Latest AI and tech news

In the week of October 21, three security stories broke almost at once: PHP2Shell, Node2Shell, and a backdoored LiteLLM 1.107.0 release. This article explains what each incident was and how it was exploited, then walks through how we checked our own stack. We close with the five supply chain control

For the past few months, we have watched AI agents fail in ways no security checklist expected. This article is our answer: the Autonomous Agent Audit (AAA), what it does well today, and where we are taking it next.

Security teams still measure AI risk with catalogs of attack techniques, yet incident records point elsewhere: practitioners in the OWASP GenAI working group ranked prompt injection first and misinformation last, while hallucination is among the top causes of real incidents. This article argues that

StereoTales, Giskard's paper on harmful stereotypes in large language models, has been accepted at NeurIPS 2026, the largest peer-reviewed conference in machine learning. The study prompted 23 frontier models to write more than 650,000 stories in 10 languages, and found that every model produces ass

AI agents are now connected to core business systems, and security teams are often asked to test them the same way they test web applications. But penetration testing relies on a clear pass/fail result, and LLMs don't provide one: the same prompt can succeed on one run and fail on the next, and whet

AI agents are now connected to core business systems, and security teams are often asked to test them the same way they test web applications. But penetration testing relies on a clear pass/fail result, and LLMs don't provide one: the same prompt can succeed on one run and fail on the next, and whet

Every AI guardrail vendor ships the same feature list: prompt injection, PII, toxicity, jailbreaks. None of it tells you whether the filter will block a banking customer who reports a stolen card. In our RealHarm research, up to 40% of requests blocked by generic guardrails were false positives (leg

Giskard Hub 3.0 lets you red team any agent that speaks JSON (a classification service, an extraction pipeline, a scoring API) not only conversational ones. Test cases become scenarios made of interactions, with checks attached to the turn that matters instead of a single verdict on the final reply.

OWASP published the 2026 Top 10 for LLM Applications with the biggest reorder yet, one renamed entry, and a new evidence layer built from 7,714 real incidents. This guide walks through what moved, why, and how to test each category before production.

We built a banking assistant with 17 known vulnerabilities and pointed four AI red teaming tools at it: Garak, Promptfoo, Claude Code running Opus 4.8, and our own Agentic Red Teamer. Garak found 2, Promptfoo found 1, Claude Code found 7, and ART found 10. This article explains what ART is, how the

On July 16, 2026, Hugging Face disclosed that an autonomous AI agent had breached its production infrastructure, entering through a malicious dataset that exploited two code-execution paths in its data-processing pipeline. OpenAI later confirmed the agent was its own: models running an internal cybe

Phare (Potential Harm Assessment & Risk Evaluation) is an independent, multilingual benchmark that evaluates AI models across four critical dimensions, or "modules": hallucination, bias, harmfulness, and vulnerability to jailbreaking attacks. This update adds 13 new models — including GPT 5.5, Claud

In this article, we compare 9 leading AI agents red teaming tools for 2026, evaluating their attack coverage, automation depth, and enterprise integration, to help you detect vulnerabilities in your AI systems.

When given the freedom to write stories, do frontier LLMs fall back on harmful stereotypes? Giskard's R&D team prompted 23 leading models to generate over 650,000 open-ended stories across 10 languages, then analyzed the demographic associations they produced. Every single model generated harmful st

When your LLM vulnerability scanner detects a threat, it relies on an LLM judge to decide whether the attack succeeded. Using one LLM to evaluate another can bring some failures into your evaluation pipeline (false positives, model drift, or context blindness). This article walks through how we meta

A X user sent a morse code message tricking Grok into authorizing a $150,000 crypto transfer. This is a prompt injection attack against an autonomous AI agent. In this article we explain how an input obfuscation allowed the heist to occur, and how to test your own agents to prevent this type of fail

Giskard has launched Guards, the first independent, EU-sovereign guardrail platform that allows regulated enterprises to secure their AI applications on-premise. Moving beyond the limitations of generic content filters, the platform is context-aware and built specifically for modern AI agents, secur

In April 2026, a Cursor AI coding agent running Claude Opus 4.6 deleted a startup's entire production database and every backup in a single API call, in nine seconds. This incident is a case of "Excessive Agency," where over-privileged credentials and autonomous reasoning loops bypass security contr

In this article, we analyze Anthropic's newly announced Claude Mythos model and its announced capabilities in automated vulnerability discovery and exploit generation. We explore how this frontier model impacts the cybersecurity landscape.

Since its creation, Giskard has been on a mission to help teams ship AI they can trust. Today, we are thrilled to announce Giskard v3, a complete evolution of the library designed for the modern landscape of Large Language Models (LLMs) and sophisticated AI agents.

