Security and cyber here means the defensive engineering around AI agents and the hardware that runs them, and the mid-2026 literature shows attacks landing reliably on shipping systems while the matching defences remain research prototypes.
Summary
“Security & Cyber” as a technology area currently splits into two very different layers. The upper layer is agentic AI security: LLM agents that read files, call tools, load third-party “skills” and drive browsers, and the guardrails, scanners and policy engines meant to contain them. The lower layer is the classical hardware and cryptographic substrate: post-quantum cryptography (PQC) on embedded devices, homomorphic encryption and trusted execution environments for confidential inference, physical unclonable functions (PUFs) for device identity, information-flow analysis of chip designs, and physical-layer security in radio links.
The upper layer works by interposing a checker between an agent and its environment. Guardrail models classify inputs and outputs, skill scanners vet natural-language plus code bundles at install time, and origin policies restrict data flows. The attack literature from June 2026 shows all three interposition points failing in distinct ways. Harmful goals can be split into individually benign subtasks that each pass refusal checks and cumulatively achieve the objective. Skills that look harmless in isolation become harmful when composed in a shared execution context, with attack success reaching 33.6 per cent on the capability-flow subset of SCR-Bench. Guardrails themselves become the target: crafted payloads trap them in extended reasoning loops, and payloads optimised on one open-source surrogate transfer to eight leading model backbones.
The lower layer is more conventional engineering with measurable results. NIST-standardised PQC signatures are shown to be impractical in pure software on an ARM Cortex-M4, with SPHINCS+ unusable and the reference Dilithium implementation failing to execute at all, while an FPGA number-theoretic-transform accelerator on a Zynq-7000 SoC brings key and signature generation down to millisecond levels. Systolic arrays can be extended to do polynomial multiplication directly for 20 per cent extra area and better than 1.2x lower latency than NTT-based mapping. Device signatures usable as PUF responses have been extracted from 112 commercial DDR4 chips.
The parameters that decide the area are: how fast defensive coverage rates rise from their current single-digit and low-double-digit percentages; whether containment can be enforced structurally (origin policies, hardware-guaranteed privacy budgets, attested TEEs) rather than by asking a model to judge intent; and whether crypto acceleration lands in the silicon that constrained devices actually ship with.
Evidence base
- Open-source skill scanners detect 2-8 per cent and commercial scanners 9-17 per cent of language-and-code cross-modal attacks on agent skills.
- In multi-file workspaces, mean jailbreak attack success against code agents reaches about 75 per cent with 32 per cent of generated attack code runnable; agent wrapping raises attack success by 1.6x.
- Composed skill paths reach 33.6 per cent attack success on the capability-flow subset of SCR-Bench, exposing risks largely absent under isolated evaluation.
- Guardrail denial-of-service payloads optimised on a single open-source surrogate transfer to eight leading model backbones including Claude, GPT and Gemini.
- SPHINCS+ is practically unusable and reference Dilithium fails to execute on an STM32F407G Cortex-M4, while an FPGA NTT accelerator on a Zynq-7000 ZedBoard achieves millisecond-level key and signature generation.
- LLM detectors reach 83 per cent on a hardware security competition benchmark via diff-style syntactic comparison; 10 per cent semantics-preserving obfuscation cuts accuracy by 50 per cent and full obfuscation by 78.6 per cent.
Open questions
- Do the structural defences hold under adaptive attack? SOPGuard and GT-MCP are evaluated against known attack sets; neither source reports an attacker optimising specifically against the deployed defence.
- Can install-time scanning ever close a composition-based gap, given that SCR-Bench shows the harm emerges from path-level state changes across skills rather than from any single artefact?
- Will PQC acceleration reach the constrained MCU class itself, or does the Cortex-M4 result imply an entire installed base that must be replaced with FPGA-SoC or accelerator-bearing parts?
- How much of the reported attack-success and detection literature survives the benchmark-contamination problem that AttackonCTF documents for hardware security competitions?
Assessment drafted 2026-08-31 from up to 18 KB sources using the technology-scorecard framework; scores are a draft read pending review.