Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.
Washington’s My Health My Data Act covers identifiable health data outside familiar HIPAA assumptions, including some inferences produced with algorithms or machine learning. This guide builds an audit package for scope, privacy notices, consent, sharing, consumer requests, processors and security, then separates statutory proof from HTTP model-traffic evidence.
Read post →OpenAI published a preliminary assessment that it cannot rule out Critical cyber capability in Astra, an upcoming model, under its own Preparedness Framework. Four of the five safeguards it listed are a model provider''s internal security programme. One of them, restricted network and tool access, is the same control the deploying enterprise has to apply on its own end, to a model it did not build. This piece separates the lab-side containment from the deployment-side authorization question and names what produces the record.
Read post →Tenet Security presented Ghostjacking at DEF CON 34 on August 9, 2026. An attacker sends a request designed to be blocked, the firewall logs the payload verbatim, and an AI agent asked to review that log follows the attacker''s text as instruction. In the demonstrated chain the agent rewrote DNS records to point at attacker infrastructure. This piece walks the mechanism step by step and separates the observability fixes from the two controls that live on the AI request path.
Washington''s My Health My Data Act separates collection consent from sharing consent, and sending consumer health data to an external model provider is a sharing event. This mapping connects RCW 19.373 duties for scope, privacy policy, dual consent, consumer rights, security practices, processors, authorization to sell and geofencing to accountable owners, implementation points, tests and evidence. Coverage is graded at the authenticated HTTP model boundary, with legal classification and consent capture kept outside it.
Read post →Two research teams published two separate routes into Atlassian Rovo within 48 hours in August 2026. Varonis Threat Labs found that a URL parameter pre-fills the assistant''s chat inside the signed-in user''s session. PromptArmor found instructions hidden in content Rovo reads, exfiltrating Jira and Confluence data with web search turned off. This piece separates the two disclosures, keeps their remediation statuses apart, and names the connected-assistant blast radius problem underneath both.
Read post →AutoGen agents pass messages to each other, and a shared conversation history means one sensitive document read once is re-sent to the model on every subsequent turn by every participating agent. This piece walks the message-passing mechanism that multiplies disclosure, separates the local code-execution surface from the model-client surface an enforcement layer can reach, shows where a base URL points a deployment at a policy boundary, and sets out what the per-decision record needs to carry.
Read post →Claude Connectors are built on the Model Context Protocol, and the transport a connector uses determines whether data loss prevention has anywhere to stand. Remote connectors speak HTTP to a server the organization can put a proxy in front of. Local connectors speak STDIO between two processes on the same machine, where no network control exists. This piece separates the two transports, walks the tool-result path that carries the real exfiltration risk, and sets out what a per-decision record needs to contain.
Read post →IAM decides which principal may invoke which Bedrock model, and says nothing about what is inside the prompt. Bedrock Guardrails evaluate content inside the AWS inference path and cover AWS-hosted endpoints. This piece walks the bedrock-runtime request path, explains why model invocation logging being off by default is the most consequential setting in the service, separates the AWS-native controls from the multi-provider case, and sets out what a per-decision record has to carry.
Read post →Azure AI Foundry content filters evaluate harm categories and jailbreak attempts. Data loss prevention asks whether the prompt contains customer records that should never have left the tenant. Those are different questions with different classifiers, and conflating them is the most common gap in a Foundry security review. This piece walks the per-deployment endpoint surface, the diagnostic-settings problem across a multi-model project, and where prompt classification and per-request authorization belong.
Read post →Amazon Q Business builds an index over enterprise data sources and answers with the acting user''s permissions applied. Two data-protection problems survive that design: the index is a second copy of the content under different controls, and permission changes at the source only reach the index at the next sync. This piece separates the managed surfaces an enforcement layer cannot intercept from the Q Developer and custom-plugin paths it can, and sets out what to test.
Read post →A Cohere deployment usually moves far more content through Embed and Rerank than through Chat, and most AI DLP programmes instrument only the conversational path. An indexing job embedding a 40,000-document corpus sends every one of those documents to the provider in a batch that no chat dashboard records. This piece walks the three endpoint families, explains why deployment-mode variation makes hostname allowlisting fragile, and sets out where classification and per-decision records belong.
Read post →At DEF CON 34 Cloud Village on August 8, 2026, Marios Gyftos and Chrysostomos Manousis presented credential relay findings across six Azure services, including Azure AI Foundry, Azure AI Speech, Azure MCP Servers, AKS MCP and API Management. The root cause is one sentence long: the credential attached to an outbound request and the destination of that request are resolved independently, and nothing checks that they belong together. This piece walks the mechanism, separates the part Microsoft owns from the part a policy gateway owns, and sets out the record an incident reviewer needs.
Read post →