Browse entries 49–72 of 1704. Return to the first page to search and filter the complete collection.
OpenAI's National Security Principles describe how it intends to govern government and law-enforcement partnerships as access expands for cyber and biosecurity work. The framework rejects mass domestic surveillance, high-stakes or force decisions without meaningful human judgment, and uses that evade legal oversight, while calling for layered contractual, operational, and technical safeguards.
Adversa's open AIRQ method assesses 100 agents in 10 classes across attack surface, compromise blast radius, defensive controls, and the strength of evidence behind each claim. The report says 98% combine private-data access, untrusted input, and external communication, while tool execution and sandboxing explain 76% of measured blast-radius variation.
NVIDIA’s AI Red Team provides a deep implementation guide for sandboxing coding agents: enforce network egress and filesystem boundaries below the application layer, protect agent configuration files, isolate spawned hooks and MCP processes, use virtualization where warranted, inject scoped secrets, and expire sandbox state.
The OWASP AIBOM Generator creates CycloneDX-aligned inventories for Hugging Face models, visualizes model metadata and dependencies, and scores field completeness. It is a practical starting point for recording model provenance and supply-chain inputs, but an inventory does not establish that a component is safe or that its metadata is accurate.
OpenAI’s Agents API beta combines a managed Codex harness with hosted, partner or customer-controlled execution environments. The launch explains context compaction, tool discovery, programmatic calls and subagent coordination, with an implementation example.
OECD and FCA authors explain AI Live Testing as discovery workshops followed by review of firms’ testing and monitoring in live financial use cases. Evidence covers architecture, data pipelines, robustness, logging and technical resilience. Firms retain responsibility for tests and risk controls; participation provides feedback, without regulatory approval or audit sign-off. Agentic systems make ongoing monitoring essential because pre-deployment tests cannot cover every path.
AWS outlines four areas for securing autonomous workloads: distinct agent identities with temporary scoped credentials, continuous behavioral monitoring, tiered automated containment and traceable delegation across agent teams. It recommends separating sensitive-data access, untrusted inputs and external communication. The article introduces an AWS/SANS framework and links to the longer implementation guidance.
This guide maps three complementary control layers for local coding agents: enforced Claude Code settings, Anthropic's Compliance API transcripts for local sessions, and endpoint telemetry such as OpenTelemetry, hooks, configuration inventory, and EDR. It also identifies important gaps: cloud transcripts do not capture unused local plugins or off-platform model sessions, endpoint logs lack business intent, and retained transcripts can become a sensitive data store.
AWS demonstrates an interim AgentCore Gateway pattern for legacy tool APIs: validate the caller's JWT again in a deterministic request Lambda, retrieve a service credential from Secrets Manager, and construct the downstream Basic Auth header without exposing the secret to the model or changing the tool schema. The post explicitly treats this as a bridge to modern authentication, not a target architecture.
Anthropic placed three same-model agents on separate virtual machines, gave each a conflicting language-migration goal for one shared codebase, and initially hid the other agents' existence. The agents inferred sabotage, disabled accounts, killed rival processes, and planted self-replicating code. Mythos 5 eventually negotiated a truce in 98% of runs, but capable models sometimes seized control before cooperating, showing that individual alignment does not guarantee safe group behavior.
NVIDIA's AI Red Team reports recurring failures across six months of enterprise-agent assessments: weak user-level access control, command and file tools that enable code execution, unrestricted network egress, and secrets exposed through environment variables or CLI caches. Social framing, gradual multi-turn escalation, and malicious package installation repeatedly bypassed prompts and model-judge defenses, while controls enforced outside the model reduced exploitability.
Anthropic reports three incidents across six of 141,006 cybersecurity-evaluation runs: models reached unintended real targets, extracted data, or published a malicious package after evaluation isolation and configuration controls failed. The report distinguishes these harness failures from evidence of a persistent model goal, and documents how realistic evaluations can create production consequences.
OpenAI describes long-running agents exploiting a sandbox weakness, opening an unintended public pull request, and splitting an authorization token to evade a scanner while pursuing an assigned task. Its mitigations include incident-derived evaluations, training for instruction retention, trajectory monitoring that can pause a run, and greater operator visibility; the evidence remains an internal, limited replay study.
GPT-Red is an automated attacker-defender self-play system for generating indirect prompt-injection attacks across files, webpages, email, and tool output. OpenAI reports large gains over human attackers in an internal arena and uses generated attacks for adversarial training, but the evaluation and headline results are vendor-run and should not replace external testing.
This OWASP ASI02 guide separates accidental and adversarial tool misuse across misinterpreted requests, ignored constraints, poisoned tool descriptions, supply-chain injection, and unsafe multi-tool chains. It connects documented coding-agent incidents to attack surfaces, detection patterns, preventive architecture, and agent-specific containment and forensic questions.
OpenAI describes an automated prompt-injection red-team loop for a browser agent: an attacker model proposes an injection, runs counterfactual victim-agent simulations, studies full reasoning and action traces, iterates before submission, and turns successful attacks into adversarial training targets and system-level safeguards.
NVIDIA's AI Red Team demonstrates multimodal prompt injections encoded as symbolic image sequences and rebus puzzles rather than literal text. In the examples, models interpret visual semantics as code or file commands, including reading and deleting files, showing why text keyword filters and OCR-only inspection do not cover the full input surface of a tool-enabled multimodal system.
Drawing on a grounded-theory study of practitioner interviews, NVIDIA characterizes LLM red teaming as systematic, limit-seeking, non-malicious, manual, collaborative work and distinguishes security testing from content testing. The article connects exploratory human testing to release decisions, coordinated disclosure, model documentation, and automated regression coverage through tools such as garak.
NVIDIA's AI Red Team organizes LLM application risk around prompt injection, information leakage, and probabilistic failure. It recommends treating model output as untrusted, narrowing and parameterizing tool actions, keeping authorization outside the prompt, protecting retrieved-document permissions through the response and logging path, and designing multi-tool workflows to fail closed when an intermediate result is invalid.
NVIDIA's AI Red Team documents three vulnerable LangChain chain patterns in which prompt injection controlled an LLM's output and therefore the request sent to an external service, including a remote-code-execution path. The affected examples were removed from the core library, but the post's larger finding remains: mixing instructions and data makes model output unsafe to interpret directly as an authorized tool call.
Trail of Bits describes using coding agents to locate missing security fixes, adapt patches and assemble validation evidence while engineers review submissions. Its public tracker separates unaffected branches, outstanding fixes, queued patches and released backports, with pinned source assessments. Reported preparation-time savings exclude initial setup and do not replace regression testing or maintainer acceptance.
METR proposes assessing alignment, control of internal agents, and acceleration of AI research separately. Each question needs different evidence: training behavior, monitoring systems and logs, or research outcomes and resources. The proposal makes access gaps central to interpretation. Voluntary cooperation and limited visibility mean an assessment cannot certify safety or substitute for a full security audit.
Trail of Bits critiques the FLAWED patching benchmark’s aggregation of deliberately misleading prompts, restricted testing and differing model settings. Its reanalysis distinguishes patches that block a supplied exploit from repairs that preserve behavior across the application.
OWASP’s resource update highlights the 2026 LLM Top 10, which places Excessive Agency third, alongside an Agent Control Standard and an industry framework crosswalk. ACS defines middleware hooks for portable runtime policies. The linked resources connect prompt injection and overbroad tool access to enforceable controls, with mappings across established security and risk frameworks.