Threat modeling AI applications

Collection of Microsoft Security Blog posts (Feb 2026) focused on AI/agent-era security and developer-targeting threats. Key highlights: guidance for threat modeling probabilistic and agentic AI systems; a developer-targeting campaign using malicious Next.js repositories that chains build-time RCE into staged C2; risks from self-hosted agents (OpenClaw-like) requiring identity, isolation, and runtime governance; common agent misconfigurations with Defender detections and Copilot Studio mitigations; research on fragmented SOC costs and recommendations for AI-ready SIEM and exposure management;