AI Security Moves from Model Testing to Runtime and Autonomous Attack Control

The MCP Python SDK OAuth flaw, Mandiant's autonomous-agent attack paths, and OpenAI's September 26 agent-training halt demonstrate protocol, tool, identity, and authorization risks at runtime. Armadin's reported $255.5 million Series B and $2.5 billion valuation provide a major October 2026 market signal for AI-native offensive security and continuous attack-path validation, while leaving differentiation, authorization, safety, and evidence-quality questions open.