Agentjacking turns error trackers into an injection vector, GPT-5.6 ships behind a government gate, and Gartner puts agent spend at $206 billion

> ../signals/2026-06-27.md

Five signals from the week of June 22. The theme, if there is one: the industry is discovering that agents are attack surface, and everyone from attackers to regulators to protocol designers is acting on it.

── Signal one · Agentjacking: your error tracker is now an injection vector ──

A new attack class dubbed Agentjacking uses error-tracking output to inject instructions into AI coding agents. The mechanics are uncomfortable in their simplicity: an attacker plants content in an error report, and when an agent like a coding assistant reads that report during debugging, it treats the planted text as instructions and executes them. There is no universal patch, and the recommended mitigation is architectural: treat all error-tracking output as untrusted input and put a human between error reports and autonomous execution.

Signal: This is the first major attack class purpose-built for the agentic era and it validates a principle we keep repeating: tool output is input, and input is untrusted. If your agent reads logs, tickets, or error reports, those channels are part of your threat model. We wrote about this exact failure shape in our tool output hijacking postmortem.

◆ Source: buildfastwithai.com/blogs/ai-news-today-june-22-2026

── Signal two · GPT-5.6 launches behind a government gate ──

OpenAI previewed GPT-5.6 on June 26 in three variants, Sol, Terra, and Luna, available to roughly twenty companies whose participation was approved by the US government, with broader release expected in the coming weeks. The staggered rollout follows government pressure, and OpenAI's own framing leaned heavily on cybersecurity capability: the company argued the model is better at finding and fixing vulnerabilities than at carrying out end-to-end attacks.

Signal: Frontier releases are now a regulatory event, not just an engineering one. For teams building on these APIs, the practical consequence is that model availability can change on political timelines. Pin versions, test fallbacks, and treat "the model got gated" as a failure mode you have engineered against, not a surprise.

◆ Source: axios.com/2026/06/26/openai-gpt-sol-terra-luna-trump

── Signal three · x401: a protocol for proving who authorized an agent ──

Proof launched x401 on June 25, an open protocol for verifying who authorized an AI agent's actions. The idea: online services can request cryptographic proof before an agent buys, signs, publishes, or moves money on someone's behalf.

Signal: Whether or not x401 becomes the standard, the problem it targets is real and getting sharper: as agents act at scale, "was this action actually authorized" becomes an infrastructure question. We solve it today at the application layer with contracts and approval queues. Watch this space, because the layer below us is starting to solve it too. See our approval queue pattern.

◆ Source: agentic.ai/news

── Signal four · Gartner: $206.5 billion on agent software in 2026 ──

Gartner forecasts purpose-built AI agent software spending to hit $206.5 billion in 2026, up roughly 139% from last year, and to climb toward $376 billion in 2027. In the same news cycle, a UC Berkeley benchmark made the rounds showing frontier agents passing only a small fraction of the hardest professional tasks.

Signal: Both numbers are true at once, and that is the whole story of this market. The budget is arriving faster than the reliability. The gap between the two is precisely where engineering discipline lives, and precisely why "it worked in the demo" is not a deployment criterion.

◆ Source: asanify.com/blog/news/ai-agent-software-spending-june-30-2026

── Signal five · ChatGPT drops below half the market ──

Sensor Tower's State of AI report, widely circulated this week, puts ChatGPT's share of the global AI assistant market at 46.4%, the first time under 50%, with Gemini at 27.7% and Claude at 10.3%.

Signal: The assistant market is fragmenting, which for builders is quietly good news: a multi-provider world keeps pricing honest and makes provider-agnostic architecture worth the extra abstraction layer it costs you.

◆ Source: buildfastwithai.com/blogs/ai-news-today-june-22-2026

── End of signal ──

ORBIRESEARCH