AI Security
Can a README or docs page prompt-inject your coding agent?
Yes. Any text an agent reads can steer it. See how indirect prompt injection reaches agents through docs and the permission habits that limit the damage.
Oct 18, 20265 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
Can a README or docs page hijack an AI coding agent?
Yes. Any text an agent reads can act as an instruction. Defenses that hold: least privilege, human approval for risky actions, docs treated as untrusted.
Oct 18, 20264 min read
AI Security
Can a README hijack your coding agent? A defensive checklist
Coding agents read READMEs and docs as context, and any file can carry instructions. Use this checklist to limit what a poisoned page can make them do.
Oct 18, 20264 min read
AI Security
Port cranes: what automation and AI agents add to the threat model
Ship-to-shore cranes are remotely programmable machines. See what US authorities have said and a threat model for terminals adding AI planners and robots.
Oct 18, 20265 min read
AI Security
Why are pickle model files risky, and how do you check provenance?
Loading a pickle file can run code. Prefer safetensors, load weights only from sources you can verify, and record where every model came from.
Oct 18, 20264 min read
AI Security
What is OWASP LLM10 unbounded consumption? A worked example
LLM10 covers uncontrolled inference that causes outages, surprise bills and model theft. See a worked scenario and the OWASP controls that stop it.
Oct 18, 20264 min read
AI Security
OWASP LLM09 misinformation: real cases and how to reduce it
LLM09 misinformation means confident wrong answers from a model. See OWASP cases, from a chatbot lawsuit to invented packages, and how to reduce the risk.
Oct 18, 20264 min read
AI Security
LLM09 misinformation: what should you log and alert on?
Log the prompt, sources, model version and review outcome for consequential answers. Alert on ungrounded claims, unknown packages and unreviewed actions.
Oct 18, 20264 min read
AI Security
OWASP LLM09 misinformation: which controls actually work?
LLM09 covers confident but false model output. Grounding, validation and trained review help. Disclaimers alone do not. Start with your high-stakes uses.
Oct 18, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.