AI Security
GPAI models with systemic risk: Articles 51 and 55 explained
How a general-purpose AI model is classed as systemic risk, the compute presumption, and the extra duties: testing, incident reports and security.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
AI Overviews and the glue on pizza answer: what Google said went wrong
In May 2024 Google explained odd AI Overviews answers: data voids, satire and forum posts. What it said, which examples were faked, and what changed.
Oct 18, 20263 min read
AI Security
The first hour after an AI agent is hijacked: a response plan
An agent followed injected instructions and acted. In the first hour: stop it, revoke its access, preserve logs, scope the damage, then fix the path.
Oct 18, 20263 min read
AI Security
Can fine-tuning weaken a model's safety? What research found
Research shows custom fine-tuning can erode safety alignment, even with benign data. What it means and how to test a tuned model before shipping.
Oct 18, 20263 min read
AI Security
False RAG entry injection: what it is and why it evades monitoring
A fake document hidden inside a normal RAG entry can be treated as a separate result. What ATLAS says about it and how to reduce the exposure.
Oct 18, 20263 min read
AI Security
Excessive agency in AI agents: a three-cause checklist
OWASP names three root causes of excessive agency: too much functionality, permission and autonomy. Use this checklist to review each agent you build.
Oct 18, 20263 min read
AI Security
EU AI Act Article 15: cybersecurity for AI specific attacks
Article 15 asks high-risk AI to resist data poisoning, model poisoning, adversarial examples and confidentiality attacks. What it means for security teams.
Oct 18, 20263 min read
AI Security
Does RAG or fine-tuning stop prompt injection? Myth vs fact
Myth: grounding a model with RAG or fine-tuning prevents prompt injection. Fact: OWASP says research shows neither fully mitigates it. What to do instead.
Oct 18, 20263 min read
AI Security
Does EDR see prompt injection? Myths and facts
EDR watches processes and files, so it usually cannot read a prompt or judge an agent's intent. Myths and facts about what existing tools miss in AI.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.