On 24 March 2026, two malicious versions of the widely used LiteLLM Python library (1.82.7 and 1.82.8) were published to PyPI. The compromised packages ran a credential-stealing attack that exfiltrated secrets (SSH keys, cloud provider sessions, Terraform state, etc.) and attempted lateral movement

Shadow AI happens when employees bypass IT to use unapproved generative AI tools, creating severe data leakage and compliance vulnerabilities. In this article, we explore the specific risks associated with these unvetted models, such as intellectual property leaks and flawed business decisions. Fina

Giskard recently embarked on a rebranding journey to align our friendly, community-loved visual identity with our deep expertise in AI security. By collaborating with talented designers, we refreshed our green colour palette, introduced modern typography, and gave our beloved turtle mascot, Sophia,

Chain-of-Thought (CoT) Forgery is a prompt injection attack where adversaries plant fake internal reasoning to trick AI models into bypassing their own safety guardrails. This vulnerability poses severe risks for regulated industries, potentially forcing compliant agents to generate unauthorized adv

This article explores the critical security failures of the OpenClaw agentic AI, which allowed sensitive data to leak across user sessions and IM channels. It examines how architectural weaknesses in the Control UI and session management created direct paths for prompt injection and unauthorized too

MCP servers pose significant MCP security risks due to their ability to execute commands and perform API calls. Even "official" Model Context Protocol setups face MCP vulnerability and tool poisoning. In this article, you'll learn the primary MCP security issues, from injection attacks to supply cha

A recent AI incident in healthcare revealed how an automated transcription agent accidentally leaked patient data by joining a meeting via a former employee's stale calendar invite. This failure shows the risk of "Shadow AI" and sensitive information disclosure when agentic tools operate without str

The New York Times has sued Perplexity, alleging that the AI startup's search engine unlawfully processes copyrighted articles to generate summaries that directly compete with the publication. The lawsuit further accuses Perplexity of brand damage, citing instances where the model "hallucinates" mis

A recent ruling by the tribunal judiciaire of Périgueux exposed an AI failure where a claimant submitted "untraceable" precedents, underscoring the dangers of unchecked generative AI in court. In this article, we cover the anatomy of this hallucination event, the systemic risks it poses to legal cre

This article examines "Best-of-N," a sophisticated jailbreaking technique where attackers systematically generate prompt variations to probabilistically overcome guardrails. We will break down the mechanics of this attack, demonstrate a realistic industry-specific scenario, and outline how automated

In November 2025, ChatGPT, Microsoft Copilot, Google Gemini, and Meta AI were caught giving UK consumers dangerous financial advice: recommending they exceed ISA contribution limits, providing incorrect tax guidance, and directing them to expensive services instead of free government alternatives. I

The Top 10 for Agentic Applications, released in December 2025, lists the highest-impact threats to autonomous AI agentic applications, systems that plan, decide, and act across tools and steps. It distills the top threats in a practical manner, building directly on prior OWASP work while highlighti

Phare (Potential Harm Assessment & Risk Evaluation) is an independent, multilingual benchmark designed to evaluate AI models across four critical dimensions, or “modules”: hallucination, bias, harmfulness, and vulnerability to jailbreaking attacks. This second version expands our evaluation to inclu

Agentic Tool Extraction (ATE) is a multi-turn reconnaissance attack to extract complete tool schemas, function names, parameters, types, and return values. ATE exploits conversation context, using seemingly benign questions that bypass standard filters to build a technical blueprint of the agent's c

There are three major tools for assessing risks associated with LLMs and AI Agents: OWASP, MITRE Attack and NIST AI RMF. Each of them has its own approach to risk and security, while examining it from different angles with varying levels of granularity and organisational scope. This blog will help y

Healthcare employees in Hyderabad have noticed a disturbing direction in self-doctoring: two of their patients relied on generic AI chatbot advice for their healthcare interventions, and some of them suffered serious medical consequences. Two recent cases demonstrate the vulnerability of misguidance

Tree of Attacks with Pruning (TAP) automates the discovery of prompt injection vulnerabilities in LLMs through systematic trial and refinement. In this article, you'll learn how TAP probe works, see a concrete example of automated jailbreaking in a business context, and understand how to incorporate

A massive phishing campaign impersonating Australian government services sent over 270,000 fake emails in four months, with security researchers pointing to AI assistance based on the sudden jump in sophistication and quality. The real security challenge isn't a vulnerability in the models themselve

The landscape of large language model security has evolved significantly since the release of OWASP’s Top 10 for LLM Applications in 2023, which we covered in our blog at the time. The 2025 edition represents a significant update of our understanding of how Gen AI systems are being deployed in produ

Anthropic has reported that Claude Code was used to orchestrate a cyber espionage campaign, with the AI independently executing 80–90% of the tactical operations. In this article, we analyze the mechanics of this attack, and explain how organizations can leverage continuous red teaming to defend aga

AI red teaming has evolved from simple prompt injection into three distinct attack categories: single-turn attacks that test immediate defenses, multi-turn attacks that build context across conversations, and dynamic agentic attacks that autonomously adapt strategies in real-time. This article break

OpenAI's Atlas browser is powered by ChatGPT, but its design choices expose unknowing users to numerous risks. They were drawn in by the wonderful marketing promise of fast, helpful, and reliable AI, while articles about vulnerability exploitation continue to flood the news, just days after the beta