[{"data":1,"prerenderedAt":626},["ShallowReactive",2],{"blog-protect-ai-en":3},{"slug":4,"published":5,"minutes":6,"category":7,"tags":8,"keywords":13,"about":22,"sources":32,"cover":65,"og":66,"expertise":67,"locales":68,"lang":69,"title":72,"description":73,"coverAlt":74,"metaTitle":75,"takeaways":76,"faq":82,"toc":95,"blocks":120,"others":389},"protect-ai","2026-06-22",10,"security",[9,10,11,12],"Model scanning","Supply chain","Pickle","CI security",[14,15,16,17,18,19,20,21],"protect ai guardian","modelscan","ai model scanning","prisma airs ai model security","pickle malware scanner","model serialization attack","modelscan vs modelaudit","scan hugging face model for malware",[23,26,29],{"name":24,"url":25},"Protect AI","https:\u002F\u002Fprotectai.com",{"name":27,"url":28},"Palo Alto Networks","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPalo_Alto_Networks",{"name":30,"url":31},"ModelScan","https:\u002F\u002Fgithub.com\u002Fprotectai\u002Fmodelscan",[33,36,39,42,44,47,50,53,56,59,62],{"title":34,"url":35},"Palo Alto Networks: completes acquisition of Protect AI","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcompany\u002Fpress\u002F2025\u002Fpalo-alto-networks-completes-acquisition-of-protect-ai",{"title":37,"url":38},"Prisma AIRS AI Model Security product page","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fai-model-security",{"title":40,"url":41},"Prisma AIRS platform page served at protectai.com","https:\u002F\u002Fprotectai.com\u002F",{"title":43,"url":31},"ModelScan repository and README",{"title":45,"url":46},"ModelScan on PyPI","https:\u002F\u002Fpypi.org\u002Fproject\u002Fmodelscan\u002F",{"title":48,"url":49},"ModelAudit repository and README","https:\u002F\u002Fgithub.com\u002Fpromptfoo\u002Fmodelaudit",{"title":51,"url":52},"promptfoo documentation: model scanning","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fmodel-audit\u002F",{"title":54,"url":55},"Beyond F1: Evaluating Coverage and Failure Recovery in AI Model Security Scanners","https:\u002F\u002Farxiv.org\u002Fabs\u002F2608.27424",{"title":57,"url":58},"JFrog: three zero-day PickleScan vulnerabilities","https:\u002F\u002Fjfrog.com\u002Fblog\u002Funveiling-3-zero-day-vulnerabilities-in-picklescan\u002F",{"title":60,"url":61},"PickleScan repository and README","https:\u002F\u002Fgithub.com\u002Fmmaitre314\u002Fpicklescan",{"title":63,"url":64},"Hugging Face Hub docs: third-party scanner Protect AI","https:\u002F\u002Fhuggingface.co\u002Fdocs\u002Fhub\u002Fen\u002Fsecurity-protectai","\u002Fimages\u002Fblog\u002Fprotect-ai\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fprotect-ai\u002Fog.jpg","ai-engineer",[69,70,71],"en","de","hu","Protect AI model scanning: Guardian is gone, ModelScan is not","A review of Protect AI model scanning after the Palo Alto Networks acquisition: what Guardian became, what ModelScan still does, and how the free scanners compare.","Three boxes stacked in a column, the middle with a magnifier, an arrow leaving the top.","Protect AI model scanning review · Balázs Csorba",[77,78,79,80,81],"Protect AI was bought by Palo Alto Networks and the deal completed on 22 July 2025; Guardian is retired and its capability ships as Prisma AIRS AI Model Security.","ModelScan survives as Apache-2.0 at version 0.8.8 from 18 February 2026, covering pickle, TensorFlow SavedModel and Keras H5 and nothing else.","An August 2026 benchmark gave ModelScan a definitive verdict on 49.6% of 135 labelled model families, against 100% for ModelAudit and 81.5% for Fickling.","Prisma AIRS AI Model Security claims 35+ file types and 25+ threat categories, publishes no price and no independent coverage measurement.","In these tools exit codes 1 to 4 are all non-zero: 1 means findings, 2 and above mean the scan did not happen and the build must fail.",[83,86,89,92],{"q":84,"a":85},"What happened to Protect AI Guardian?","Palo Alto Networks announced the acquisition of Protect AI on 28 April 2025 and completed it on 22 July 2025. Guardian was retired as a product name: protectai.com\u002Fguardian returns 404 and the domain now serves Prisma AIRS pages. The model-scanning capability continues as Prisma AIRS AI Model Security inside the Prisma AIRS platform.",{"q":87,"a":88},"Is ModelScan free to use?","Yes. ModelScan is Apache-2.0, installs with pip install modelscan, and version 0.8.8 was released on 18 February 2026 for Python 3.10 to 3.12. It has no hosted component, no account and no usage limit.",{"q":90,"a":91},"Which model