Tags
13 posts
A security check that finishes successfully can still leave no results. When the result files are missing, a zero score means "not measured," not "no risk," so teams need a storage rule before they adopt any scoring tool.
I ran a prompt-injection regression suite on my LLM pipeline. A naive guard caught 2 of 11, a structural guard caught all 11, and it flagged my own regression.
WebMCP shipped as a Chrome 149 origin trial, but its API already moved: navigator.modelContext is now document.modelContext and provideContext is gone.
Anthropic's npm packaging error exposed Claude Code's full source. Agent loops, memory systems, cost optimization — what developers can learn from 510K lines.
MCP has crossed 97 million monthly downloads and become the de facto standard, but there is no control layer governing which tools agents call and how often. The MCP Gateway pattern addresses this gap.
Deep analysis of the LiteLLM supply chain attack on PyPI: dependency vulnerabilities, malicious package detection, and a defense checklist for AI engineering teams.
According to the GitGuardian 2026 report, repositories using AI coding tools leak secrets at twice the GitHub average. Over 24,000 credentials were exposed in MCP config files alone.
Announced at GTC 2026, NVIDIA NemoClaw is an open-source reference stack for running OpenClaw safely in enterprise environments. A look at its realistic limitations and possibilities in alpha stage.
70% of enterprises run AI agents in production, yet 80% cannot see what they do. What identity dark matter is, why risk compounds, and 5 controls to apply now.
Analysis of the RoguePilot vulnerability found in GitHub Codespaces, passive prompt injection risks in AI coding tools, and security guidelines for engineering teams.
The MCP attack surface is expanding fast. Here's an analysis of 30 CVEs, a three-layer attack model, and an enterprise security hardening checklist for engineering leaders.
Understanding NIST AI Agent Standards Initiative and an actionable security checklist for Engineering Managers to strengthen AI agent security within their teams.
Hidden prompt injection telling AI reviewers what to write was found in ICML submission PDFs. We analyze the attack and the risks of AI-dependent peer review.