← All posts

Problem-Aware

192 posts on problem-aware.

Shadow AI Detection Software: What the Category Should Actually Detect

Shadow AI detection software is converging into a category, with vendors marketing variants of network monitoring, browser-extension telemetry, and CASB pivots. The detection problem decomposes into four signals: traffic identification, identity correlation, prompt-level classification, and policy state. Software that produces the first signal without the other three solves discovery and leaves the enforcement gap open. I walk through what the four signals look like, why most current detection tools generate the first one only, and what the shift from detection to enforcement requires of the architecture.

shadow-aiai-securitydata-loss-preventionpolicy-enforcementai-governance
Read post →

Agentic AI in the Enterprise: Where the Action Surface Sits and How It Gets Controlled

Agentic AI in the enterprise introduces a new action surface: the LLM-driven agent that calls tools, queries databases, sends emails, files tickets, runs code, and triggers workflows on behalf of an authenticated user. The control problem is not whether the model behaves. The control problem is who authorized this specific action, against what data, under which policy, and with what audit record. I walk through what the enterprise action surface looks like in 2026, where the control points sit, and how the NIST three-pillar framework maps to the enterprise deployment.

agentic-aiai-securityidentity-and-authorizationinline-enforcementarchitecture
Read post →

Prompt Injection Detection: The Three Inspection Layers That Actually Catch It in Production

Prompt injection detection lives at three inspection layers: the inbound prompt, the model output, and the downstream tool invocation. Each layer catches a class of attack the others miss. Production systems that rely on a single layer leak the rest. This article walks through what each layer detects, where most deployments today have visibility, and what the runtime architecture needs in order to detect across all three.

prompt-injectionllm-securityai-securityinline-enforcementllm
Read post →

Prompt Injection Monitoring: What to Watch For in Production Traffic and Where the Signals Live

Prompt injection monitoring is the operational layer above detection. The detector fires on a single request. The monitor watches the population of requests over time and surfaces trends, drift, and emerging attack patterns. This article walks through the signals worth watching, the cadence on each, and the runtime evidence the monitor depends on.

prompt-injectionllm-securityai-securityinline-enforcementaudit
Read post →

AI System Prompt Leakage: What Leaks, How It Leaks, and Where to Stop It

System prompts carry the AI applications instructions, role assignments, tool definitions, retrieved context, and sometimes credentials or routing keys. A leaked system prompt exposes the application logic to an attacker, including the role boundaries, the tool catalog, and any sensitive context the prompt happened to include. The leakage modes are well-understood. The mitigations live at the AI request boundary, not inside the model. This piece walks through the leak surfaces, the demonstrated attack techniques, and the architectural pattern that prevents leakage.

system-promptprompt-injectionai-securitydata-leakageai-governanceowasp-llm
Read post →

Prompts Become Shells: What Microsoft''s May Disclosure Means for Any Enterprise Running LangChain, AutoGen, or Semantic Kernel

On May 7, 2026, Microsoft Security Research published a disclosure that walks through prompt-to-shell escalation paths in mainstream AI agent frameworks, including LangChain, AutoGen, and Semantic Kernel. The disclosure reframes agentic AI from a data-leak concern into a remote code execution attack surface. The reframing matters because the SOC playbook for an RCE class of vulnerability is different from the privacy playbook most security teams currently apply to AI traffic. This article walks through the disclosed escalation paths, identifies which framework patterns are exposed, and outlines the enforcement architecture that contains the blast radius before the prompt reaches the agent.

agentic-aircelangchainautogensemantic-kernelprompt-injection
Read post →

AI Incident Response Playbook: Detection, Containment, and Forensics for AI-Layer Compromises

Most enterprise incident response playbooks assume the compromise sits at the network, endpoint, or application layer. AI-layer incidents (prompt injection in production, agent tool-call escalation, model-extraction attempts, credential theft via LLM-operated post-exploitation, data exfiltration through prompts) require a different detection signal, a different containment action, and a different forensic timeline. This playbook walks through the AI-layer incident classes the SOC should recognize, the detection signals each class produces, the containment actions that work at the AI request boundary, the forensic evidence the post-mortem needs, and the integration points with the rest of the security operations stack.

incident-responsesocai-securityprompt-injectionforensicscontainment
Read post →

When the LLM Is the Attacker''s Hands: CVE-2026-39987 and the Case for Per-Decision Audit Logging

On May 10, 2026, The Hacker News documented an incident where attackers exploited CVE-2026-39987 in Marimo (≤0.20.4) to gain pre-auth RCE inside a victim AWS environment, harvested credentials, and then drove an LLM agent to operate AWS Secrets Manager on their behalf. The LLM was the post-exploitation tool. This article walks the attack path and explains why the per-decision audit log of LLM traffic just acquired forensic and regulatory weight that legacy CloudTrail data lacks.

ai-securityllm-securityagentic-aiforensic-auditauditcybersecurity
Read post →

Shadow AI in 2026: Detection Patterns, Real Incidents, and What Your SOC Should Already Be Doing

The shadow IT framing for shadow AI is now outdated. Shadow AI is browser-extension-deep: ChatGPT in DevTools, Copilot in IDE, Claude in Slack. Blocking fails for the same architectural reason it failed for shadow SaaS in 2018. This article walks through current detection patterns at the DNS, proxy, OAuth consent, and browser inventory layers, three documented shadow AI incidents from 2025-2026, and why a policy gateway succeeds where blocking does not. The piece refreshes the existing shadow AI canon for the patterns SOCs are actually seeing in production this year.

shadow-aiai-securitycybersecuritydata-loss-preventiondlppolicy-enforcement
Read post →

Shadow AI in the Enterprise: Definition, Mechanism, and the Architecture That Closes the Gap

Shadow AI is the unauthorized use of AI tools by employees, agents, and embedded vendor features inside an enterprise. IBM Cost of Data Breach finds one in five breached organizations had shadow AI exposure, with $670,000 in incremental cost per incident. Cloud Radix puts unauthorized AI usage at 78% of employees. This pillar walks through what shadow AI is, why traditional DLP cannot see it, and the architecture that contains the blast radius.

shadow-aiai-securitydlpai-governancecisoenterprise
Read post →

Enterprise AI Data Uploads Nearly Doubled in 2026: Reading the Zscaler ThreatLabz Numbers as an Inline-Enforcement Problem

Zscaler ThreatLabz published the 2026 AI Threat Report on June 17, 2026. Employees moved 18,033 TB of enterprise data into AI tools over the year, a 93% jump. ChatGPT alone generated 410 million DLP policy violations, up 99% year over year. The report calls for zero trust on every model interaction and inline inspection on every AI/ML request. Those are gateway-layer controls. Reading the numbers as a control-architecture problem shows why app blocking and one-off DLP rules collapse at this volume.

shadow-aiai-dlpenterprise-aidata-exposureinline-enforcementai-security
Read post →

AI Agent Runtime Protection: Where the Control Plane Has to Sit and Why Most Architectures Get It Wrong

AI agent runtime protection has to enforce policy at the moment the agent calls a tool or a model. Most architectures push protection into the framework layer (LangChain callbacks, AutoGen middlewares, Semantic Kernel filters), which the agent can bypass once a prompt-injection payload reshapes the call path. The placement that survives sits at the HTTP request layer between the agent and the LLM or tool endpoint. This walkthrough shows why framework-layer protection fails, where the gateway placement closes the gap, and which controls only the request layer can enforce.

agentic-aiai-agent-securityruntime-protectioninline-enforcementai-security
Read post →