formats does ModelScan support?","Pickle and pickle-derived formats such as PyTorch, scikit-learn, XGBoost, joblib, dill and cloudpickle, plus TensorFlow SavedModel and Keras H5 files, with the TensorFlow and H5 scanners installed as extras. Anything outside that set comes back as exit code 3 rather than as a clean result.",{"q":93,"a":94},"Is a model scan enough to trust a downloaded model?","No. Static scanning catches code that would run at load time; it cannot see a backdoor in the weights or behaviour on your data. Coverage between the free scanners differs a lot, so run more than one, fail the build when a scan does not finish, and prefer formats that cannot execute code at all.",[96,99,102,105,108,111,114,117],{"id":97,"title":98},"what-it-is","What it is",{"id":100,"title":101},"how-it-works","How it works",{"id":103,"title":104},"supported-formats","Supported formats",{"id":106,"title":107},"getting-started","Getting started",{"id":109,"title":110},"what-survived","What survived",{"id":112,"title":113},"where-it-shingles","Where it shingles",{"id":115,"title":116},"verdict","Verdict",{"id":118,"title":119},"sources","Sources",[121,125,134,137,140,163,166,167,170,176,179,183,191,192,195,246,249,250,253,255,258,265,266,269,272,275,276,279,323,326,332,333,336,348,352,353],{"type":122,"content":123},"paragraph",[124],"Protect AI used to be a company you could buy model scanning from. Palo Alto Networks announced the acquisition on 28 April 2025 and completed it on 22 July 2025, so what is left to review is not a vendor but two artefacts: Prisma AIRS AI Model Security, the paid scanner that Guardian became, and ModelScan, an Apache-2.0 command-line tool that still installs from PyPI. The position of this review is that scanning a model file is a CI gate rather than a procurement category: the paid tier buys policy, provenance and audit trail, and nothing in the published material shows it detecting what the free tools miss.",{"type":122,"content":126},[127,128,133],"A model file is executable code wearing a data-science extension, because loading one with PyTorch runs whatever the pickle inside asks for. The scanner therefore sits between the registry and the deploy step, at the same intake point as a marketplace tool or a package from a public index; the reasoning in the ",{"tag":129,"to":130,"children":131},"link","\u002Fblog\u002Fmcp-server-security-checklist",[132],"MCP security checklist"," applies to weights as well. The free competition is ModelAudit and Picklescan, and on the commercial side JFrog's research team published the PickleScan bypasses described further down.",{"type":135,"level":136,"id":97,"text":98},"heading",2,{"type":122,"content":138},[139],"ModelScan is a Python package with a single command: it reads a file byte by byte, looks for serialisation constructs that lead to code execution, and reports them by severity without ever loading the model. Guardian was the hosted and enterprise layer over that idea, scanning models in CI and in registries, enforcing policies and keeping an audit trail, and it no longer exists under that name. The capability is sold as Prisma AIRS AI Model Security inside the Prisma AIRS platform, which also carries runtime protection, red teaming and posture management.",{"type":141,"ordered":142,"items":143},"list",false,[144,146,148,150,152,159,161],[145],"Vendor: Protect AI, now inside Palo Alto Networks; the acquisition completed on 22 July 2025",[147],"Free component: ModelScan, Apache-2.0, PyPI version 0.8.8 released on 18 February 2026, Python 3.10 to 3.12",[149],"Paid component: Prisma AIRS AI Model Security, 35+ file types and 25+ threat categories, price only on request",[151],"Detection: unsafe serialisation constructs, embedded malicious code, backdoors and structural anomalies, rated CRITICAL to LOW",[153,154,158],"Interface: ",{"tag":155,"children":156},"code",[157],"modelscan -p PATH",", console or JSON reporting, exit codes 0 to 4",[160],"Placement: scans run inside your own environment so model files and IP stay local, according to the product page",[162],"Guardian is gone: protectai.com\u002Fguardian returns 404, and the Hugging Face documentation page that describes it still links that dead address",{"type":122,"content":164},[165],"For a team already paying for Prisma AIRS, model scanning is a checkbox on a platform it owns. For a team that is not, the same gate can be assembled from ModelScan and a CI step at no cost. That asymmetry, rather than any detection