--- author: "Umesh Malik" canonical: "https://umesh-malik.com/blog/category/ai-security" description: "Explore AI Security articles and tutorials by Umesh Malik — AI Engineer, LLM & GenAI Developer. Learn AI Security best practices, practical tips, and in-depth guides." title: "Umesh Malik's Blog - AI Security Articles | AI Security Tutorials" tokens: 2818 generator: "scripts/generate-page-markdown.mjs" --- [← Back to Blog](https://umesh-malik.com/blog) # AI Security 20 articles [![The flow from prompt to invisible watermark: Paint sends a prompt to Microsoft's moderation server, receives a GUID, runs local inference, then embeds that GUID into the pixels](https://umesh-malik.com/blog/ms-paint-invisible-watermark-guid-cover.png) AI Security • Aug 25, 2026 ### MS Paint Invisible Watermark: How to Find the GUID in AI Images The MS Paint invisible watermark embeds a server GUID into every AI image — even when inference runs locally. Here's how to detect it. 8 min read Read more →](https://umesh-malik.com/blog/ms-paint-invisible-watermark-guid) [![Cover showing the inference engine attack surface with token stream flowing from model through vulnerable parser to arbitrary code execution, and the defense architecture separating GPU host from token parsing](https://umesh-malik.com/blog/secure-llm-inference-vllm-cve-2025-9141-cover.png) AI Security • Aug 25, 2026 ### How to Harden vLLM Inference: CVE-2025-9141 Defense Guide How to harden vLLM inference against token exploits. CVE-2025-9141 let models run code via eval(). Separate GPU hosts from parsers. 9 min read Read more →](https://umesh-malik.com/blog/secure-llm-inference-vllm-cve-2025-9141) [![Diagram showing robots.txt preferences syncing with Cloudflare's AI bot enforcement rules across Search, Agent, and Training categories](https://umesh-malik.com/blog/sync-robots-txt-ai-bot-blocks-cover.png) AI Security • Aug 24, 2026 ### How to Block AI Training Without Losing Search Visibility Block AI training without losing search by setting one toggle. Bot Preference Sync writes robots.txt from your dashboard — no static file to maintain. 8 min read Read more →](https://umesh-malik.com/blog/sync-robots-txt-ai-bot-blocks) [![The five sandbox tools a Gemini agent hook intercepts, against the two tool families it never sees](https://umesh-malik.com/blog/gemini-agent-hooks-fail-open-cover.png) AI Security • Aug 19, 2026 ### Gemini agent hooks fail open: how to block a tool call anyway Gemini agent hooks fail open on every error path, and never fire for MCP or function tools. The deny contract, the coverage gap, and what to gate instead. 9 min read Read more →](https://umesh-malik.com/blog/gemini-agent-hooks-fail-open) [![The four layers at which an AI feature can be switched off, ranked by which events reset each one](https://umesh-malik.com/blog/turn-off-ai-features-permanently-cover.png) AI Security • Aug 18, 2026 ### Turn off AI features permanently: configure 1 policy, not 25 toggles Turn off AI features permanently with policy, not toggles: one Chrome default covers 25 gen-AI features, and Microsoft has deprecated the Copilot policy. 11 min read Read more →](https://umesh-malik.com/blog/turn-off-ai-features-permanently) [![Cloudflare Access enforcing an identity policy in front of a Worker before its code executes](https://umesh-malik.com/blog/cloudflare-access-for-workers-cover.png) AI Security • Aug 15, 2026 ### Configure Cloudflare Access for Workers: auth before your code runs Cloudflare Access for Workers checks requests before your code runs — no JWT validation. The three scopes, the local-dev config, and what it still misses. 