Archive
Format: Research explained
-
An AI security checklist should start with access, data and deployment ownership
Wiz’s general guidance supports a deployment review, not a claim that Amazon Bedrock suffered a data breach.
-
Hexstrike-AI reporting points to attacker interest in automated exploitation
Check Point’s analysis mixes observed criminal discussion with claims about how much AI orchestration can accelerate attacks.
-
Lenovo chatbot research highlights output-handling risks in AI support tools
Reported cross-site scripting involved the surrounding chatbot application, rather than proof of a vulnerability in GPT-4 itself.
-
Brave demonstrated how a web page could redirect Comet’s browsing assistant
The browser research connected attacker-controlled page text with actions available through an authenticated assistant.
-
LLM security starts with the data and tools a model can reach
A vendor primer offers a useful starting point for reviewing prompt injection, information exposure and unsafe model outputs.
-
Enterprise assistant research shows how connected tools can amplify prompt injection
Zenity’s demonstrations concerned assistant permissions and connected workflows, rather than a confirmed breach across enterprise AI products.
-
Healthcare breach-cost figures need context before they become an AI-risk claim
A reported average breach cost describes a study population, not the expected loss from every AI incident.
-
Historical Gemini demonstration used hidden email instructions to fabricate warnings
The reported proof of concept manipulated an email summary; it is not evidence that a real Google security warning was issued.
-
Enterprise ChatGPT security starts with the data paths around the model
Review identities, connectors, retention, and access to internal information—not only the chat interface.
-
AI-security product claims need an evidence-based evaluation
Qualys describes its approach to AI and LLM risk. Read it as a vendor product account, not a breach disclosure.
-
How to read a vendor’s mapping to the OWASP LLM Top 10
A product-coverage mapping is useful for evaluation, but it is not an incident report or a guarantee.
-
EchoLeak: what a historical zero-click Copilot flaw teaches about trust boundaries
A published case study examines how an email could cross an AI assistant’s data-access boundaries.