AI Security
Safeguard articles tagged "AI Security" — guides, analysis, and best practices for software supply chain and application security.
100 articles
What should you ask about the model behind a security AI feature?
Ask which model powers the feature, where it runs, what data it sees, whether customer data trains it, and what happens when the model changes. A buyer's list.
What should you ask a vendor that uses AI under NYDFS guidance?
NYDFS says to consider vendors' AI threats and add contract terms for notice and secure use of nonpublic information. Eight diligence questions to ask.
How do you test a vendor's AI feature for prompt injection safely?
Run a safe prompt injection test on a vendor AI feature using a sandbox repo, harmless planted instructions, and clear pass criteria. Steps and what to record.
Is prompt injection worse when an AI task runs on a schedule?
Yes, in one way: no person is watching. Scheduled tasks read untrusted data on their own. Here is how routine fire text and fetched content are handled.
What permission questions should you ask about agent tools in a demo?
Eight questions that reveal how a security product handles agent tool permissions: scope, identity, approval, revocation and records. Ask them live.
Can an OpenAI Responses API call reach a private MCP server?
The Responses API reaches public MCP servers by URL and private ones through a tunnel. Learn what that means for security tools, with steps and a table.
Does OpenAI retain MCP tool data? What store=true means
OpenAI's docs say store=true keeps data 30 days unless zero data retention applies, and MCP servers have their own policies. What security teams check.
How do OpenAI Code Interpreter containers expire and handle files?
OpenAI Code Interpreter runs in sandboxed containers that expire after 20 idle minutes. How lifetime, memory tiers, and files affect security design.
ONNX custom operators: when a model needs a native library to run
ONNX Runtime custom operators are native code shipped as a shared library. What that means for model intake, and the questions to ask before you load one.
Why are wildcard scopes dangerous for AI agent tokens?
Scopes like all or admin star hand an AI agent every tool at once. What the MCP guidance says about scope minimization and how to design smaller scopes.
Offboarding AI coding assistants and MCP configs for leavers
When a developer leaves, also revoke AI assistant seats, API keys and MCP server credentials, and check agent configs for tokens tied to that person.
What does NYDFS AI guidance mean for teams using AI tools?
NYDFS's October 2024 AI letter applies Part 500 controls to AI: risk, vendors, access, training, monitoring. A checklist.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.