benchmark, is what this review turns on.",{"type":135,"level":136,"id":100,"text":101},{"type":122,"content":168},[169],"Static scanning avoids the very trap it defends against: nothing in the file is ever deserialised. The ModelScan README describes reading a file a byte at a time, like a string, looking for unsafe code signatures, which bounds both the runtime and the risk, since a scan takes about as long as reading the file from disk. Findings arrive as CRITICAL, HIGH, MEDIUM or LOW, and the process exit code carries the verdict into CI.",{"type":171,"src":172,"alt":173,"wide":174,"caption":175},"image","\u002Fimages\u002Fblog\u002Fprotect-ai\u002Fdiagram-8.webp","How a model scan runs A four stage static pipeline: a model file from a registry or a CI artefact is checked for its format, scanned byte by byte without being loaded, assigned a severity, and the result becomes an exit code and a policy decision. Below, a severity ladder from critical to low, and a note that threat intelligence only arrives with the paid tier.",true,"A model scan reads the file without loading it, assigns a severity and turns the verdict into an exit code; threat intelligence only arrives with the paid product.",{"type":122,"content":177},[178],"The paid tier adds what a file-by-file tool cannot see. Palo Alto Networks states that scans validate models against Advanced WildFire threat intelligence and findings from the huntr researcher community, that analysis runs in the customer's own environment, and that build systems integrate through an API; January 2026 added Artifactory and GitLab sources. Those are claims about intelligence, provenance and workflow, and none of them says the parser reads the file more accurately.",{"type":135,"level":180,"id":181,"text":182},3,"static-not-behavioural","Static, not behavioural",{"type":122,"content":184},[185,186,190],"Neither tier watches the model run. No scanner can tell you that a layer activates only for a particular input distribution, or that accuracy was quietly degraded for one class of user; that requires evaluation against your own data and, for agents, runtime controls of the kind described in the ",{"tag":129,"to":187,"children":188},"\u002Fblog\u002Fsandboxing-coding-agents-ci-checklist",[189],"AI agent sandbox checklist",". Static analysis answers one question: does this file contain constructs that execute when it is loaded. Answering it well is worth a great deal, as long as nobody reads no findings as safe.",{"type":135,"level":136,"id":103,"text":104},{"type":122,"content":193},[194],"Format coverage is where the free tool and the paid product diverge most, and where the free tool is at least honest about its limits.",{"type":196,"head":197,"rows":204},"table",[198,200,202],[199],"Format family",[201],"ModelScan, free",[203],"Prisma AIRS AI Model Security",[205,212,219,226,233,240],[206,208,210],[207],"Pickle variants",[209],"torch, scikit-learn, XGBoost, joblib, dill, cloudpickle",[211],"Inside the claimed set of 35+ file types",[213,215,217],[214],"TensorFlow SavedModel",[216],"Protocol buffers, scanner installed as an extra",[218],"TensorFlow named on the product page",[220,222,224],[221],"Keras HDF5",[223],"h5 and keras v3, scanner installed as an extra",[225],"Keras covered by the same claim",[227,229,231],[228],"ONNX and other tensor formats",[230],"Not in the documented set",[232],"ONNX named explicitly among 35+ types",[234,236,238],[235],"Archives, manifests, configs",[237],"Not claimed",[239],"Part of the 25+ threat categories",[241,243,244],[242],"Backdoors in the weights",[237],[245],"Listed as a detection category",{"type":122,"content":247},[248],"The gap that matters is not a missing format but an unlisted one: a scanner cannot scan what it does not recognise, and an unrecognised file has to fail closed rather than pass quietly. ModelScan handles that correctly by returning exit code 3 when it is given no supported files. The question to ask of any vendor's format list is what happens to the thirty-sixth file type.",{"type":135,"level":136,"id":106,"text":107},{"type":122,"content":251},[252],"The free path takes two commands: install the package, point it at a directory. What matters in CI is not the text output but the exit code, because 0 means clean, 1 means findings, and 2, 3 and 4 mean the scan did not really happen.",{"type":155,"code":254},"# CI gate: scan every model before it reaches the registry\npip install \"modelscan[tensorflow,h5py]\"\n\nmodelscan --path .