A new security study found that four gatekeeper AI models approved 100 percent of crafted prompts that hid malicious instructions inside ordinary prose, even though each model had blocked the same req…
A security analysis argues that vault coverage is the missing metric in non-human identity (NHI) programs, noting that while enterprises can see which machine credentials are vaulted, they cannot meas…
Enterprises with compliance exposure or brand risk should build AI agents on their own sites before deploying in-browser or off-browser agents, InfoWorld columnist argues, citing Anthropic's guidance …
OWASP has updated its list of the top 10 most critical vulnerabilities of LLM applications, with prompt injection and sensitive information disclosure remaining the two most severe threats and excessi…
Parameter AI is promoting autonomous AI agents that continuously pentest code, cloud, and dependencies, arguing that penetration testing cadence matters more than framework choice among PTES, OWASP, N…
Pillar Security documented Deadbugz, a malicious MCP server attributed to GitHub account zellkernel, which targeted 23 GitHub repositories in one evening and breached none. The server evades detection…
Sunil Gentyala's pen-testing guide for GenAI, LLM, and RAG applications emphasizes that prompt injection can manipulate language to reach protected data or trigger unauthorized actions, requiring test…
Three standards bodies—OWASP, NIST, and the Agentic AI Foundation (AAIF)—are independently writing rules for agent infrastructure, converging on a unified stack for authentication, authorization, and …
GitGuardian reported that 28,649,024 new secrets were exposed on public GitHub in 2025, a 34% year-over-year increase and the largest single-year jump recorded, according to Akeyless. The article argu…
Petros Savvakis, in Part 3 of his 'From Prompt to Proof' series ahead of PyCon Greece 2026, demonstrates that letting a prompt injection succeed at the model boundary can still be blocked at the execu…
OWASP's guidance labels tool output as untrusted because fields like ticket bodies, PR descriptions, and CRM notes can be written by outsiders, yet systems such as Jira, GitHub, Salesforce, and Postgr…
Security experts warn that existing controls for human access are insufficient for AI agents, which operate at machine speed and can chain actions into unauthorized outcomes, as seen in recent inciden…
An engineer argues that OAuth tokens alone do not provide an operational identity for AI agents, and that systems need a governed identity model that tracks an agent's lifecycle, authority, and purpos…
Runtime enforcement is crystallizing as a mandatory infrastructure layer for AI agents, with ServiceNow, Microsoft, MintMCP, Citrix, and CrowdStrike converging on a three-layer stack of connectivity, …
Developer Mohamed Saleh has released an open-source AI testing suite designed to stop large language models from rubber-stamping code reviews. The suite forces AI agents through strict phase gates, re…
OWASP launched the Open Automated Security Initiative for Software (OASIS) on August 26, 2026, in San Francisco, aiming to shift open source vulnerability work from 'find and report' to 'find, validat…
Oconee Runtime, a new open-source project by Henry Thomas, provides policy enforcement for browser AI and coding agents, addressing the shift from prompt-based AI to agentic systems that execute actio…
PromptSonar 1.5.1, an execution path analyzer for AI agents and MCP servers, now maps findings to OWASP 2025 Top 10 and ISO/IEC 42001 controls, with a local-first CLI and playground that visualizes so…
A developer outlines a server-rendered authentication design for an edtech app, emphasizing distinct state transitions for session creation, verification, refresh, logout, and phone recovery. The appr…
A security engineering perspective on deploying large language models (LLMs) into production outlines a tripartite architecture for AI guardrails, including input sanitization, model alignment, and ou…