LLM
Safeguard articles tagged "LLM" — guides, analysis, and best practices for software supply chain and application security.
40 articles
Why LLMs Are Structurally Insecure (and What That Means for Your Pipeline)
Language models are not insecure because of a bug you can patch. They are insecure by construction — non-deterministic, context-poisonable, and unreproducible. Here is how to reason about them without pretending otherwise.
The Limits of Single-Model Vulnerability Scanning: A Technical Analysis of the Mythos Approach
Anthropic's Mythos model claims to find vulnerabilities in open-source code using a single LLM. We analyze where this approach falls short and why production-grade zero-day discovery requires Safeguard's Multi-Agent TAOR Deep Think AI Engine.
Why LLM-Based Vulnerability Scanning Needs More Than a Single Model
Large language models are being used to find vulnerabilities in open-source code. But a single model, no matter how capable, isn't enough. Here's why multi-agent orchestration, structured CWE analysis, and deep context matter more than model size.
LLM Traces and Evals: The Missing Layer in AI Supply Chain Security
Prompt traces and offline evals are standard hygiene for ML teams, but almost nobody treats them as supply chain telemetry. They should be. Here's how traces and evals plug into SBOM and reachability as a fourth security signal.
Prompt Injection in RAG: Indirect Attacks
A senior engineer's breakdown of indirect prompt injection in RAG pipelines, how real attacks land through retrieved content, and what actually reduces exposure.
AI Agent Tool Calling Security: Risks and Mitigations
AI agents that call tools -- APIs, databases, file systems, code interpreters -- convert non-deterministic LLM output into real-world actions. Securing this boundary is the defining challenge of agentic AI.
LLM-Augmented Bug Discovery Methodology
A practitioner's methodology for using LLMs to augment — not replace — traditional bug discovery workflows, with patterns that hold up under real review load.
Prompt Injection as a Supply Chain Risk: When AI Dependencies Are Exploitable
Prompt injection is not just an application vulnerability. When LLMs process content from the software supply chain -- package descriptions, README files, commit messages -- injection becomes a supply chain attack vector.
How to Use AI for Stock Trading (and the Risks Nobody Mentions)
Using AI for stock trading means applying models to signals, screening, and execution, but the security and reliability risks are as important as the strategy. Here is a grounded look.
Typosquatting Meets AI: The New Threat of AI-Generated Package Names
AI code assistants recommend packages that do not exist, and attackers are registering those hallucinated names. This new typosquatting vector exploits the trust developers place in AI suggestions.
Security Testing for LLM-Powered Applications
Applications built on large language models introduce novel attack surfaces that traditional security testing does not cover. This guide addresses the specific testing methodologies needed for LLM applications.
The Full Form of MCP: What Model Context Protocol Means for Security
The full form of MCP is Model Context Protocol, the open standard that lets AI models talk to tools and data. Here is what it is and where the security risks live.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.