AI Security
Can an AI agent pass its permissions to another agent?
A delegate agent should never exceed what its caller may grant. Delegation rules between agents: narrower scope, shorter life, own identity, linked logs.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Can an AI agent approve its own action?
No. An agent that approves its own action is not a control. Put approval and authorization outside the model, in systems it cannot edit. Here is how.
Oct 19, 20264 min read
AI Security
Can a vulnerability description hijack your AI chat session?
Yes, in principle. Text returned by a tool can carry instructions a model may follow. How prompt injection works through connectors and how to limit it.
Oct 19, 20266 min read
AI Security
Can a vulnerability advisory or ticket attack the LLM that reads it?
Advisories, issues and scanner output contain third party text. If an LLM reads it, hidden instructions can steer it. How to reduce that risk.
Oct 19, 20264 min read
AI Security
Can a comment or advisory text steer an AI-generated fix?
Yes, indirect prompt injection can ride in on code comments, issue text or package metadata a fix generator reads. How to contain it with controls.
Oct 19, 20264 min read
AI Security
Are TensorFlow models code? Why untrusted models need a sandbox
TensorFlow's security guidance says a model is a program, so an untrusted model equals untrusted code. Here is what that means and how to isolate one.
Oct 19, 20263 min read
AI Security
Are prompt templates part of your software supply chain?
Yes. A prompt template steers a model like code steers a program, so it needs an owner, review, versioning and a change record like any dependency.
Oct 19, 20264 min read
AI Security
Are MCP tool descriptions and annotations trustworthy?
No. The MCP specification says clients must treat tool annotations as untrusted unless the server is trusted. What that means when you buy a connector.
Oct 19, 20266 min read
AI Security
How do you set approval tiers for AI agent actions by reversibility?
Tier agent actions by how easily they can be undone: auto, notify, approve, or block. A simple reversibility test and a table you can adopt this week.
Oct 19, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.