AI Security
Tabletop script: your AI assistant installs a fake package
A 45 minute tabletop script for a coding assistant that recommends a nonexistent package an attacker then registers: detection, scope, policy fixes.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Tabletop script: a connected MCP server starts misbehaving
A 45 minute tabletop script for an MCP server that changes behaviour after an update: find who connected it, limit tool access, review logs, set approvals.
Oct 19, 20263 min read
AI Security
Tabletop scenario: an AI coding agent installs a lookalike package
A 60 minute tabletop where an AI coding agent installs a near match package: injects, questions on tokens and sandboxes, and what good answers look like.
Oct 19, 20264 min read
AI Security
Should you log an AI agent's reasoning text in the audit trail?
Reasoning text is not a reliable record of intent. Log actions, approvals and outcomes in the audit trail, and keep reasoning in short-lived debug logs.
Oct 19, 20264 min read
AI Security
Load prompts from a database or keep them in the build?
Keep prompts in the build by default. Runtime loading lets anyone with database access change behavior without review. When each option makes sense.
Oct 19, 20264 min read
AI Security
Should you assign vulnerability alerts to an AI agent?
Platforms now let you assign alerts to AI agents that open draft fix PRs. Here is what that changes in the exposure window and which controls to keep.
Oct 19, 20264 min read
AI Security
Should we ban shadow AI or run an amnesty first?
When a ban works, when an amnesty finds more, and how to run a two week disclosure window that ends in an approved list. A guide for engineering leaders.
Oct 19, 20264 min read
AI Security
Should research mode be allowed to call security connector tools?
Research runs can call connector tools without more approvals. Turn off write tools first and keep sensitive reads narrow. A guide for security teams.
Oct 19, 20266 min read
AI Security
Is it safe to paste an SBOM into an LLM chat?
An SBOM looks harmless, but it can reveal internal names, versions and structure. Here is what to check before sharing one with an AI assistant.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.