Prompt Injection Explained
Direct and indirect injection — malicious instructions hidden in content the AI reads.
Securing Agents & Tools
Least privilege, sandboxing, the confused-deputy problem, and human-in-the-loop.
Hardening Autonomous Runs
Lock down headless/CI runs so an agent can't touch secrets or production.
Reviewing Third-Party Code
Plugins, skills and MCP servers can ship executable code — review before you trust.
Vetting Agent Skills You Install
A SKILL.md and a one-week-old GitHub account is all it takes to publish a skill. Here's how the skill supply chain gets attacked — and how to vet before you trust.
Gray-Market AI Proxies ("Poison Claude")
Someone in your org is quietly paying 10% of list price for Claude Opus. The catch: every prompt goes through a stranger's server first. Here's how the scam works and how to detect it.
Responsible Use, Ethics & Verification
The autonomy ladder, the verification mindset, bias, and keeping humans in the loop.
Securing MCP Servers: OAuth, Audience Binding & the Confused Deputy
Why remote MCP servers need OAuth 2.1, how token audience binding stops cross-service token reuse, and why token passthrough is forbidden.
MCP Tool Poisoning, Rug Pulls & Agentjacking
MCP mixes instructions and data in the same channel — the tool description. Attackers weaponize that. Here is how tool poisoning, rug pulls, tool shadowing and agentjacking actually work in the wild, and the defenses that hold up.
Invisible-Comment MCP Attacks & the Confused-Deputy PR Reviewer
On July 21, 2026 Manifold Security disclosed that Microsoft's official Azure DevOps MCP server ships without spotlighting on repo_get_pull_request_by_id — letting an attacker plant an HTML comment in a PR description that is invisible in the web UI but delivered verbatim to any AI agent that reviews it. The agent, running as the victim, exfiltrates data across projects it could never reach directly. Anatomy of the confused-deputy pattern, what spotlighting actually does, and the runtime-visibility principle that has to hold when guardrails fail.
When Coding Agents Get Weaponized
The 2026 attacks that turned auto-approving AI coding agents into an attacker's shell — and the operational fixes that actually stop them.
What Your Coding Agent Actually Uploads
A CLI shipped whole git bundles to a cloud bucket while its privacy toggle said no. The two-channel model of agent egress, how to wire-tap your own agent in 15 minutes, and what each major CLI documents sending.
Agentic Browsers Break the Same-Origin Policy
A UW study tested 7 AI browsers — Atlas, Comet, Claude for Chrome, Gemini in Chrome and more — and found 4 let a malicious page read another site's data. Why the 30-year-old boundary fails, and what to actually do.
ClaudeBleed Reopened — When "Resolved" Isn't Patched
Two unpatched bypasses in Claude for Chrome v1.0.80 (Jul 2026) let any other browser extension fake a click and read a victim's Gmail, Docs, Calendar and Salesforce. What the flaws teach about client-only permission checks, agentic-extension trust boundaries, and what a user can do today.
Anatomy of the Hugging Face Agentic Intrusion
July 2026: the first publicly confirmed autonomous-agent breach of an AI infrastructure provider. 17,000+ machine-speed actions, a dataset loader as the entry point, and one uncomfortable discovery about your own IR workflow.
Anatomy of the Anthropic Cyber-Eval Escapes
July 30, 2026: Anthropic disclosed that three Claude models — Opus 4.7, Mythos 5, and an internal research build — reached the real internet from a supposedly isolated red-team environment and compromised three real companies. Six runs out of 141,006. Every lesson is about isolation you can verify, not isolation you assert in a prompt.