\u002Fmodels --reporting-format json --output-file scan.json\nstatus=$?\n\n# 0 clean, 1 findings, 2 scan failed, 3 no supported files, 4 usage error\nif [ \"$status\" -ne 0 ]; then\n  echo \"modelscan returned $status: refusing to publish\"\n  exit 1\nfi",{"type":122,"content":256},[257],"Treat 2, 3 and 4 as failures. A scanner that crashes on a malformed archive, or skips a file type it does not know, prints something very close to a clean run unless the pipeline is built to notice. The PickleScan bypasses published by JFrog had exactly this shape: a file crafted so that the scanner errored or took another path, while PyTorch loaded it without complaint.",{"type":259,"variant":260,"title":261,"body":262},"callout","warn","Fail closed",[263],[264],"If a scan does not complete, the model does not ship. JFrog reported three critical PickleScan bypasses, CVE-2025-10155, CVE-2025-10156 and CVE-2025-10157, each rated CVSS 9.3: one renamed file, one corrupted ZIP checksum, one subclass import. They were fixed in version 0.0.31 on 2 September 2025. The lesson outlives the patch: any difference between how a scanner parses a file and how the framework loads it is a hole.",{"type":135,"level":136,"id":109,"text":110},{"type":122,"content":267},[268],"State it plainly: Guardian does not exist as a product any more. protectai.com\u002Fguardian returns 404, protectai.com itself now serves the Prisma AIRS pages, and the only first-party description left is a Hugging Face documentation page that still links the dead URL. The acquisition was announced on 28 April 2025 and completed on 22 July 2025, and the scanning capability now appears as Prisma AIRS AI Model Security, with Artifactory, GitLab and cloud-storage sources added in January 2026.",{"type":122,"content":270},[271],"ModelScan survived intact. The repository still sits under the protectai organisation under Apache-2.0 with 780 stars, and version 0.8.8 on PyPI is dated 18 February 2026. Its README still advises readers to consider Guardian and links to the dead page, which is as good a signal as any about the project's maintenance temperature: functional, quietly neglected, not abandoned.",{"type":122,"content":273},[274],"The commercial side has the same shape at a different address. There is no public price, only a demo request, and a number that arrives after a sales conversation. That is ordinary for security software; for an engineer costing a CI gate it means the paid tier has to beat free tools by enough to justify a procurement, and no published measurement shows that.",{"type":135,"level":136,"id":112,"text":113},{"type":122,"content":277},[278],"The weaknesses first. ModelScan covers three format families while free competition covers dozens. Reading a file statically says nothing about behaviour. There is no independent coverage measurement from the vendor, and the one independent benchmark available is unflattering: an August 2026 study of 135 labelled pickle and PyTorch families found ModelScan reached a definitive verdict on 49.6% of them, against 100% for ModelAudit and 81.5% for Fickling. When ModelScan did decide, its precision, recall and F1 were all 100%. And the paid tier has no price you can look up.",{"type":196,"head":280,"rows":289},[281,283,285,287],[282],"Tool",[284],"What it covers",[286],"Independent evidence",[288],"Cost",[290,298,306,315],[291,292,294,296],[203],[293],"35+ file types, 25+ threat categories",[295],"No published coverage measurement",[297],"On request, no public price",[299,300,302,304],[30],[301],"Pickle, TensorFlow SavedModel, Keras H5",[303],"Definitive verdicts on 49.6% of 135 labelled families",[305],"Apache-2.0",[307,309,311,313],[308],"ModelAudit",[310],"45 registered scanners, archives and configs",[312],"Definitive verdicts on 100% of those families",[314],"MIT",[316,318,320,322],[317],"Picklescan",[319],"Pickle bytecode only",[321],"Three CVSS 9.3 bypasses, fixed in 0.0.31",[314],{"type":122,"content":324},[325],"Read that third column as a failure-mode warning rather than a league table. A tool that returns a verdict on half of what it is shown, and is perfect on that half, is a tool that stays silent the rest of the time, and silence is what a CI gate reports as success. The same benchmark found that in the 48 malicious families ModelScan failed to analyse, ModelAudit and Fickling both detected the payload, while Fickling found no true positives beyond what the other two already covered. The conclusion is to run two