Blog/Topic
AI security and compliance: prompt injection, MCP tool poisoning, least-privilege agents, PII and the EU AI Act.
Security & compliance
·13 min read
What to check after the model answers: safe Markdown rendering, schema checks before actions, moderation classifiers, streaming rails and groundedness.
Security & compliance
·12 min read
A practical red teaming checklist for LLM features: scope, OWASP 2025 test cases, promptfoo, garak and PyRIT, human testers and regression tests.
Security & compliance
·6 min read
How LLMs hallucinate package names, how attackers register them, and the registry, lockfile and agent-harness controls that stop the install.
Security & compliance
·6 min read
How attackers plant documents that RAG systems retrieve, what PoisonedRAG and OWASP show, and the ingestion, retrieval and answer controls that limit it.
Security & compliance
·11 min read
How secrets leak through coding agents, and the controls that stop them: deny reads, a sandbox, pre-commit scans, push protection, OIDC and rotation.
Security & compliance
·11 min read
Usage logs can make an AI coding tool a monitoring system. What Austria (§ 96 ArbVG) and Germany (§ 87 BetrVG) require, and what to agree before rollout.
Security & compliance
·12 min read
EU AI Act after the Digital Omnibus: GPAI duties, high-risk dates of 2 Dec 2027 and 2 Aug 2028, provider vs deployer on OpenAI and Anthropic, AI literacy.
Security & compliance
·12 min read
A worked DPIA under GDPR Art. 35 for an AI assistant that drafts customer email replies from order data: when it is needed, the risks and owners.
Security & compliance
·10 min read
A review of Guardrails AI: 65 hub validators, eight on-fail actions, the August 2026 shutdown of hosted inferencing, and when NeMo Guardrails fits better.
Security & compliance
·12 min read
EU AI Act Article 50 from 2 August 2026: AI interaction disclosure, machine-readable marking, deepfakes, provider vs deployer, and a checklist.
Security & compliance
·9 min read
Why prompt injection can't be filtered away: the lethal trifecta, six design patterns that contain it, egress rules and a red-team checklist for AI agents.
Security & compliance
·11 min read
Can an LLM API be GDPR compliant? EU data residency on OpenAI, Claude via Bedrock and Google Cloud, zero data retention, pseudonymisation and self-hosting.
Security & compliance
·10 min read
Semgrep: 30-plus languages, YAML patterns matched in seconds, a free LGPL-2.1 engine. Cross-file analysis, rulesets and AI triage sit behind paid tiers.
Security & compliance
·10 min read
MCP security checklist: the threat model, tool poisoning, rug pulls, RFC 9207 issuer checks, per-issuer credentials, scoped tokens and audit logs.
Security & compliance
·11 min read
AI agent sandbox checklist for CI: isolation, egress allowlists, short-lived scoped credentials, blocked metadata endpoints, untrusted project config.
Security & compliance
·9 min read
A review of Lakera Guard: one endpoint before the model, the PINT benchmark behind its scores, and why the free tier stops at 10,000 requests a month.
Security & compliance
·10 min read
What detect-secrets does, how its committed baseline differs from gitleaks and TruffleHog, why verification calls matter in CI, and where the tool stops.
Security & compliance
·12 min read
Where to redact PII in LLM pipelines: reversible tokens vs masking, Presidio and cloud DLP, German and Hungarian gaps, GDPR for pseudonymised data.
Security & compliance
·9 min read
Rebuff scores prompts with heuristics, an LLM, a vector store of past attacks and canary tokens. Archived in May 2025; last release January 2024.
Security & compliance
·10 min read
Protect AI model scanning after the Palo Alto Networks acquisition: what became of Guardian, what ModelScan still does, and how free scanners compare.
Security & compliance
·12 min read
AI agent identity and least privilege: its own identity, delegated tokens, an off switch, audit and offboarding, and what Entra, Okta and Auth0 ship.