All posts
-
What Is a Prompt Injection Attack? Definition, Types, and Defenses
A prompt injection attack manipulates an LLM's instruction-following logic to override intended behavior. Ranked OWASP LLM01:2025, it affects chatbots, RAG pipelines, and autonomous AI agents alike.
-
AI Security Week: May 22, 2026
Google says it caught attackers using an LLM to find a zero-day, peer-reviewed research shows reasoning models can autonomously jailbreak other models, and a look back at the month's AI-infrastructure CVEs. Verify all specifics against primary sources.
-
AI Security Week: May 18, 2026
A self-propagating npm/PyPI worm sweeps up AI SDKs including Mistral AI and Guardrails AI, two critical RCE classes in the vLLM inference server, and the U.S. CAISI signs frontier-model pre-deployment testing agreements. Verify all specifics against primary sources.
-
AI Security Week: May 13, 2026
A critical pre-auth SQL injection in LiteLLM lands in CISA's KEV catalog, the EU reaches a provisional deal to delay and reshape the AI Act, and Microsoft details how prompt injection becomes RCE in agent frameworks. Verify all specifics against primary sources.
-
AI Security Week: May 10, 2026
Analysis and commentary: training-data poisoning as a durable class, ATLAS as a finding taxonomy, red-teaming through the data channel, and the EU AI Act's staged timeline. Verify all specifics against primary sources.
-
AI Security Week: May 9, 2026
Analysis and commentary: RAG retrieval as an injection channel, insecure output handling as the under-built control, the OWASP LLM Top 10 as an application checklist, and excessive agency in agent designs. Verify all specifics against primary sources.
-
AI Security News Weekly Digest: What to Track and Where
A practitioner's guide to building and consuming a reliable AI security news weekly digest — covering threat categories, authoritative sources, and the signal worth your attention each week.
-
AI Security Week: May 8, 2026
Analysis and commentary: the NIST AI RMF and its Generative AI Profile as a control map, the model/data supply-chain compromise class, why model extraction is a real business risk, and a defender's reading of safetensors. Verify all specifics against primary sources.
-
AI Security Week: May 7, 2026
Analysis and commentary: the durable shape of the EU AI Act timeline, MITRE ATLAS as a shared attack vocabulary, the recurring SSRF class in LLM-tool integrations, and why agent tool-use is the surface to watch. Verify any CVE or date against primary sources.
-
AI Security Week: May 6, 2026
Analysis and commentary: AI provider usage-policy direction for security research, multi-modal (image-embedded) prompt injection, AI-security certification trends, and the recurring ML-library CVE classes. Verify any CVE ID or fixed version against NVD/vendor advisories.
-
AI Security Week: May 5, 2026
Analysis and commentary: why machine-unlearning guarantees are weak, the RAG-exposure misconfiguration class, ENISA-style AI incident-response practice, and the recurring ML-deserialization risk class. Verify any CVE or version specifics against primary advisories.
-
AI Security Week: May 4, 2026
Analysis and commentary: transfer-resistant adversarial-example research, the recurring typosquat/supply-chain class against ML packaging, NIST AI RMF direction, and why AI-assisted phishing is the realistic near-term risk. Verify specifics against primary sources.
-
Understanding the OWASP LLM Top 10: What Matters Most
OWASP published the LLM Top 10 in 2023 and updated it in 2025. The list is useful but requires interpretation. Here's which items are operationally relevant vs. theoretically important, and what to prioritize.
-
AI Security Week: May 3, 2026
Analysis and commentary: Anthropic's safety-research posture, the recurring class of path-traversal issues in LLM middleware, EU AI Act enforcement direction, and why prompt-injection incidents in regulated industries are credible. Verify specifics against primary advisories.
-
AI Security Year in Review: 2025
The five most consequential AI security developments of 2025: the shift from theoretical to operational attacks, the supply chain compromise wave, regulatory enforcement reaching AI, and what actually improved.
-
What this site is for
AI Sec Digest is a daily, primary-source-only digest of AI security news — breach disclosures, exploited CVEs, and regulatory action, with the hype filtered out.