Blog
Security Research
Deep dives into prompt injection techniques, AI agent security, and defensive practices.
New Research: AI Agents May Always Be Vulnerable to Prompt Injection
A May 2026 arXiv paper argues that prompt injection resistance is fundamentally limited. Here is what the research actually says, and what it means for teams deploying agents now.
Semantic Kernel CVE-2026-25592: When Prompt Injection Becomes Remote Code Execution
Microsoft disclosed two critical vulnerabilities in Semantic Kernel on May 7, 2026. CVE-2026-25592 and CVE-2026-26030 turn ordinary prompt injection into host-level RCE. Here is what happened and what to do.
Best AI Agent Security Testing Tools in 2026: An Honest Comparison
A straightforward comparison of AI security testing tools in 2026. What each one tests, who it is for, and where it falls short. Includes BreakMyAgent, Garak, Lakera Guard, and others.
Prompt Injection in 2026: Five Things That Changed in the Last 12 Months
Prompt injection attacks are up 340% in 2026. But the more important story is how the attack and defense landscape has fundamentally shifted. What is different now and why it matters.
MCP Server Security: What to Know Before Connecting AI Agents
Model Context Protocol servers give AI agents access to file systems, databases, and APIs. That access needs to be secured. A practical guide to MCP security risks and defenses.
Google Just Caught Indirect Prompt Injection Spreading in the Wild. Here Are the Details.
Google scanned 2-3 billion crawled pages a month and found a 32% rise in malicious prompt injection content between November 2025 and February 2026. Here is what they found, and what it means for any agent that browses the open web.
Anthropic, Google, and Microsoft Are Now Quietly Paying for Prompt Injection. What Changed?
Three major AI vendors paid bug bounties for prompt injection vulnerabilities in April 2026 without public disclosure. The prompt injection bug bounty era has started. Here is what it means for builders.
CIS Just Called Prompt Injection a Government-Level Security Risk. Here Is What That Means.
The Center for Internet Security released a report in April 2026 warning that prompt injection attacks are a serious and growing threat to organizations using generative AI. Here is the key takeaway for teams shipping AI products.
Comment and Control: How Three AI Coding Agents Leaked API Keys via One PR
A researcher planted a single malicious PR comment and watched Claude Code, Gemini CLI, and GitHub Copilot all post their own API keys. Here is what happened and what it means for your CI pipeline.
Prompt Injection vs Jailbreak: What Is the Difference?
These terms get used interchangeably. They should not be. Understanding the distinction matters for building secure AI systems.
OWASP LLM Top 10 Explained: What Developers Need to Know
The OWASP LLM Top 10 is the closest thing AI security has to a shared standard. Here is what each risk actually means for developers building agent systems.
DeepSeek Security Analysis: What You Need to Know Before Deploying
An honest security assessment of DeepSeek V3.2. At $0.28/M tokens it is tempting, but what are you trading away on security?
HackerOne Just Made Agentic Prompt Injection Testing Official
HackerOne launched agentic prompt injection testing this week, and a Zenity researcher just called AI agents gullible at RSA. Here is what both mean for developers building production agents.
Claude vs GPT-5.4: Security Comparison for AI Agents
Head-to-head security analysis of Anthropic Claude Opus 4.6 and OpenAI GPT-5.4. Which model is safer for your AI agent deployment?
How to Secure Your AI Agent: A Practical Checklist
A concrete, actionable security checklist for AI agent deployments. Covers system prompt hardening, input validation, output monitoring, tool security, and incident response.
Which LLM Is Most Secure? 2026 Model Security Rankings
We scored 21 major LLMs across 5 security categories. Here are the results, the methodology, and what actually matters for your deployment.
10 Prompt Injection Attacks Every AI Developer Should Know
A practical breakdown of the 10 most impactful prompt injection attack techniques, with real payloads and specific mitigations for each.
What Is Prompt Injection? The Complete Guide for 2026
A comprehensive technical guide to prompt injection attacks - how they work, why they are dangerous, and how to defend against them in production AI systems.
Ready to test your agent?
Put the theory into practice. Scan your system prompt now.
Get new research in your inbox
We publish deep dives on AI security techniques. No fluff, no spam.