8 min read Read more →](https://umesh-malik.com/blog/cloudflare-access-for-workers) [![Verifying AI crawler identity by matching source IPs against published CIDR lists instead of trusting the User-Agent header](https://umesh-malik.com/blog/verify-ai-crawler-ips-not-user-agents-cover.png) AI Security • Aug 13, 2026 ### How to Verify AI Crawler IPs: 3 Lists Are Over a Year Stale Verify AI crawler IPs instead of trusting the User-Agent: the CIDR check for ClaudeBot and GPTBot, and the three published lists that are over a year stale. 8 min read Read more →](https://umesh-malik.com/blog/verify-ai-crawler-ips-not-user-agents) [![The metrics path behind WhatsApp Scam Alert, where device identity, IP address and per-user counters are each stripped at a different hop before any number reaches Meta](https://umesh-malik.com/blog/on-device-ai-without-breaking-e2ee-cover.png) AI Security • Aug 12, 2026 ### Build on-device AI without breaking E2EE: the metrics leak first Local inference is the easy half of on-device AI without breaking E2EE. The hard half is telemetry: two TEEs, k-anonymity, DP noise, and a ledger you don't own. 9 min read Read more →](https://umesh-malik.com/blog/on-device-ai-without-breaking-e2ee) [![Cover showing the four-layer agent containment stack — deny egress, scope identity, watch live, kill fast — alongside the AISI evaluation figures of 122 runs, 10 off-scope runs and containment in under an hour](https://umesh-malik.com/blog/sandbox-ai-agent-internet-access-cover.png) AI Security • Aug 8, 2026 ### How to sandbox an AI agent: 10 of 122 eval runs went rogue AISI logged 19 unsanctioned actions across 122 cyber-eval runs. How to sandbox an AI agent at the network layer — the control that blocks, not just detects. 10 min read Read more →](https://umesh-malik.com/blog/sandbox-ai-agent-internet-access) [![Cover card titled Approve, subtitled One in three gets through, with three statistics: 409,000 approve or deny decisions analysed, 66.3% mean accuracy, and 52.5% miss rate on npm-disguised exfiltration](https://umesh-malik.com/blog/ai-agent-permissions-approval-fatigue-cover.png) AI Security • Aug 7, 2026 ### Configuring AI Agent Permissions: Humans Miss 1 in 3 Threats 409,000 approve/deny decisions show humans miss 1 in 3 agent threats, and 52.5% of npm-shaped exfiltration. The AI agent permissions config that works instead. 10 min read Read more →](https://umesh-malik.com/blog/ai-agent-permissions-approval-fatigue) [![Cover card titled The Exit, subtitled Badge returned. Access still live., with three statistics: 2 named defendants in Apple Inc. v. Liu, 11 additional former employees named in the filing, and reasonable measures as the statutory test for a trade secret](https://umesh-malik.com/blog/insider-threat-offboarding-controls-cover.png) AI Security • Aug 5, 2026 ### Insider Threat Offboarding Controls: The Apple v. OpenAI Lesson Insider threat offboarding controls, read through Apple v. OpenAI: retained devices, live access, and why weak offboarding also weakens your legal claim. 11 min read Read more →](https://umesh-malik.com/blog/insider-threat-offboarding-controls) [![LLM abuse detection diagram contrasting per-message content classification with account-level behavioural correlation across a session corpus](https://umesh-malik.com/blog/llm-abuse-detection-openai-scam-network-cover.png) AI Security • Aug 5, 2026 ### LLM Abuse Detection: What OpenAI's Scam Ban Reveals LLM abuse detection failed at the message level and worked at the account level. OpenAI's Cambodia scam ban shows which signal actually catches misuse. 11 min read Read more →](https://umesh-malik.com/blog/llm-abuse-detection-openai-scam-network) [![MCP write controls diagram: a tool call passing through a policy layer that allows, labels, or blocks it before the handler runs](https://umesh-malik.com/blog/mcp-write-controls-cloudflare-writeguard-cover.png) AI Security • Aug 5, 2026 ### MCP Write Controls: Lessons from Cloudflare WriteGuard MCP write controls decide what your agents can break. Cloudflare's WriteGuard shows the pattern: per-tool risk tiers, agent attribution, central audit. 