and sees nothing. Zero-click hijacks of major AI browsers have been demonstrated with no complete fix known.
Tool poisoning #: Prompt injection hidden in a tool's own description or metadata, the text an agent reads to decide how to use the tool, so the attack arrives with a connector rather than with a document. Researchers named it in April 2025 with a demonstration tool that quietly told the agent to read the user's private login keys, and a 2026 benchmark built on 45 live MCP servers found the most susceptible model followed the poisoned instructions 72.8 percent of the time, with refusal rates under 3 percent across models. Review tool descriptions the way you review code, and alert on any that change after install.
Memory poisoning #: An attack that plants instructions in an agent's persistent memory, skills, or configuration so malicious behavior reactivates later with no new bad input. In 2026 research, 3 planted memory records were enough to hijack an agent's choice of tools in up to 85.9 percent of attempts across 10 different models. Anything an agent keeps between runs is attack surface.
Data exfiltration #: An attacker moving data out through a channel the agent controls, such as a tool call, an image URL, or a crafted link. It is the payoff step of most prompt injection attacks. Blocking the leak channel matters as much as blocking the injection.
Guardrails #: Controls that constrain what an agent can do or say: input/output filters, approval gates for risky actions, sandboxes, spending limits. Defense in depth, because no single guardrail holds.
Human-in-the-loop (HITL) approval gate #: A control that pauses an agent before a risky action and asks a person to approve it; HITL is the shorthand for human in the loop. It fails in three documented ways: the operator turns it off, as with the Hermes agent an attacker ran inside Thailand's finance ministry in 2026 in its YOLO (you only live once) mode, which disables approval prompts; the approver clicks yes by reflex after too many prompts, known as approval fatigue; or the screen shows one action while the system runs another, known as Loopjacking. An approval gate is only a control if the agent cannot reach the setting that turns it off.
Loopjacking #: An attack, named in a September 2026 paper, in which a human approves what they understand to be one operation and the system executes a materially different one, either because the approval screen misrepresented the action or because the action was swapped after approval. Researchers reproduced it against Agno AgentOS, a LangGraph Agent Server configuration, and OpenClaw, while OpenAI's Agents SDK (software development kit) blocked the tested version because it binds each approval to the exact call. Before trusting an approval step, verify that the screen renders the exact operation that will run, not a cached or editable stand-in.
Sandbox #: An isolated environment that limits what an agent can touch while it works. Escapes are documented reality, not theory: OpenAI models broke out of a test sandbox and reached Hugging Face infrastructure in July 2026, and a flaw disclosed in September 2026 in DeepSeek Harness let a coding agent switch off its own sandbox with one unauthenticated call. Check egress rules, network reach, and whether the agent can reach the setting that turns the sandbox off.
Evaluation environment (test harness) #: The sandboxed setup in which a lab or red team runs an agent against mock targets to measure what it can do, often with safety guardrails deliberately switched off. Between July and September 2026, OpenAI, Anthropic, Meta, and Google each disclosed that agents under evaluation had reached real companies' systems, and the cause was repeatedly the environment, such as a test domain that matched a live one, rather than the model defeating containment. Before buying agentic red-team work, ask for proof of network isolation rather than an assurance.; Read the explainer
Containment #: Bounding what a misbehaving or hijacked agent can reach, through network egress rules, identity scope, and kill switches, rather than only steering its behavior with guardrails. It assumes guardrails will sometimes fail. The September 2026 discovery of agents coordinating on an abandoned public wiki made it the operative word of the beat, and in October 2026 Anthropic cut every one of its internal evaluations off from the live internet.; Read the explainer
Reward hacking #: A model meeting the letter of its goal by a route nobody intended, such as hunting down a benchmark's answer key or slipping past a restriction that stood between it and the reward. In October 2026 Anthropic linked a series of its agents' unsanctioned actions on real websites partly to training environments that reward workarounds, and OpenAI's models had broken out of an evaluation in July while going after a benchmark's answers. Treat it as a containment problem: an agent rewarded for results will use whatever path its environment leaves open.; Read the explainer
Audit log #: The tamper-resistant record of every action an agent took, tool calls and access included. If you can't reconstruct what an agent did last Tuesday, you don't govern it.
CVE / KEV #: A CVE (Common Vulnerabilities and Exposures entry) is the public identifier for a disclosed software flaw. KEV is the Known Exploited Vulnerabilities catalog from CISA (the US Cybersecurity and Infrastructure Security Agency), listing the CVEs attackers are actively using, with fix deadlines for US federal agencies. Agent-stack CVEs now land weekly: 2026 brought two flaws with the maximum 10.0 severity score, in the Ruflo agent harness and in Azure AI Foundry, and a LiteLLM gateway flaw joined the KEV list in September.
AIVSS (AI Vulnerability Scoring System) #: Severity scoring for AI vulnerabilities from OWASP (the Open Worldwide Application Security Project), in the mold of CVSS (the Common Vulnerability Scoring System) for traditional software flaws; the version shipped so far scores agentic risks specifically. Version 0.8 landed on March 19, 2026, public review of version 1.0 closed on October 1, and publication is slated before the end of 2026. Auditors already publish crosswalks to it.; Read the explainer

Cost

Cost optimization (AI spend governance) #: Knowing what your agents and models cost, who's spending it, and whether the same work could run cheaper. In practice that means budgets, caps, alerts, and routing policies for AI usage.
FinOps #: The discipline of managing cloud spend as an engineering practice. AI spend is becoming its fastest-growing line item, with worse visibility than compute ever had.
Hard spend cap #: A budget limit enforced at the API or gateway that stops the run when the money runs out, as opposed to a dashboard alert that reports after billing. Google, OpenAI, and AWS all shipped cap features in 2026, but they differ in the details: Google's enforces after a delay of about 10 minutes and bills the overage, and AWS's pause-at-limit setting began as a limited rollout in September. Read the fine print on the word cap.
Prompt caching (cache hit) #: A provider feature that stores the unchanged opening portion of a prompt, such as the system prompt, the tool list, or a long conversation history, so repeat requests reuse it instead of paying to process it again; each reuse is a cache hit. Cache hits bill at a fraction of the normal input price (10 percent is the common multiplier, and some newer models go lower), and in long agent sessions the same context is re-sent on every turn, so cached tokens can dominate the input bill. When comparing models on price, check the cache-hit rate your workload actually gets before trusting the headline input and output numbers.

Missing a term? Email [email protected] and it gets considered for the next update. Corrections are welcome at the same address.

New to all of this? Start with why agents need a permission layer, then see who sells what on the vendor landscape map.

Want more than a definition? The explainers take one of these terms at a time and answer it in full, with the incident or number behind each claim.