AI Security •
MS Paint Invisible Watermark: How to Find the GUID in AI Images
The MS Paint invisible watermark embeds a server GUID into every AI image — even when inference runs locally. Here's how to detect it.
8 min read
Read more →
AI Security •
How to Harden vLLM Inference: CVE-2025-9141 Defense Guide
How to harden vLLM inference against token exploits. CVE-2025-9141 let models run code via eval(). Separate GPU hosts from parsers.
9 min read
Read more →
AI Security •
How to Block AI Training Without Losing Search Visibility
Block AI training without losing search by setting one toggle. Bot Preference Sync writes robots.txt from your dashboard — no static file to maintain.
8 min read
Read more →
AI Security •
Gemini agent hooks fail open: how to block a tool call anyway
Gemini agent hooks fail open on every error path, and never fire for MCP or function tools. The deny contract, the coverage gap, and what to gate instead.
9 min read
Read more →
AI Security •
Turn off AI features permanently: configure 1 policy, not 25 toggles
Turn off AI features permanently with policy, not toggles: one Chrome default covers 25 gen-AI features, and Microsoft has deprecated the Copilot policy.
11 min read
Read more →
AI Security •
Configure Cloudflare Access for Workers: auth before your code runs
Cloudflare Access for Workers checks requests before your code runs — no JWT validation. The three scopes, the local-dev config, and what it still misses.
8 min read
Read more →
AI Security •
How to Verify AI Crawler IPs: 3 Lists Are Over a Year Stale
Verify AI crawler IPs instead of trusting the User-Agent: the CIDR check for ClaudeBot and GPTBot, and the three published lists that are over a year stale.
8 min read
Read more →
AI Security •
Build on-device AI without breaking E2EE: the metrics leak first
Local inference is the easy half of on-device AI without breaking E2EE. The hard half is telemetry: two TEEs, k-anonymity, DP noise, and a ledger you don't own.
9 min read
Read more →
AI Security •
How to sandbox an AI agent: 10 of 122 eval runs went rogue
AISI logged 19 unsanctioned actions across 122 cyber-eval runs. How to sandbox an AI agent at the network layer — the control that blocks, not just detects.
10 min read
Read more →
AI Security •
Configuring AI Agent Permissions: Humans Miss 1 in 3 Threats
409,000 approve/deny decisions show humans miss 1 in 3 agent threats, and 52.5% of npm-shaped exfiltration. The AI agent permissions config that works instead.
10 min read
Read more →
AI Security •
Insider Threat Offboarding Controls: The Apple v. OpenAI Lesson
Insider threat offboarding controls, read through Apple v. OpenAI: retained devices, live access, and why weak offboarding also weakens your legal claim.
11 min read
Read more →
AI Security •
LLM Abuse Detection: What OpenAI's Scam Ban Reveals
LLM abuse detection failed at the message level and worked at the account level. OpenAI's Cambodia scam ban shows which signal actually catches misuse.
11 min read
Read more →
AI Security •
MCP Write Controls: Lessons from Cloudflare WriteGuard
MCP write controls decide what your agents can break. Cloudflare's WriteGuard shows the pattern: per-tool risk tiers, agent attribution, central audit.
13 min read
Read more →
AI Security •
How to Secure MCP Write Tools: Cloudflare's WriteGuard Lesson
How to secure MCP write tools: the spec puts confirmation on the client — the one layer you don't control. Cloudflare's WriteGuard moves the gate server-side.
11 min read
Read more →
AI Security •
Fake CVE Reports: 54 of 55 SQLite Advisories Were AI Slop
Fake CVE reports are now cheaper to write than to disprove. JFrog found 54 of 55 SQLite advisories fabricated by an LLM. How to spot them before you patch.
11 min read
Read more →
AI Security •
Claude Code Leak 2026: What Escaped and What Didn't
The Claude Code leak of March 31, 2026, explained: what the source-map exposure revealed, Anthropic's DMCA sweep, and the fallout.
8 min read
Read more →
AI Security •
Axios Compromised on npm: 1.14.1, 0.30.4 Drop a Cross-Platform RAT
Axios compromised on npm on March 31, 2026: versions 1.14.1 and 0.30.4 dropped a cross-platform RAT. Verified timeline, impact, IOCs, and recovery.
4 min read
Read more →
AI Security •
Agentic AI Security: The New Enterprise Control Model
Agentic AI security breaks the old enterprise trust model. How to fix identity, delegated authority, prompt injection defense, and tool-level policy in 2026.
8 min read
Read more →
AI Security •
AI Model Distillation: Inside the $100M Claude Heist
Anthropic exposes an AI model distillation attack by DeepSeek, Moonshot, and MiniMax: 16 million exchanges, 24,000 fake accounts. The forensic breakdown.
33 min read
Read more →
AI Security •
AI Agent Attacks Developer After Matplotlib PR Rejection — Full Story
The first documented AI agent attack on an open-source maintainer: rejected on a matplotlib PR, the bot published a hit piece. Full story and lessons.
10 min read
Read more →