Strategic PartnersIssue 106 records
Palo Alto Networks
Nov. 9 brought two Palo Alto framing pieces and two independent checks on them. In an IT Brief byline, VP Jaimin Patel described Claude lifecycle controls: Cortex discovery of coding agents and MCP servers, Prisma AIRS inspection of prompts and MCP tool calls, AI Gateway quotas and agent identity, with no performance data. An independent Nov. 2 arXiv study found MCP tool poisoning succeeded in 22.9% of 9,720 real-execution tests across 12 frameworks and that description scanning blocked only 20 of 45 scenarios. Palo Alto's Digital Contagion blog used the French supermarket refrigeration attacks to argue for machine-speed defense, citing Unit 42's under-72-minute fastest-quartile exfiltration, but its 80°C and loss figures conflict with Unit 42 and French officials. The same day France attributed the October attacks to IRGC-linked Shahid Kaveh (BleepingComputer, NPR), and NPR linked the pattern to U.S. water and food-storage incidents. Palo Alto also announced VM-Series support on the AWS European Sovereign Cloud. No Nov. 8 edition was filed because that scheduled run failed.
- Evidence records
- 6
- Cross-source patterns
- 2
- Evidence classes
- 3 vendor claim2 independent reporting1 academic research
- Outcomes
- 3 emerging3 cautionary
- Source freshness
- 6 new this fortnight
- Research completed
- 2026-11-10
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Palo Alto markets MCP tool-call inspection and skill scanning for Claude while an independent study shows MCP tool poisoning is common and metadata scanning only partly helps
Palo Alto's Nov. 9 byline says Prisma AIRS and Cortex inspect Claude Code prompts, responses and MCP tool calls and scan agent skills, but gives no performance data. The Nov. 2 arXiv study measured MCP tool poisoning succeeding in 22.9% of 9,720 real-execution tests, found no intentional defenses in 12 frameworks, and showed a description scanner blocked only 20 of 45 scenarios. Interpretation: SLED buyers should require runtime poisoning tests in any pilot rather than accept feature lists.
Operating questionBefore approving agent-security tooling, what poisoning and exfiltration tests will the organization run to prove the controls catch attacks in its own agent workflows?
Supporting evidencePalo Alto Networks (vendor-authored byline published by IT Brief US)Farooq Shaikh and Biagio Montaruli (academic preprint, accepted at AISec '26 / ACM CCS 2026)
Palo Alto frames the French refrigeration attacks as an AI-speed supply-chain problem, while French officials describe state-backed sabotage of exposed controllers
Palo Alto's Nov. 9 blog uses the attacks to argue for machine-speed autonomous defense and states figures (80°C, losses in the hundreds of millions of euros) that conflict with Unit 42's 50°C and French officials' tens of millions. The same day, France attributed the October attacks to IRGC-linked Shahid Kaveh, citing device-search reconnaissance of internet-exposed controllers, and NPR linked the pattern to U.S. water and food-storage incidents. Interpretation: for SLED, the first fix is removing OT controllers from the internet, not buying AI speed.
Operating questionWhich refrigeration, water and building controllers are reachable from the internet today, and who owns closing that exposure?
Supporting evidencePalo Alto Networks (blog by Stefano Ciminelli)BleepingComputer (Lawrence Abrams), reporting French government and CERT-FR statementsNPR (Jenna McLaughlin, Rebecca Rosman)
Evidence ledger
Full record · every source keeps its link and limitations
Palo Alto Networks VP Jaimin Patel lays out Claude lifecycle controls: Cortex agentic endpoint discovery, Prisma AIRS prompt and MCP tool-call inspection, AI Gateway and agent identity
A Nov. 9 vendor byline by Palo Alto Networks VP of Product Management Jaimin Patel maps Palo Alto controls onto Claude use in four steps. Discover: Cortex Agentic Endpoint Security finds coding agents, extensions and MCP servers; Prisma Browser and Prisma SASE cover employee workflows. Assess: Prisma AIRS AI Supply Chain Security scans models and agent skills, plus AI Red Teaming. Protect: Prisma AIRS inspects governed prompts through native Claude Enterprise inference hooks and, with Cortex on endpoints, inspects Claude Code prompts, responses, MCP tool calls and supported network interactions; Agent Identity Security issues verifiable agent identities with just-in-time least privilege. Govern: Prisma AIRS AI Gateway applies policy, quotas and rate limits to LLM, MCP and A2A traffic with usage and cost analytics. The piece says Palo Alto teams used frontier Claude models through Project Glasswing to find vulnerabilities earlier models missed. It gives no detection rates, customers or pricing.
Why it matters, evidence and limitations
- Why it matters
- State agencies, universities and research computing groups piloting Claude Code, Claude Enterprise or custom Claude API apps face exactly the scenario described: agents that can read repositories, access secrets and call MCP tools under a user's authority. Interpretation: the piece is a useful control checklist for SLED AI-use policies, but it is a vendor roadmap, not evidence that these controls work in public-sector tenants.
