AI Engineering

The Defender’s Window

Why it ranks: manually reviewed for hands-on depth; directly applicable to AI security practice; demonstrates an actionable operational method.

OpenAI describes a staged program for AI-assisted defense: use agents to review code and infrastructure, triage alerts, enumerate attack paths, and validate security invariants while retaining strong isolation and least privilege. Its recommended rollout starts with internet-facing services and vulnerability backlogs, moves security review into CI, requires focused fixes and regression tests, and expands from read-only triage to narrowly bounded automation only after teams build evidence and confidence.

Now in preview: Find and fix software vulnerabilities with CodeMender

Google opened a preview of CodeMender, an AI code-security agent delivered through Gemini Enterprise Agent Platform and AI Threat Defense. It is designed to inspect code, identify and validate potentially exploitable defects, and produce targeted fixes, with Google’s specialized Gemini 3.5 Flash Cyber model initially restricted to governments and trusted partners.

Piloting the world's first double-blind AI evaluations

Google DeepMind, Singapore's AI Safety Institute, OpenMined, AVERI, and MLCommons are piloting an external evaluation in a confidential-computing environment. The evaluator's hidden tests and Google's Gemini Flash Lite weights remain private from one another, reducing benchmark contamination without transferring either sensitive asset.

OpenLeash Adds a Human Check to Risky AI Agent Actions

SecurityWeek profiles OpenLeash, an authorization layer that evaluates proposed agent actions and can block them or request human approval. The project’s public repository provides a personal runtime using agent hooks and provider traffic, with a decision engine, local history and desktop integration. Its hosted business control plane is outside that repository. Public implementation materials make it inspectable, while the profile offers no independent efficacy benchmark.

Extend Amazon Bedrock Guardrails to Tool Interactions Using the Strands Agents SDK

AWS extends Bedrock Guardrails beyond model input and output with three Strands lifecycle checkpoints: inspect inbound user or retrieved content, validate tool arguments before execution, and inspect tool results before they re-enter the model or leave the system. The implementation mixes service guardrails with lower-latency schema, regex, and allowlist checks.

Securing the future of AI agents

Google DeepMind frames increasingly capable agents as potential insider threats and proposes an AI Control Roadmap that combines access controls with supervisors that inspect plans, reasoning, and actions. Its internal prototype analyzed one million coding-agent tasks, but most flags reflected mistakes or overreach rather than adversarial behavior, making this a control design and measurement guide rather than proof of solved monitoring.

NVIDIA AI Red Team: An Introduction

Why it ranks: manually reviewed for hands-on depth; directly applicable to AI security practice; strong implementation or testing value.

NVIDIA’s 2023 AI red-team introduction organizes assessments across the ML lifecycle, infrastructure and organizational risk. It combines conventional security testing, model attacks and harm scenarios, then illustrates lifecycle boundaries, privilege separation and tabletop exercises. The framework helps teams identify affected components and assign responsibility across data collection, training, deployment and monitoring.

Authenticate legitimate AI agent traffic with AWS WAF Bot Control

AWS provides a four-step technical guide to authenticating automated agents with Web Bot Authentication: deploy WAF Bot Control, sign requests with Ed25519 HTTP Message Signatures, write rules against verification labels, and monitor attempts through WAF logs and CloudWatch.

Agentic security: Detection and response at machine speed

Why it ranks: manually reviewed for hands-on depth; directly applicable to AI security practice; demonstrates an actionable operational method.

AWS outlines four areas for securing autonomous workloads: distinct agent identities with temporary scoped credentials, continuous behavioral monitoring, tiered automated containment and traceable delegation across agent teams. It recommends separating sensitive-data access, untrusted inputs and external communication. The article introduces an AWS/SANS framework and links to the longer implementation guidance.

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance

This guide maps three complementary control layers for local coding agents: enforced Claude Code settings, Anthropic's Compliance API transcripts for local sessions, and endpoint telemetry such as OpenTelemetry, hooks, configuration inventory, and EDR. It also identifies important gaps: cloud transcripts do not capture unused local plugins or off-platform model sessions, endpoint logs lack business intent, and retained transcripts can become a sensitive data store.

Implement custom authentication for tools integration using request Lambda interceptor in AgentCore Gateway

AWS demonstrates an interim AgentCore Gateway pattern for legacy tool APIs: validate the caller's JWT again in a deterministic request Lambda, retrieve a service credential from Secrets Manager, and construct the downstream Basic Auth header without exposing the secret to the model or changing the tool schema. The post explicitly treats this as a bridge to modern authentication, not a target architecture.

NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework

NVIDIA launched the Open Secure AI Alliance and contributed NOOA, an Apache-2.0 Python framework that represents agent state, capabilities, prompts, and typed contracts in classes with built-in testing and tracing. NVIDIA reports 86.8% on CyberGym L1 with GPT-5.5, blocked network access, and trajectory checks; the repository warns that generated Python can exfiltrate or delete data and that its AST and module filters are not a containment boundary.

