--- author: "Umesh Malik" canonical: "https://umesh-malik.com/blog/tag/security" description: "Explore articles tagged with Security by Umesh Malik — AI Engineer, LLM & GenAI Developer. Learn Security best practices, practical tips, and in-depth guides." title: "Umesh Malik's Blog - Security Articles | Security Tutorials" tokens: 918 generator: "scripts/generate-page-markdown.mjs" --- [← Back to Blog](https://umesh-malik.com/blog) # Security 7 articles [![OAuth consent screen with optional scope checkboxes that let users narrow agent permissions](https://umesh-malik.com/blog/optional-oauth-scopes-mcp-servers-cover.png) Web Engineering • Aug 23, 2026 ### Configure Optional OAuth Scopes for MCP Servers and Agents Configure optional OAuth scopes so users can narrow agent permissions at consent. The API call, the UX, and handling partial grants. 6 min read Read more →](https://umesh-malik.com/blog/optional-oauth-scopes-mcp-servers) [![Architecture diagram of a self-hosted AI coding agent with sandboxed execution](https://umesh-malik.com/blog/self-hosted-ai-coding-agent-sandbox-cover.png) AI Coding Agents & DX • Aug 23, 2026 ### Self-Hosted AI Coding Agent: Sandboxed Prompt-to-Deploy for $25/mo Build a self-hosted AI coding agent with sandboxed execution. One prompt produces a repo, tests, CI, and deployed app — $25/mo, no cloud bills. 7 min read Read more →](https://umesh-malik.com/blog/self-hosted-ai-coding-agent-sandbox) [![Diagram of the Datasette filter injection — a query-string column name flows unquoted into generated SQL and returns rows from a private table](https://umesh-malik.com/blog/datasette-sql-injection-patch-cover.png) Web Engineering • Aug 7, 2026 ### Fix the Datasette SQL Injection: Why execute-sql Won't Save You The Datasette SQL injection patched in 1.0a38 and 0.65.3 leaks private tables via unescaped filter columns. The check, upgrade, and why execute-sql is no fix. 8 min read Read more →](https://umesh-malik.com/blog/datasette-sql-injection-patch) [![Claude Code source map leak visualization showing 512K lines of TypeScript escaping a code window with key stats](https://umesh-malik.com/blog/claude-code-leak-cover.png) AI Security • Apr 2, 2026 ### Claude Code Leak 2026: What Escaped and What Didn't The Claude Code leak of March 31, 2026, explained: what the source-map exposure revealed, Anthropic's DMCA sweep, and the fallout. 8 min read Read more →](https://umesh-malik.com/blog/claude-code-leak-march-2026) [![Editorial cover: the Axios npm supply-chain compromise (1.14.1 and 0.30.4)](https://umesh-malik.com/blog/axios-compromised-npm-cover.png) AI Security • Mar 31, 2026 ### Axios Compromised on npm: 1.14.1, 0.30.4 Drop a Cross-Platform RAT Axios compromised on npm on March 31, 2026: versions 1.14.1 and 0.30.4 dropped a cross-platform RAT. Verified timeline, impact, IOCs, and recovery. 4 min read Read more →](https://umesh-malik.com/blog/axios-compromised-npm-cross-platform-rat) [![Agentic AI enterprise security cover showing identity, prompt injection, policy gates, and observability](https://umesh-malik.com/blog/agentic-ai-enterprise-security-cover.png) AI Security • Mar 9, 2026 ### Agentic AI Security: The New Enterprise Control Model Agentic AI security breaks the old enterprise trust model. How to fix identity, delegated authority, prompt injection defense, and tool-level policy in 2026. 8 min read Read more →](https://umesh-malik.com/blog/agentic-ai-enterprise-security-model) [![A glowing AI brain being extracted through a network of fraudulent connections representing the massive distillation attack on Claude](https://umesh-malik.com/blog/distillation-attacks-cover.png) AI Security • Feb 24, 2026 ### AI Model Distillation: Inside the $100M Claude Heist Anthropic exposes an AI model distillation attack by DeepSeek, Moonshot, and MiniMax: 16 million exchanges, 24,000 fake accounts. The forensic breakdown. 33 min read Read more →](https://umesh-malik.com/blog/anthropic-detecting-preventing-distillation-attacks)