scanners, not to buy a fifth.",{"type":259,"variant":327,"title":328,"body":329},"note","Two scanners, one gate",[330],[331],"A workable free gate: run ModelScan for its speed and its exit codes, add ModelAudit for format coverage, and fail the build if either reports findings or fails to finish. Both run offline. Note that packaged ModelAudit installs enable telemetry unless CI=true or NO_ANALYTICS=1 is set.",{"type":135,"level":136,"id":115,"text":116},{"type":122,"content":334},[335],"Protect AI's scanning is worth buying in its paid form only if Prisma AIRS is already on the purchase order; bought alone, it is a policy and audit layer priced like a platform. In its free form it is a narrow, useful CI gate that should never be the only one. The engineering judgement this review commits to is that model scanning is infrastructure, like a linter: it should be cheap, offline, exit-code driven and boring. A product whose main argument is a threat-intelligence feed is arguing about a different layer.",{"type":141,"ordered":174,"items":337},[338,340,342,344,346],[339],"Use ModelScan if you need a free, offline gate over pickle, TensorFlow and Keras files and you treat any non-zero exit code as a build failure",[341],"Use Prisma AIRS AI Model Security if provenance, policy enforcement and an audit trail are things your auditors already ask about; detection alone does not justify the price",[343],"Do not adopt either as your only control: the coverage numbers say a second scanner and a fail-closed rule matter more than the brand on the box",[345],"Do not plan around Guardian: the product name is retired, the URL is dead, and any migration advice that mentions it is out of date",[347],"Prefer safetensors and other non-executable formats where you can, because the strongest model-scanning policy is not needing the deserialiser at all",{"type":349,"content":350},"quote",[351],"A scanner that finishes only half of what it is shown is not a gate. It is a speed bump with a green light.",{"type":135,"level":136,"id":118,"text":119},{"type":141,"ordered":174,"items":354},[355,359,362,365,368,371,374,377,380,383,386],[356],{"tag":357,"children":358,"href":35},"a",[34],[360],{"tag":357,"children":361,"href":38},[37],[363],{"tag":357,"children":364,"href":41},[40],[366],{"tag":357,"children":367,"href":31},[43],[369],{"tag":357,"children":370,"href":46},[45],[372],{"tag":357,"children":373,"href":49},[48],[375],{"tag":357,"children":376,"href":52},[51],[378],{"tag":357,"children":379,"href":55},[54],[381],{"tag":357,"children":382,"href":58},[57],[384],{"tag":357,"children":385,"href":61},[60],[387],{"tag":357,"children":388,"href":64},[63],[390,458,528,584],{"slug":391,"published":392,"minutes":393,"category":7,"tags":394,"keywords":400,"about":413,"sources":421,"cover":452,"og":453,"expertise":67,"locales":454,"lang":69,"title":455,"description":456,"coverAlt":457},"llm-output-guardrails-moderation","2026-10-17",13,[395,396,397,398,399],"LLM security","Guardrails","Content moderation","OWASP","Output validation",[401,402,403,404,405,406,407,408,409,410,411,412],"llm output guardrails","improper output handling llm","owasp llm05","openai moderation api","omni-moderation-latest","llama guard 4","nemo guardrails streaming","markdown image exfiltration","sanitize llm output html","groundedness detection","llm content moderation production","output rails",[414,416,419],{"name":397,"url":415},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FContent_moderation",{"name":417,"url":418},"Cross-site scripting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCross-site_scripting",{"name":398,"url":420},"https:\u002F\u002Fowasp.org\u002F",[422,425,428,431,434,437,440,443,446,449],{"title":423,"url":424},"OWASP GenAI Security Project: LLM05:2025 Improper Output Handling","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm052025-improper-output-handling\u002F",{"title":426,"url":427},"OpenAI API Docs: Moderation","https:\u002F\u002Fplatform.openai.com\u002Fdocs\u002Fguides\u002Fmoderation",{"title":429,"url":430},"Meta: Llama Guard 4 model card and prompt formats","https:\u002F\u002Fwww.llama.com\u002Fdocs\u002Fmodel-cards-and-prompt-formats\u002Fllama-guard-4\u002F",{"title":432,"url":433},"NVIDIA NeMo Guardrails: Output rail streaming configuration","https:\u002F\u002Fdocs.nvidia.com\u002Fnemo\u002Fguardrails\u002Fconfigure-guardrails\u002Fyaml-schema\u002Fstreaming\u002Foutput-rail-streaming.md",{"title":435,"url":436},"Microsoft Learn: Prompt