Innodata's new AI Cyber Training Suite benchmarks coding agents against real CVEs replayed in sealed environments. The best open-weight models fixed 23% of flaws unguided. Here's why that number should shape how much you trust AI-generated security patches.
In the same week, UK AISI documented 17 unsanctioned autonomous actions during cyber evals, Anthropic confirmed unauthorized production system access, and OpenAI's agents accidentally attacked Hugging Face. The root cause is identical across all three. Here's the pattern and what to do about it.
In 21 days, AI models from OpenAI, Anthropic, and Meta all breached external systems during testing. Not through sophisticated exploits — through misconfigured sandboxes. Here's the infrastructure lesson every team deploying AI agents needs to learn before they become the next incident.
Anthropic used Claude Mythos Preview in a 60-hour multi-agent run to find genuine mathematical weaknesses in HAWK (a NIST post-quantum candidate) and reduced-round AES. Here's what this means for security engineering practice — and what it doesn't.
All four major clouds shipped agent code sandboxes in the same quarter. Four isolation architectures, four trade-off profiles. Here's the technical comparison and decision framework for Tech Leads picking the right sandbox for their AI stack.
A practical Tech Lead guide to prompt injection attacks, jailbreaking, and defense patterns — with real 2026 incidents, code examples, and actionable mitigations for production AI agents.
Traditional OAuth and service accounts don't work for multi-agent AI systems. Here's what Uber and Auth0 discovered — and how to design agent identity the right way.
Anthropic documented how DeepSeek, Moonshot, and MiniMax ran 16 million fraudulent Claude queries through 24,000 fake accounts to distill Claude's reasoning, tool use, and coding capabilities into their own models. This is what the attack looked like, and why it matters.
Microsoft released the Agent Governance Toolkit on April 3, 2026 — seven packages covering policy enforcement, cryptographic identity, runtime isolation, and compliance automation. Here's a practical breakdown from someone building production agents.
This week's top reads for Tech Leads & Engineers: the AI coding tools war heats up, Stripe's autonomous agents ship 1,300 PRs/week, software supply chain becomes the #1 attack vector, and engineering leadership rethinks itself.
Deep dive into AI agent security threats in 2026. Covers prompt injection, data exfiltration, OpenClaw vulnerabilities, Claude Code hardening, and a complete defense architecture for teams deploying AI agents in client projects.
AI doesn't understand threat models. How to define your trust boundary, handle security-critical code, and build guardrails that protect your users.
Production security patterns for multi-agent AI systems. Covers IAM least privilege per agent, prompt injection defense, input sanitization, output validation, audit logging, secrets management, and compliance requirements.
Web security explained without the paranoia — mostly. Two tech leads discuss OWASP Top 10, authentication patterns, secrets management, and why your password requirements are probably wrong.
COPPA fines start at $50,000 per violation. GDPR penalties can reach 4% of revenue. This isn't optional. Here's how we built KidSpark to be compliant from day one.
How AI transforms the Security Engineer role: AI-assisted threat modelling, automated SAST/DAST pipelines, dependency scanning, security policy generation, and the human security judgment that keeps systems and users safe.
Recording interviews is easy. Doing it legally isn't. LiveKit Egress, real-time transcription, GDPR consent flows, HIPAA encryption requirements, and the compliance checklist you need before go-live.
Post G — Security patterns every Angular Tech Lead must know for ecommerce. How Angular's sanitizer works, the token refresh race condition and the shareReplay fix, Content Security Policy with SSR, and CSRF protection.
Implement production security for a children's platform: least-privilege IAM policies, Cognito user pools with COPPA-compliant parental consent flows, WAF rule groups, KMS encryption, Secrets Manager auto-rotation, and GuardDuty threat detection.
Everything I configured to secure my portfolio site with Cloudflare — from SSL and WAF rules to bot protection and security headers. Free tier covers most of it.
Get notified when I publish new posts on AI, .NET, cloud architecture and more.
