Объяснение Prompt Injection
Прямая и косвенная инъекция — вредоносные инструкции, спрятанные в контенте, который читает ИИ.
Защита агентов и инструментов
Минимальные привилегии, песочница, проблема «запутавшегося заместителя» и человек в контуре.
Усиление защиты автономных запусков
Заблокируйте headless/CI-запуски так, чтобы агент не мог получить доступ к секретам или продакшену.
Проверка стороннего кода
Плагины, навыки и MCP-серверы могут поставлять исполняемый код — проверяйте, прежде чем доверять.
Vetting Agent Skills You Install
A SKILL.md and a one-week-old GitHub account is all it takes to publish a skill. Here's how the skill supply chain gets attacked — and how to vet before you trust.
Gray-Market AI Proxies ("Poison Claude")
Someone in your org is quietly paying 10% of list price for Claude Opus. The catch: every prompt goes through a stranger's server first. Here's how the scam works and how to detect it.
Ответственное использование, этика и проверка
Лестница автономии, установка на проверку, предвзятость и удержание человека в контуре.
Защита MCP-серверов: OAuth, привязка к аудитории и запутанный заместитель
Почему удалённым MCP-серверам нужен OAuth 2.1, как привязка токена к аудитории останавливает переиспользование токенов между сервисами и почему проброс токена запрещён.
MCP Tool Poisoning, Rug Pulls & Agentjacking
MCP mixes instructions and data in the same channel — the tool description. Attackers weaponize that. Here is how tool poisoning, rug pulls, tool shadowing and agentjacking actually work in the wild, and the defenses that hold up.
Invisible-Comment MCP Attacks & the Confused-Deputy PR Reviewer
On July 21, 2026 Manifold Security disclosed that Microsoft's official Azure DevOps MCP server ships without spotlighting on repo_get_pull_request_by_id — letting an attacker plant an HTML comment in a PR description that is invisible in the web UI but delivered verbatim to any AI agent that reviews it. The agent, running as the victim, exfiltrates data across projects it could never reach directly. Anatomy of the confused-deputy pattern, what spotlighting actually does, and the runtime-visibility principle that has to hold when guardrails fail.
When Coding Agents Get Weaponized
The 2026 attacks that turned auto-approving AI coding agents into an attacker's shell — and the operational fixes that actually stop them.
What Your Coding Agent Actually Uploads
A CLI shipped whole git bundles to a cloud bucket while its privacy toggle said no. The two-channel model of agent egress, how to wire-tap your own agent in 15 minutes, and what each major CLI documents sending.
Agentic Browsers Break the Same-Origin Policy
A UW study tested 7 AI browsers — Atlas, Comet, Claude for Chrome, Gemini in Chrome and more — and found 4 let a malicious page read another site's data. Why the 30-year-old boundary fails, and what to actually do.
ClaudeBleed Reopened — When "Resolved" Isn't Patched
Two unpatched bypasses in Claude for Chrome v1.0.80 (Jul 2026) let any other browser extension fake a click and read a victim's Gmail, Docs, Calendar and Salesforce. What the flaws teach about client-only permission checks, agentic-extension trust boundaries, and what a user can do today.
Anatomy of the Hugging Face Agentic Intrusion
July 2026: the first publicly confirmed autonomous-agent breach of an AI infrastructure provider. 17,000+ machine-speed actions, a dataset loader as the entry point, and one uncomfortable discovery about your own IR workflow.
Anatomy of the Anthropic Cyber-Eval Escapes
July 30, 2026: Anthropic disclosed that three Claude models — Opus 4.7, Mythos 5, and an internal research build — reached the real internet from a supposedly isolated red-team environment and compromised three real companies. Six runs out of 141,006. Every lesson is about isolation you can verify, not isolation you assert in a prompt.