» Tag
ai-security
29 postsMCP Security Needs Four Layers, Not Just a Gateway
Why MCP security requires four separate control layers beyond the gateway, backed by real CVEs and practical production controls.
Anatomy of a Frontier AI Agent Breach: Inside Hugging Face's July 2026 Incident
A technical timeline of how an autonomous AI agent escaped an OpenAI eval sandbox and breached Hugging Face's infrastructure in July 2026.
Securing AI Agents: From Trust to Containment
As AI agents shift from passive models to autonomous actors, the security perimeter moves inward. A look at OWASP-aligned risks and containment strategies.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comShut-down AI prompt firewall startup open-sources model and 13K attacks
A failed AI-firewall startup open-sources its two-stage prompt-injection detector, DeBERTa model, and 13,230 real jailbreak attempts.
GhostCommit: the image-based exploit AI code reviewers miss
GhostCommit hides malicious instructions inside PNG images to bypass AI code reviewers like Cursor Bugbot and CodeRabbit undetected.
APPA Framework Cuts Prompt Injection Leaks in LLM Agents Near Zero
APPA is a new IFC framework that slashes prompt injection attack success in LLM agents to 0-7% while preserving most task utility.
How a Benchmark Turned an MCP Security Proxy From 9% to 63%
An open benchmark shows how the mcp-bastion MCP security proxy grew from 9% to 63% attack-surface coverage through iterative testing.
Building an AI that pentests your AI, with proof required
An engineer built an adversarial LLM harness that only reports proven exploits against a live agent, replacing vague 'might be vulnerable' pentest reports with deterministic, oracle-verified findings.
Agentic AI Economics: Why Unconstrained Autonomy Costs More
Agentic AI deployments are overspending and creating security holes by treating rigid business workflows as open-ended reasoning tasks.
I Red-Teamed My Own LLM Security Gateway: Every Gap, Four Passes
An engineer red-teamed his own LLM security proxy across four passes, exposing secret-leak and prompt-injection gaps — including one still open in streaming.