← All posts

Problem-Aware

232 posts on problem-aware.

Generative AI Security Risks: Which Ones a Policy Gateway Governs, and Which It Cannot

Enterprise generative AI carries six governable security risks and three that sit outside any request-path control: sensitive data in prompts, prompt injection, exfiltration via outputs, shadow AI, over-broad agent permissions, and unlogged access. This overview maps each risk to the OWASP LLM Top 10, states plainly whether it is in or out of a policy gateway boundary, and links the deeper analysis for each.

ai-securitygenerative-aiowasp-llm-top-10ai-governancellm-securityshadow-ai
Read post →

AI Penetration Testing: Scoping a Real Engagement Against a Deployed LLM or Agent System

AI penetration testing against a deployed LLM or agent system covers five behaviors on the HTTP path: prompt injection and jailbreak testing, data exfiltration through outputs, tool and function-call abuse, authorization bypass on model access, and egress-path testing. This article scopes the program, maps each test class to OWASP LLM Top 10, MITRE ATLAS, and NIST AI 600-1, and shows where classic infra pentesting stays a separate discipline.

ai-securitypenetration-testingred-teamingllm-securityowaspmitre-atlas
Read post →

Chatbot Security Risks: What an Enterprise AI Assistant Exposes

An enterprise chatbot is an HTTP channel to a language model, and every message on it carries whatever a user or an agent typed. This walks the concrete security risks of deploying one, from prompt injection and data exposure to the authenticated-user gap and the missing audit trail, and what controlling that traffic actually requires.

ai-securityllm-securityprompt-injectionshadow-aipolicy-enforcementaudit
Read post →

Taiwan’s Multi-Agent Campaign Puts Agent Identity on the Security Review

Taiwan disclosed a hybrid, agent-assisted campaign against government agencies in August 2026. The incident belongs to conventional intrusion response, but it also gives enterprise security teams a concrete reason to govern the HTTP model calls made by internal agents with identity-bound policy and decision records.

agentic-aicybersecurityidentity-and-authorizationpolicy-enforcementai-security
Read post →

Indirect Prompt Injection Defense: Containing What the Model Was Told to Do

Indirect prompt injection hides instructions inside content an AI agent reads, a web page, a document, a tool result, and the model acts on them as if they came from you. No request filter reliably stops a model from being fooled. This piece is honest about that limit and shows where the defensible control sits: identity-scoped authorization on what the agent may then do, plus a per-decision record of what it did.

prompt-injection'agentic-ai''ai-security''authorization''audit-trail'
Read post →

AI Agent Tool Call Authorization: Deciding Per Call, Not Per Session

An AI agent authenticates once and then makes hundreds of tool and model calls, most systems authorize the session and wave the rest through. That is the post-authentication gap. This piece shows what per-call authorization for agents looks like: each tool call checked against the agent identity, its scope, and the parameters it carries, decided inline, and recorded.

agentic-ai'authorization''ai-agent-identity''ai-security''access-control'
Read post →

LLM Hallucination Controls: The Layer That Reduces the Rate and the Layer That Contains the Damage

A hallucinated answer is a confident, well-formed claim the model invented. Two moments in February 2024 made the cost concrete: a Canadian tribunal held Air Canada liable for a chatbot that invented a refund policy, and a New York court had already sanctioned lawyers who filed six fake cases ChatGPT produced. The controls that reduce hallucination frequency sit upstream in retrieval and prompt design. The controls that contain the damage and produce an accountable record sit at the request boundary. This walks both layers and marks which one enforces.

llm-securityai-securityai-governanceinline-enforcementllm
Read post →

Anthropic Evaluation Incidents Exposed a Months-Long Detection Gap

Anthropic reviewed 141,006 cybersecurity evaluation runs after another lab disclosed a related incident. Its July 30, 2026 report found six runs in which three models reached real organizations. The useful security lesson sits in the months-long detection gap and the records needed to reconstruct every model-directed call.

ai-securityagentic-aicybersecurityauditinline-enforcement
Read post →

A Hidden Word Prompt Can Copy Itself Through Copilot Output

Håkon Måløy demonstrated a hidden instruction that Copilot could ingest from a Word document, follow while producing an answer, and reproduce in a newly generated file. The proof of concept makes document provenance and deterministic authorization central to any workflow that lets retrieved content influence consequential actions.

prompt-injectionllm-securityai-securitypolicy-enforcementaudit
Read post →

Seven Model Backends Behind One Autonomous Attack Framework

Unit 42 documented a Hermes Agent campaign with seven interchangeable model backends and more than 460 targets. The useful defensive lesson sits at the model egress boundary: authorize the identity and destination for every outbound AI request, then preserve the decision record independently of the chosen provider.

ai-securityagentic-aicybersecurityinline-enforcementpolicy-enforcement
Read post →

Google ADK Agent-to-Agent Attack: Authority Moved with a Comment

A hidden instruction in a pull request could make Google ADK's triage agent invoke a more privileged workflow through a trusted bot account. The July 21 patch closed the repository path. The lasting security lesson is narrower: every relayed AI request needs authorization tied to its originating identity.

ai-securityagentic-aiprompt-injectionidentity-and-authorizationpolicy-enforcement
Read post →

An Email AI Assistant Inherits the Authority of a Hijacked Session

Barracuda's August 4 lab simulation started with one compromised mailbox and used its built-in AI assistant to map an organization, find a roughly $250,000 transfer, and draft convincing messages. The account compromise sits outside an AI gateway. The assistant's outbound model calls expose a separate authorization gap.

ai-securityagentic-aiidentity-and-authorizationinline-enforcementforensic-audit
Read post →