8 articles tagged ai-security
The word agent gets used for a chatbot with a system prompt, a script in a loop, and a system that plans and acts on its own. Three different animals. Only one can hurt you. A red teamer's guide to what an AI agent actually is and what agentic really means.
Every team is wiring agents to MCP servers with the same casual trust they once showed Dropbox installs. The attackers have already noticed.
Claude Code is the best AI tool I've found for offensive security, but these concepts work with Gemini and other powerful AI agents too. Here's how to build your first AI red team skill and why it changes everything about how you operate.
Most AI security tools test for prompt injection with a list of 50 known payloads. That's a scanner, not a pentester. Here's how to build an AI that actually thinks like an attacker.
Your company's AI chatbot trusts its vector database like gospel. I can change what it believes with a single document. Here's how RAG attacks work and how to test for them.
A jailbroken chatbot says something embarrassing. A jailbroken AI agent with database access and API keys does something catastrophic. Here's how to test agent security before an attacker does.
One AI agent found the vulnerability. A second built the exploit. A third exfiltrated the data. The whole operation took 4 minutes. Here's how to run coordinated AI red team operations.
The hardest part of any pentest isn't finding the vulnerabilities. It's explaining them to someone who doesn't know what a prompt injection is. Here's how AI generates better reports than most consultants.