13 min read Read more →](https://umesh-malik.com/blog/mcp-write-controls-cloudflare-writeguard) [![Cover card titled The Gate, subtitled Thousands of tickets. One agent., with three statistics: 4 risk tiers, Cloudflare's MCP portal growing 13 to 27 servers, and tool annotations marked untrusted per the MCP spec](https://umesh-malik.com/blog/secure-mcp-write-tools-writeguard-cover.png) AI Security • Aug 5, 2026 ### How to Secure MCP Write Tools: Cloudflare's WriteGuard Lesson How to secure MCP write tools: the spec puts confirmation on the client — the one layer you don't control. Cloudflare's WriteGuard moves the gate server-side. 11 min read Read more →](https://umesh-malik.com/blog/secure-mcp-write-tools-writeguard) [![A fabricated CVE advisory flowing unverified into the public vulnerability database pipeline](https://umesh-malik.com/blog/fake-cve-reports-ai-slop-sqlite-cover.png) AI Security • Aug 4, 2026 ### Fake CVE Reports: 54 of 55 SQLite Advisories Were AI Slop Fake CVE reports are now cheaper to write than to disprove. JFrog found 54 of 55 SQLite advisories fabricated by an LLM. How to spot them before you patch. 11 min read Read more →](https://umesh-malik.com/blog/fake-cve-reports-ai-slop-sqlite) [![Claude Code source map leak visualization showing 512K lines of TypeScript escaping a code window with key stats](https://umesh-malik.com/blog/claude-code-leak-cover.png) AI Security • Apr 2, 2026 ### Claude Code Leak 2026: What Escaped and What Didn't The Claude Code leak of March 31, 2026, explained: what the source-map exposure revealed, Anthropic's DMCA sweep, and the fallout. 8 min read Read more →](https://umesh-malik.com/blog/claude-code-leak-march-2026) [![Editorial cover: the Axios npm supply-chain compromise (1.14.1 and 0.30.4)](https://umesh-malik.com/blog/axios-compromised-npm-cover.png) AI Security • Mar 31, 2026 ### Axios Compromised on npm: 1.14.1, 0.30.4 Drop a Cross-Platform RAT Axios compromised on npm on March 31, 2026: versions 1.14.1 and 0.30.4 dropped a cross-platform RAT. Verified timeline, impact, IOCs, and recovery. 4 min read Read more →](https://umesh-malik.com/blog/axios-compromised-npm-cross-platform-rat) [![Agentic AI enterprise security cover showing identity, prompt injection, policy gates, and observability](https://umesh-malik.com/blog/agentic-ai-enterprise-security-cover.png) AI Security • Mar 9, 2026 ### Agentic AI Security: The New Enterprise Control Model Agentic AI security breaks the old enterprise trust model. How to fix identity, delegated authority, prompt injection defense, and tool-level policy in 2026. 8 min read Read more →](https://umesh-malik.com/blog/agentic-ai-enterprise-security-model) [![A glowing AI brain being extracted through a network of fraudulent connections representing the massive distillation attack on Claude](https://umesh-malik.com/blog/distillation-attacks-cover.png) AI Security • Feb 24, 2026 ### AI Model Distillation: Inside the $100M Claude Heist Anthropic exposes an AI model distillation attack by DeepSeek, Moonshot, and MiniMax: 16 million exchanges, 24,000 fake accounts. The forensic breakdown. 33 min read Read more →](https://umesh-malik.com/blog/anthropic-detecting-preventing-distillation-attacks) [![Editorial cover: an AI agent's autonomous retaliation against an open-source maintainer](https://umesh-malik.com/blog/ai-agent-matplotlib-cover.png) AI Security • Feb 15, 2026 ### AI Agent Attacks Developer After Matplotlib PR Rejection — Full Story The first documented AI agent attack on an open-source maintainer: rejected on a matplotlib PR, the bot published a hit piece. Full story and lessons. 10 min read Read more →](https://umesh-malik.com/blog/ai-agent-attacks-developer-matplotlib-open-source)