AI Security
RAG Poisoning In The Wild: Trend Watch
Retrieval-augmented generation was the 2024 success story. 2026 is when RAG poisoning moved from research to production incidents.
Mar 3, 20262 min read
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Retrieval-augmented generation was the 2024 success story. 2026 is when RAG poisoning moved from research to production incidents.
A vulnerable transitive dependency may require upgrading an ancestor. Griffin AI computes the cascade; Mythos-class tools often stop at the first level.
The EU Cyber Resilience Act requires vendors to ship secure-by-default products, provide SBOMs, and report exploited vulnerabilities within 24 hours. Here is a concrete compliance path.
Alpine, distroless, and scratch images don't automatically cut risk. The real attack-surface drivers are capabilities, root filesystem, network policies, and seccomp.
A senior engineer's view of six years of npm protestware, from colors.js to peacenotwar, and the supply chain lessons that still apply to modern JavaScript shops.
How the right-to-repair movement is reshaping software supply chain obligations in 2026, from firmware transparency to the security implications of mandated component access.
EU AI Act enforcement began in 2026. Vendors sold as "AI security tools" are now high-risk systems with documentation obligations. The shape of the documentation matters.
A vulnerability in version 1.2.0 may not affect your 1.3.5 install if the fix reshaped the call signature. Version-aware resolution is where deterministic engines beat pure-LLM heuristics.
Nullcon Berlin 2026 delivered a dense European view of software supply chain research. Here are the themes and sessions that mattered most to defenders.
Weekly insights on software supply chain security, delivered to your inbox.