- Evidence and measured results
- Opened and read the full IT Brief page dated Mon 9 Nov 2026 carrying Jaimin Patel's byline and title. All capability descriptions are first-person vendor statements ('our approach'). No metrics, test results, customer names or availability dates are given for the individual integrations.
- Limitations and uncertainty
- Vendor-authored opinion piece on a trade site; no independent validation, benchmarks or SLED customers. Availability and licensing of each integration are not stated. The Glasswing vulnerability claim is not quantified here. Independent research in this edition (arXiv 2611.03555) shows metadata scanning alone only partially blocks MCP tool poisoning.
arXiv 2611.03555 (AISec '26): MCP tool poisoning succeeds in 22.9% of 9,720 real-execution tests across 12 agent frameworks; metadata scanning is only a partial control
The authors measured MCP tool poisoning with real tool execution using an open-source tool (mcpvenom) across a 9,720-cell matrix: 12 frameworks, 18 models and 45 attack scenarios, with a dual oracle that confirms exfiltration through a canary HTTP receipt. Overall attack success was 22.9% (2,113 vulnerable cells). Of those, 64.9% dispatched an attacker tool call, 23.0% contacted the attacker endpoint and 12.1% verifiably exfiltrated a secret. Nine core frameworks clustered at 23–26% (chi-squared 3.30, p = 0.91), so resistance is model-level; model attack success ranged from 0.4% to 49.7%. A regex description scanner rejected 20 of 45 scenarios at a 7.2% false-positive rate. A code audit found no intentional defense in twelve frameworks, and all five coordinated disclosures to four vendors were rejected. It is newly relevant tonight because Palo Alto's Nov. 9 byline markets MCP tool-call inspection and skill scanning.
Why it matters, evidence and limitations
- Why it matters
- SLED developers and research groups wiring agents to MCP servers inherit this risk regardless of framework. Interpretation: the study gives buyers an independent way to test vendor MCP-inspection claims, since it shows scanning tool descriptions alone misses more than half of scenarios.
- Evidence and measured results
- Opened the arXiv abstract page and read the abstract, comments (accepted at AISec '26, co-located with ACM CCS 2026; 12 pages, 9 tables) and submission history (v1, 2 Nov 2026). Full PDF tables were not reviewed in this run; all figures come from the abstract.
- Limitations and uncertainty
- Preprint; peer review status is acceptance at a workshop. Results depend on the 45 chosen scenarios and 18 models. Only the abstract was inspected. It does not test any Palo Alto product. Counts are cells in a lab matrix, not field incidents.
Palo Alto Networks blog uses the French refrigeration attacks to argue for machine-speed defense, citing Unit 42 data that the fastest quartile of exfiltration takes under 72 minutes
The Nov. 9 blog opens with the attack on over 700 French supermarkets, saying it caused six hours of operational paralysis and estimated losses 'in the hundreds of millions of Euros,' and that attackers drove fridge and freezer temperatures as high as 80°C while disabling alarm logic. It argues that frontier AI and autonomous agents let adversaries map and exploit digital supply chains at machine speed, cites SolarWinds, Log4Shell and Mini Shai-Hulud, and warns that vendors ship AI agents through routine updates that executives may not know about. It cites Unit 42 data that the fastest quartile of sensitive data exfiltration now occurs in under 72 minutes from initial compromise, contrasted with SOC triage of at least 15 minutes and containment that can take days. It recommends a unified architecture and autonomous detection and response, and promotes a whitepaper.
Why it matters, evidence and limitations
- Why it matters
- State and local governments rely on the same third-party software and vendor-pushed updates the blog describes, and many SOCs cannot triage at machine speed. Interpretation: the useful SLED takeaway is to inventory AI features arriving through vendor updates; the refrigeration example is not itself evidence of AI-enabled attack.
- Evidence and measured results
- Opened and read the full blog post dated Nov 09, 2026. Compared its incident figures with Palo Alto's own Unit 42 post (as high as 50°C) and with Nov. 9 government attributions reported by BleepingComputer and NPR (tens of millions of euros in food losses).
- Limitations and uncertainty
- Vendor marketing. Internal inconsistencies with other sources: the blog says temperatures reached 80°C while Unit 42 says 50°C, and it says losses were in the hundreds of millions of euros while French authorities, as reported by BleepingComputer, said tens of millions. It implies AI-enabled adversaries but France attributes the October attacks to an IRGC unit without saying AI was used. The 72-minute figure is the fastest quartile, not typical.