Shields in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fjailbreak-detection",{"title":438,"url":439},"Microsoft Learn: Groundedness detection in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fgroundedness",{"title":441,"url":442},"Microsoft Learn: Protected material detection in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fprotected-material",{"title":444,"url":445},"Guardrails AI documentation","https:\u002F\u002Fwww.guardrailsai.com\u002Fdocs",{"title":447,"url":448},"Vue.js docs: Security best practices","https:\u002F\u002Fvuejs.org\u002Fguide\u002Fbest-practices\u002Fsecurity.html",{"title":450,"url":451},"Simon Willison: Remote prompt injection in GitLab Duo leads to source code theft","https:\u002F\u002Fsimonwillison.net\u002F2025\u002FMay\u002F23\u002Fremote-prompt-injection-in-gitlab-duo\u002F","\u002Fimages\u002Fblog\u002Fllm-output-guardrails-moderation\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fllm-output-guardrails-moderation\u002Fog.jpg",[69,70,71],"LLM output guardrails: moderation, safe rendering and validation before anything acts","What to check after the model answers: safe Markdown rendering, schema checks before actions, moderation classifiers, streaming rails and groundedness.","Three narrowing rectangular frames stacked as a funnel, dots falling through to a tray beside a lock.",{"slug":459,"published":392,"minutes":460,"category":7,"tags":461,"keywords":465,"about":477,"sources":485,"cover":522,"og":523,"expertise":67,"locales":524,"lang":69,"title":525,"description":526,"coverAlt":527},"ai-red-teaming-checklist-llm-apps",12,[462,395,398,463,464],"AI red teaming","promptfoo","Penetration testing",[466,467,468,469,470,471,472,473,474,475,476],"ai red teaming checklist","llm red teaming","red teaming llm applications","owasp genai red teaming guide","promptfoo red team","garak llm scanner","pyrit red teaming","llm penetration testing","owasp top 10 llm 2025 testing","jailbreak testing llm app","red team rag chatbot",[478,481,484],{"name":479,"url":480},"Red team","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRed_team",{"name":482,"url":483},"Prompt injection","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPrompt_injection",{"name":398,"url":420},[486,489,492,495,498,501,504,507,510,513,516,519],{"title":487,"url":488},"OWASP GenAI Security Project: GenAI Red Teaming Guide (January 2025)","https:\u002F\u002Fgenai.owasp.org\u002Fresource\u002Fgenai-red-teaming-guide\u002F",{"title":490,"url":491},"OWASP GenAI Security Project: Top 10 for LLM Applications 2025","https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F",{"title":493,"url":494},"Bullwinkel et al. (Microsoft): Lessons From Red Teaming 100 Generative AI Products (2025)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2501.07238",{"title":496,"url":497},"NIST AI 600-1: Generative Artificial Intelligence Profile (July 2024)","https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002Fai\u002FNIST.AI.600-1.pdf",{"title":499,"url":500},"Promptfoo Docs: Red team quickstart","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fquickstart\u002F",{"title":502,"url":503},"Promptfoo Docs: Red team configuration","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fconfiguration\u002F",{"title":505,"url":506},"Promptfoo Docs: Red team plugins","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fplugins\u002F",{"title":508,"url":509},"Promptfoo Docs: Red team strategies","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fstrategies\u002F",{"title":511,"url":512},"NVIDIA garak: LLM vulnerability scanner (GitHub)","https:\u002F\u002Fgithub.com\u002FNVIDIA\u002Fgarak",{"title":514,"url":515},"Microsoft PyRIT documentation","https:\u002F\u002Fmicrosoft.github.io\u002FPyRIT\u002F",{"title":517,"url":518},"EU AI Act, Article 55: Obligations for providers of GPAI models with systemic risk","https:\u002F\u002Fartificialintelligenceact.eu\u002Farticle\u002F55\u002F",{"title":520,"url":521},"OWASP GenAI LLM Top 10 2026: final entries (GitHub)","https:\u002F\u002Fgithub.com\u002FGenAI-Security-Project\u002FGenAI-LLM-Top10\u002Ftree\u002Fmain\u002F2026\u002Ffinal","\u002Fimages\u002Fblog\u002Fai-red-teaming-checklist-llm-apps\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fai-red-teaming-checklist-llm-apps\u002Fog.jpg",[69,70,71],"AI red teaming checklist for LLM apps: what to attack before your users do","A practical red teaming checklist for LLM features: scope, OWASP 2025 test cases, promptfoo, garak