How security teams use AI, how to do it well, and what it means for your job. Written for people who defend the company, not people who build models.
Bernie Sanders wants to pause AI and outlaw superintelligence. Here is what a pause would and would not fix for cyber risk, open-weight models and AI agents.
Black October explained: the October 21 PHP disclosure, AI agent attack traffic, Storm-0940's three-hour cloud takeover, and why patching may not be enough.
A creator reported swarms of AI agents, leaked Railway API keys and PHP panic. Here is what is unverified and the security steps worth taking now.
GoodFire research suggests AI neurons that look random, like a car-and-cat unit, may share a concept such as pose. What it means for AI safety and reading LLMs.
A checklist for this week's incidents: PHP, Node.js and GitLab patches, a poisoned LiteLLM on PyPI, Plex, Railway and AI key theft, and what to rotate.
Steps for consumers and site owners after the PHP flaws: hardware keys, fewer accounts, patch and confirm, OAuth, and family verification phrases.
How Calif researchers used OpenAI and Gemini models plus a reusable skill file to turn a PHP out-of-memory bug into WordPress RCE, and what it means.
Two critical PHP flaws, found with AI help, led the NSA and Japan to urge patching or taking sites offline. Here is what happened and who is exposed.
DeepSeek Recipe keeps user-typed control markers as plain text, blocking a classic injection trick. Here is how the failure works and how to test it yourself.
Microsoft Agent 365 and Project Perception give agents their own identity, time-bound permissions and risk-based access. Here is how the pieces fit.
How the EU AI Act, state right-to-compute laws like Montana's SB 212, and Meta's Llama license shape open source AI rules, and what builders should check.
Learn how to secure shadow AI agents built by employees: inventory them, limit access, add human checkpoints, and defend against prompt injection and EchoLeak-style attacks.
How AI-generated code affects open-source quality, from F-Droid and Flathub app slop to curl's ended bug bounty, with data from GitClear, Apiiro and METR.
Who pays when rented facial recognition causes a false arrest? See NIST error data, the Workday ruling, settlements, and the SaaS contract terms that shift risk.
Learn how to audit AI agents with per-agent cryptographic identity, per-action authorization, and tamper-evident logs, based on NSA and Five Eyes guidance.
Employees are giving AI agents access to email and company systems. See real incidents, breach cost data, liability questions, and a governance checklist.
Epic's sepsis model scored 0.63 AUC in Michigan Medicine testing versus a claimed 0.76 to 0.83, and missed 67% of sepsis cases. See why it failed.
Moffatt v. Air Canada explained: how a BC tribunal held the airline liable for its chatbot's false refund advice, the CA$812.02 award, and what it means for AI bots.
What are the risks of third-party API dependencies? See how CrowdStrike, AWS, and Starlink outages cost billions, plus a due-diligence checklist to reduce risk.
Learn how to secure and govern AI agents with a 7-step containment model: inventory, autonomy tiers, least privilege, sandboxing, approval gates, and monitoring.
Datadog shut down CoScreen in 2026, four years after buying it. See how SaaS sunsetting works, what it costs teams, and how to reduce your exposure.
Can you opt out of AI scraping? Robots.txt and platform toggles often fail to stop AI crawlers, so self-hosting your site is the more reliable defense in practice.
HTTP header prompt injection hides instructions in response metadata that AI agents read. Learn how it works, how common it is, and a 6-step prevention checklist.
Withings now charges new accounts $99.99/year for Apple Health and Health Connect sync. See who is affected, what stays free, and why the change matters.