BleepingComputer: France attributes October refrigeration attacks on about 700 retail sites to IRGC-linked Shahid Kaveh; November wave not attributed
France's foreign ministry on Nov. 9 blamed the Oct. 11–12 refrigeration-controller attacks on Shahid Kaveh, a unit tied to the IRGC's electronic and cyber center. French authorities said about 700 retail locations were targeted, the attacks caused at least 15 fires and tens of millions of euros in food losses, and the same campaign hit Schneider Electric equipment at small hydroelectric sites with moderate effects. The C4 crisis center, including ANSSI, cited shared infrastructure, use of the FOFA device-search platform, a linked propaganda outlet that publicized the attacks on Oct. 13 and Farsi-language traces. France attributed only the October attacks, not the November wave affecting more than 115 stores across six countries. This updates the Unit 42 Nov. 6 post, which mentioned only unverified hacktivist claims.
Why it matters, evidence and limitations
- Why it matters
- U.S. SLED entities run similar refrigeration and cold-chain controllers in school nutrition, public hospitals, blood and vaccine storage and corrections, and small public utilities run hydroelectric or water OT. Interpretation: a state-backed sabotage attribution raises the priority of removing these controllers from the internet.
- Evidence and measured results
- Opened and read the full article dated November 9, 2026. Attribution facts come from the French ministry statement, the C4 and CERT-FR as quoted; the article links but this run did not separately open the French primary documents.
- Limitations and uncertainty
- Secondary reporting of government statements. Attribution covers only the October French attacks. Not a Palo Alto Networks evaluation; included because it corrects and updates the attacker context used in Palo Alto's Unit 42 and Nov. 9 blog material.
NPR: France calls Iran's fridge attacks its first large-scale cyber sabotage; Paris prosecutors seek arrest warrants as U.S. analogues remain officially unattributed
NPR reports that, according to ANSSI, Iranian military hackers took over refrigeration controllers at around 700 French retail sites and also targeted small hydroelectric plants. Foreign Minister Jean-Noël Barrot called it the first large-scale cyber sabotage on French territory, and the Paris prosecutor's office opened an investigation into Shahid Kaveh and is requesting international arrest warrants. NPR places the attacks in a wider 2026 pattern: grocery stores in Sweden and Ireland hit last week, a French blood bank incident, a spring attack on an Israeli food plant, food spoiled in refrigerators at U.S. military base commissaries over the summer, and August attacks on U.S. water treatment plants that most experts link to Iran. France is the first government to formally assign blame; the Pentagon has made no official statement on the U.S. base incidents.
Why it matters, evidence and limitations
- Why it matters
- NPR's U.S. examples, water treatment plants and food storage, map directly to municipal utilities, school nutrition and public-health cold chains. Interpretation: U.S. SLED operators should not wait for a U.S. attribution before hardening the same controller types.
- Evidence and measured results
- Opened and read the full NPR article dated November 9, 2026 5:30 PM ET. U.S. incident links are NPR's reporting and expert opinion (including Sublime Security's Alex Orleans), not official U.S. attribution.
- Limitations and uncertainty
- Journalism; U.S. links rely on unnamed officials and expert opinion. Not a Palo Alto Networks evaluation; included as independent context for Palo Alto's Unit 42 and Nov. 9 blog framing.
Palo Alto Networks announces VM-Series firewall support on the AWS European Sovereign Cloud for government, healthcare and finance workloads
Palo Alto Networks said the VM-Series virtual next-generation firewall will be fully supported on the AWS European Sovereign Cloud, which it describes as a physically and logically separate EU environment operated by EU residents. The post says VM-Series brings Advanced Threat Prevention, DNS Security and Advanced URL Filtering into the sovereign boundary, integrates with AWS Gateway Load Balancer and keeps Panorama, Terraform and Ansible workflows. It claims inspection and logging stay in-region so no operational metadata or telemetry crosses sovereign borders, and that inspection works when sovereign partitions run detached from global networks. It frames the offering for NIS 2, DORA, BSI C5 and GDPR compliance and names government and healthcare as target sectors.
Why it matters, evidence and limitations
- Why it matters
- Limited relevance for U.S. SLED. Interpretation: the transferable question for U.S. states and universities is whether cloud-delivered security services keep telemetry inside required boundaries, such as AWS GovCloud or CJIS-scoped environments; this post does not address U.S. regions.
- Evidence and measured results
- The direct curl request returned 403; the page was opened through a web-fetch tool and read in full, including the date line 11-09-2026 03:50 PM and author attribution. No independent confirmation or AWS-side listing was checked.
- Limitations and uncertainty
- Vendor announcement; 'will be fully supported' leaves timing unclear. EU-only. AWS is a separate partner stream; included here because the product and claims are Palo Alto's.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Vendor claim
- A supplier-provided assertion that has not been upgraded to independent evidence.
- Independent reporting
- Independent reporting with attributable sources but without a formal evaluation design.
- Academic research
- Research produced through an academic institution or peer-reviewed venue.