and PyRIT, human testers and regression tests.","A clipboard list, then a crossed shield and a check at the end of a curved line.",{"slug":529,"published":530,"minutes":531,"category":7,"tags":532,"keywords":538,"about":549,"sources":559,"cover":578,"og":579,"expertise":67,"locales":580,"lang":69,"title":581,"description":582,"coverAlt":583},"slopsquatting-ai-package-hallucinations","2026-10-16",6,[533,534,535,536,537],"Supply chain security","Coding agents","npm","PyPI","Package hallucination",[539,540,541,542,543,544,545,546,547,548],"slopsquatting","package hallucination","ai hallucinated packages","llm package confusion attack","coding agent supply chain security","npm min-release-age","pnpm minimumReleaseAge","uv exclude-newer","npm ignore-scripts","huggingface-cli hallucinated package",[550,553,556],{"name":551,"url":552},"Typosquatting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTyposquatting",{"name":554,"url":555},"Supply chain attack","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSupply_chain_attack",{"name":557,"url":558},"Hallucination (artificial intelligence)","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FHallucination_(artificial_intelligence)",[560,563,566,569,572,575],{"title":561,"url":562},"Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.10279",{"title":564,"url":565},"Lasso Security, Bar Lanyado: Diving Deeper into AI Package Hallucinations (Mar 2024)","https:\u002F\u002Fwww.lasso.security\u002Fblog\u002Fai-package-hallucinations",{"title":567,"url":568},"npm Docs: config (min-release-age, before, ignore-scripts, allow-scripts)","https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fusing-npm\u002Fconfig",{"title":570,"url":571},"pnpm: Dependency resolution settings (minimumReleaseAge)","https:\u002F\u002Fpnpm.io\u002Fsettings\u002Fdependency-resolution",{"title":573,"url":574},"uv: Settings reference (exclude-newer, require-hashes)","https:\u002F\u002Fdocs.astral.sh\u002Fuv\u002Freference\u002Fsettings\u002F",{"title":576,"url":577},"pip documentation: Secure installs and hash-checking mode","https:\u002F\u002Fpip.pypa.io\u002Fen\u002Fstable\u002Ftopics\u002Fsecure-installs\u002F","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fog.jpg",[69,70,71],"Slopsquatting: when coding agents install packages that do not exist","How LLMs hallucinate package names, how attackers register them, and the registry, lockfile and agent-harness controls that stop the install.","Three boxes on a rail, the middle one hollow and offset, aligned squares on a tray below.",{"slug":585,"published":530,"minutes":531,"category":7,"tags":586,"keywords":590,"about":601,"sources":607,"cover":620,"og":621,"expertise":67,"locales":622,"lang":69,"title":623,"description":624,"coverAlt":625},"rag-poisoning-knowledge-base-attacks",[587,588,482,398,589],"RAG security","Data poisoning","Vector database",[591,592,593,594,595,596,597,598,599,600],"rag poisoning","knowledge base poisoning","poisonedrag","rag security","indirect prompt injection rag","owasp llm08 vector and embedding weaknesses","vector database security","rag data poisoning defense","hidden text prompt injection","secure rag ingestion",[602,605,606],{"name":603,"url":604},"Retrieval-augmented generation","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRetrieval-augmented_generation",{"name":482,"url":483},{"name":398,"url":420},[608,611,614,617],{"title":609,"url":610},"Zou et al.: PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2402.07867",{"title":612,"url":613},"Greshake et al.: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2302.12173",{"title":615,"url":616},"OWASP Gen AI Security Project: LLM08:2025 Vector and Embedding Weaknesses","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm082025-vector-and-embedding-weaknesses\u002F",{"title":618,"url":619},"OWASP Gen AI Security Project: LLM04:2025 Data and Model Poisoning","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm042025-data-and-model-poisoning\u002F","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fcover.webp","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fog.jpg",[69,70,71],"RAG poisoning: how a few documents can steer your assistant, and how to defend the knowledge base","How attackers plant documents that RAG systems retrieve, what PoisonedRAG and OWASP show, and the ingestion, retrieval and answer controls that limit it.","Sheets feeding a container on a belt, one carrying a small block, a gate before the exit.",1792261156469]