Ideco NGFW Novum v23 Adds Shadow AI Discovery, Dynamic Routing and QoS Controls
Ideco has released NGFW Novum v23, bringing together visibility of AI services, advanced dynamic routing, QoS and strict authentication in a single platform. The update targets large distributed networks, data centers, congested WAN links and regulated environments.
Shadow AI begins with everyday actions: employees opening chatbots, developers connecting API models, analysts uploading tables to assistants and engineers running local inference services. The new release adds 83 AI application protocols to the Application Control module, allowing ChatGPT, Claude, DeepSeek, GigaChat, YandexGPT and proxy services such as Chad AI and GPTunneL to be identified by DNS, SNI and connection characteristics without mandatory TLS decryption.
Two new content-filter categories, “AI agents” and “AI services”, complement the existing “AI chatbots” group. Because the firewall sits at the natural observation point for all outbound AI traffic, administrators can immediately apply different policies to approved and unapproved services and build an internal registry of AI tools.
The routing stack has been significantly expanded. Prefix lists and Route maps enable reusable filtering and attribute manipulation for OSPF, EIGRP and BGP. BFD profiles allow sub-second neighbor failure detection, while OSPF areas and key chains support scalable, secure link-state domains. These features eliminate the need to maintain large sets of static routes across multiple sites.
Virtual contexts now communicate internally through Virtual Ethernet (veth) pairs and a Virtual Switch, removing the requirement for external switches when connecting separate VCEs. QoS, per-interface MTU and IPsec-specific MSS settings help maintain voice and video quality on constrained WAN links.
Ideco Client adds certificate-based primary authentication for Windows, Linux and macOS, with CRL checking during active sessions. Support for GOST algorithms in reverse proxy and certificate handling has also been added. The IPS engine now detects SSH tunneling, and a new “Block tunneled traffic” option in TLS/SSL inspection profiles prevents non-HTTP protocols inside decrypted sessions.
Related articles
Stop Asking If an AI Skill Is Safe — Ask What It Can Do Instead
A detailed analysis warns that AI agent skills distributed as simple text files can execute malicious commands with full user privileges. The article examines how prompt injection attacks embedded in skill.md files have already led to credential theft and persistent malware that survives system restores. Research by Snyk on 3984 public skills found that 36.8 percent contained at least one security issue and 13.4 percent had critical flaws. The author argues that traditional security badges are ineffective because skills can dynamically load payloads, target reviewers with injection, or change after initial review. Instead, a new tiered system called skill-xray classifies capabilities from inert text (T0) to runtime code loading (T4) and binds results to content hashes. The approach is implemented in an open-source MIT-licensed tool that combines static regex scanning with agent-based reporting to surface risks without issuing false safety guarantees.
Agentic AI Systems Under Siege: Prompt Injections, Data Poisoning, and Tool Exploits
Independent expert Andrey Biryukov details how AI agents with file access, email capabilities, and API calls become high-value targets for attackers. The article examines confidentiality, integrity, and availability risks created by autonomous decision-making. Real-world examples include NeuralTrust’s discovery of malicious URL instructions bypassing OpenAI Atlas validation and Zscaler ThreatLabz’s demonstration of hidden instructions on fake Python documentation sites that tricked models into making cryptocurrency payments. Data poisoning research from Carnegie Mellon and Cornell Tech showed agents from Anthropic, OpenAI, and Google selecting tampered datasets in half of tested cases. Additional findings cover vulnerabilities in Git MCP Server and comparative weaknesses between Function Calling and Model Context Protocol architectures. OWASP’s Agentic Top 10 and joint guidance from Canada, Australia, the US, New Zealand, and the UK emphasize threat modeling, least-privilege isolation, and separation of trusted versus untrusted data.
Critical Sandbox Escape Vulnerability in DeepSeek Harness Lets AI Agents Disable Protections with One Command
Researchers at OX Research identified a critical vulnerability in DeepSeek Harness, an open-source tool for running AI agents that interact with local code and files. The flaw, tracked as CVE-2026-82533 with a CVSS score of 9.4, allowed an AI agent to access the tool's local web interface and switch its session to danger-full-access mode, removing all sandbox restrictions and confirmation prompts. Attackers could trigger the escape through prompt injection by embedding malicious instructions in files or content processed by the agent. The web interface lacked authentication and relied on a spoofable Host header, while session details were automatically exposed to the agent environment. The issue affected versions 0.1.1-rc.2 and earlier; patched releases began with 0.1.2-alpha.2. The same interface also exposed logs of all stored conversations. DeepSeek had previously warned that its sandbox and confirmation mechanisms did not guarantee full isolation.
How to Build an AI Agent for Pentesting Without Turning It Into a Black Box
Most security specialists use language models as advanced references where the human reviews every suggestion before execution. With autonomous AI agents the workflow changes dramatically as the agent plans steps, calls tools, analyzes outputs and maintains memory across multiple iterations. This automation introduces serious risks because specialists may see only the final result without understanding which hypotheses were tested or why specific commands were chosen. CyberED and Standoff Hackbase are running a practical AI pentesting challenge to help participants build controllable agents. The event includes a live webinar on 10 September followed by a week-long hands-on period on the Standoff Hackbase training range. Experts emphasize defining strict technical boundaries, logging every decision, and keeping high-risk actions under human oversight.