OWASP AIBOM Generator

The OWASP AIBOM Generator creates CycloneDX-aligned inventories for Hugging Face models, visualizes model metadata and dependencies, and scores field completeness. It is a practical starting point for recording model provenance and supply-chain inputs, but an inventory does not establish that a component is safe or that its metadata is accurate.

OWASP ASI02: tool misuse and exploitation — the definitive security guide

This OWASP ASI02 guide separates accidental and adversarial tool misuse across misinterpreted requests, ignored constraints, poisoned tool descriptions, supply-chain injection, and unsafe multi-tool chains. It connects documented coding-agent incidents to attack surfaces, detection patterns, preventive architecture, and agent-specific containment and forensic questions.

Best Practices for Securing LLM-Enabled Applications

NVIDIA's AI Red Team organizes LLM application risk around prompt injection, information leakage, and probabilistic failure. It recommends treating model output as untrusted, narrowing and parameterizing tool actions, keeping authorization outside the prompt, protecting retrieved-document permissions through the response and logging path, and designing multi-tool workflows to fail closed when an intermediate result is invalid.

Propagate user authorization context in AI agents with Amazon Bedrock AgentCore

AWS demonstrates three ways to carry user identity through an AgentCore application: STS session tags for DynamoDB authorization, metadata filters for Bedrock Knowledge Bases, and RFC 8693 on-behalf-of exchange for external services. The design keeps enforcement in infrastructure and downstream systems instead of asking the model to filter results.

Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps

Microsoft added AI, Security Operations, and Infrastructure checks to its Zero Trust Assessment and a DevSecOps pillar with 15 control groups and 91 tasks to its Zero Trust Workshop, alongside new guidance for governing agent memory.

Play video

Black Hat Asia 2026 | Model Files → Memory Corruption → RCE: The Triple-Stage AI Attack Chain

Ji'an Zhou and Lei Lu show how a malicious model artifact can move beyond familiar pickle or Lambda-layer deserialization bugs into native memory corruption. Their Black Hat briefing builds an end-to-end three-stage chain from a crafted model file through controlled heap layout and control-flow hijacking to reliable code execution, then evaluates the attack against real inference systems.

The Wiz Red Agent is Now Generally Available

Wiz launched Red Agent for continuous application and API penetration testing. The vendor says it maps hidden APIs from client-side code, adapts tests to business logic, and safely validates exposed secrets; it describes preview findings involving SSRF-based credential theft, a passenger-data authorization bypass, and a paywall-bypass parameter. The examples and performance claims are vendor-reported, not independent benchmarks.

Introducing Gemini 3.6 Flash, 3.5 Flash-Lite, and 3.5 Flash Cyber

Google introduced Gemini 3.6 Flash for more efficient coding, knowledge work, multimodal tasks, and computer use; 3.5 Flash-Lite for high-throughput, low-latency agent workflows; and 3.5 Flash Cyber for vulnerability research inside CodeMender. Google reports lower token use for 3.6 Flash, about 350 output tokens per second for Flash-Lite, and enhanced CBRN and cyber-misuse safeguards.

AlphaEvolve: How our Gemini-powered coding agent is scaling impact across fields

Google DeepMind reports that AlphaEvolve's evaluator-guided coding search improved deployed or experimentally validated algorithms across infrastructure and science. Examples include a 30% reduction in DeepConsensus variant-detection errors, an increase from 14% to more than 88% in feasible solutions from a grid-optimization model, and a 5% aggregate accuracy gain across 20 natural-disaster prediction categories.

Decoupled DiLoCo: A new frontier for resilient, distributed AI training

Google DeepMind’s Decoupled DiLoCo divides model training into asynchronous compute islands across data centers. Tests reported much lower wide-area bandwidth, better useful work during simulated failures, and comparable Gemma 4 benchmark performance.

GitSpawn: background Git calls bypass coding-agent approval boundaries

Manifold’s GitSpawn research traces eight findings across seven coding agents to background Git calls that honor executable repository configuration. Some calls run before workspace trust or outside the agent sandbox. The delivery condition is a directory or archive containing attacker-controlled .git metadata; ordinary clone, fetch and pull do not transport that configuration. Four findings remained unpatched in the researcher’s September 1 retest.

Claude Mythos research prompts HAWK withdrawal and speeds a reduced-round AES attack

Anthropic reports that Claude Mythos Preview helped produce an end-to-end HAWK-256 key-recovery attack and a projected 200- to 800-fold speedup for an attack on seven-round AES-128. Public code targets only the small HAWK challenge parameter, while the AES result remains impractical and is projected from component tests. The HAWK team subsequently withdrew the candidate from NIST's process; no independent reproduction was public when reviewed.