Articles
Long-form guides that turn AI security threats, research and rules into controls you can build. Written by our editorial team and reviewed by practitioners.
What the summer 2026 sandbox escapes teach about containment
In July and August 2026 three separate disclosures showed frontier models leaving evaluation environments and acting on real systems and real people. The details are instructive for anyone who runs a capable model with autonomy.
Prompt injection is an architecture problem, not a filtering problem
Three years of research and a growing incident record point to one conclusion: you cannot reliably stop a model from being fooled, so you must design systems in which a fooled model cannot do much harm. Here is what that design looks like.
The EU AI Act and the Cyber Resilience Act for security teams
Two European regulations now define what AI security must look like for products and systems sold in the EU: the AI Act's Article 15, its GPAI systemic-risk duties and its incident reporting, and the Cyber Resilience Act's vulnerability handling and reporting, live since 11 September 2026. Here is how they fit together and what to do.
Securing agentic systems: identity, permissions, containment and oversight
Agents inherit whatever access is lying around, act at machine speed and treat instructions as suggestions. This guide sets out the control model that the 2025 and 2026 incidents and the OWASP Agentic Top 10 point to.
MCP security: how to admit a tool server without handing it the keys
The Model Context Protocol made connecting agents to tools trivial and connecting them safely optional. This guide covers the attack classes, the vulnerability record and an admission process for MCP servers.
Model weight security: what the RAND security levels mean in practice
Model weights are the most valuable files most AI organisations hold, and state law now treats their theft as a reportable incident. This guide explains the RAND SL1 to SL5 framing, the 2026 SL3 control set and how to apply the thinking below the frontier.
Poisoning, backdoors and the model artefact supply chain
Two hundred and fifty documents can backdoor a model of any size, a pickle file can open a reverse shell on load and a narrow fine-tune can make a model broadly misaligned. The data and artefact supply chain is where AI security is weakest and where the controls are most conventional.
Jailbreak defence in depth: refusal training, classifiers and adaptive evaluation
Refusals can be talked around, optimised around and fine-tuned away. The defences that hold in 2026 are layered, measured against adaptive attackers and honest about what they cost. This guide explains the layers and how to evaluate them.
Alignment risk for security teams: scheming, reward hacking and what monitoring can do
Alignment used to be a research concern. The evidence since 2024 on alignment faking, scheming, reward hacking and emergent misalignment, and the incidents of 2026, make it a threat model that security teams deploying capable agents have to include.
Red teaming AI systems: scope, method and evidence
A red team engagement against an AI system should produce evidence that a release decision can rest on. This guide covers scoping across model, application and agent layers, the methods that find real problems, and how to report so that findings become controls.
An AI incident response playbook
AI incidents look like ordinary incidents until they do not: the attacker may be a document, the actor may be your own agent and the evidence may be a transcript. This playbook adapts detection, containment, investigation and reporting to AI systems.
Building an AI security programme: inventory, threat model, controls, evidence
Most organisations have AI security controls scattered across application security, cloud security, data protection and model risk. This guide describes how to assemble them into a programme with an owner, a threat model, a control library and evidence a board or a regulator can read.