AI Agent Security
Is ChatGPT Safe for Company Data? Plans vs API
Consumer ChatGPT, business plans and the API handle your data differently. Compare control, retention and training defaults, and when a governed API path wins.
Blog
Insights & updates — page 2
AI agent security, identity, governance, cost, and the engineering behind the control plane.
AI Governance & Compliance
Is It Safe to Use DeepSeek and Open-Weight Models at Work?
DeepSeek's hosted app and its open weights carry different risks. Learn how to assess each, set a model allow-list, and govern use through a gateway.
AI Governance & Compliance
ISO 27001 vs ISO 42001: Do You Need Both?
ISO 27001 secures information; ISO 42001 governs AI systems. How the two management systems overlap, where 42001 adds AI controls, and when you need both.
AI Agent Security
Can an LLM Be Backdoored? Sleeper Agents and Data Poisoning
Yes. Poisoned training data can plant hidden triggers that survive safety training. Why runtime monitoring and drift detection are the practical backstop.
Platform & Operations
MCP Sampling and Elicitation: Security Risks
MCP sampling lets servers call your LLM; elicitation lets them prompt your users. Both open injection and phishing channels. Here are the risks and controls.
Platform & Operations
Why MCP Token Passthrough Is Forbidden
MCP servers must not accept or forward tokens issued for another resource. Why passthrough breaks audit and trust, and audience-bound patterns to use instead.
AI Agent Security
How to Verify AI Model Provenance with Sigstore Signing
Verify an AI model's provenance by checking a signature over every model file against a trusted signer identity, with OpenSSF model signing and Sigstore.
AI Agent Security
Multimodal Prompt Injection: Images, PDFs and Audio
Multimodal prompt injection hides instructions in images, PDFs and audio that text filters never see. Learn where payloads hide and which controls hold.
AI Governance & Compliance
NIST Cyber AI Profile Explained: CSF 2.0 for AI Systems
NIST IR 8596, the Cyber AI Profile, maps CSF 2.0 outcomes to AI across Secure, Defend and Thwart. What it asks for and how to map it to agent controls.
AI Agent Security
How Do You Enforce Document Permissions in RAG?
Permission-aware RAG filters retrieval by the caller's entitlements at query time and logs which chunks reached whom. How to build it for humans and agents.
AI Agent Security
How to Secure AI SOC Agents Against Prompt Injection
AI SOC agents read attacker-controlled logs and alerts. Scope their response actions, gate containment behind humans, and audit every autonomous verdict.
AI Agent Security
How to Secure a Self-Hosted LLM: Ollama and vLLM Checklist
Self-hosted LLM servers often ship without auth. A hardening checklist for Ollama and vLLM: network binding, auth, isolation, model provenance and audit.
AI Agent Security
What Is Slopsquatting? AI Package Hallucination Attacks
Slopsquatting is registering package names that AI coding tools hallucinate, so agents install malware. How it works and how to block it with allow-lists.
AI Governance & Compliance
Who Is Liable When an AI Agent Makes a Mistake?
When an AI agent errs, the company deploying it is usually liable first. How contract, negligence and the new EU Product Liability Directive split the risk.
AI Governance & Compliance
What Is Zero Data Retention (ZDR) for LLM Providers?
Zero data retention means a provider stores no prompts or outputs after the request. Learn how ZDR works, where it stops, and how to enforce it.
AI Governance & Compliance
Verify Signed AI Agent Audit Logs: A Runnable Example
Run a synthetic signed-audit lab to detect changed records, broken chains, and missing tails with a trusted checkpoint. Learn what verification cannot prove.
Platform & Operations
Fix MCP OAuth 401 and 403 Errors
Diagnose MCP OAuth failures with a local lab: missing or expired tokens, wrong audiences, insufficient scopes, discovery problems, and issuer mismatches.
AI Governance & Compliance
EU AI Act Article 12 Logging for AI Agents
What EU AI Act Article 12 record-keeping means for AI agents that call tools: the events to log, who keeps the logs under Articles 19 and 26(6), and how long.
AI Governance & Compliance
The EU Cyber Resilience Act and AI Agent Products
How the EU Cyber Resilience Act's security-by-design, vulnerability handling, and reporting duties apply to AI agent software sold into the EU market.
AI Governance & Compliance
Governing Workday Agents Over HR Data
Workday's domain security model scopes agent access to HR data tightly, but integrations to external HRIS, payroll, and ATS systems fall outside it.
AI Governance & Compliance
Governing Snowflake Cortex Agents
Snowflake's RBAC and row-level policies govern Cortex Agents tightly inside the platform, but external functions and exports fall outside that perimeter.
AI Governance & Compliance
Governing SAP Joule Agents in Regulated Estates
Joule inherits SAP's authorization objects in-landscape, but regulated estates need an audit trail spanning any system a Joule agent reaches beyond SAP.
AI Agent Security
Governing Salesforce Agentforce Deployments
Agentforce agents run as a dedicated Salesforce agent user, not the invoking human, so what that user's permission sets grant is the first thing to check.
AI Governance & Compliance
Governing Microsoft 365 Copilot Agents
Copilot agents respect Microsoft Graph permissions by default, but citizen-developer publishing in Copilot Studio outpaces central inventory and review.