# Enforster AI Insights

> Practical research, engineering guidance, and perspectives on AI security, governance, and trust from Enforster AI.

Enforster AI publishes practical guidance on AI security, AI governance, compliance, and privacy for engineers, security teams, and risk owners. Every article is available as clean Markdown at the links below. The full text of all articles is at https://blog.enforster.ai/llms-full.txt.

## Articles

- [The trojanized Claude Code extension on Cursor: how to find the SSH backdoor and clean it up](https://blog.enforster.ai/md/trojanized-claude-code-extension-cursor-marketplace.md): Cursor's marketplace served a tampered Claude Code extension, 2.1.312 and 2.1.313, that planted an SSH key and tunnel. How to check, clean up, and harden.
- [Black October: how to contain stolen AI provider keys after the AI developer platform breaches](https://blog.enforster.ai/md/black-october-stolen-ai-keys-developer-platforms.md): Nine AI developer platforms reported breaches in October 2026 that exposed stored AI keys. What to rotate first, how to check Bedrock abuse, how to scope keys.
- [EMBRACE: how the embedded browsers in AI coding assistants became an attack surface](https://blog.enforster.ai/md/embrace-embedded-browser-flaws-ai-coding-assistants.md): Forever Security's EMBRACE research found code execution, file theft, and URL spoofing in the embedded browsers of five AI coding tools. What to check.
- [LiteLLM CVE-2026-114612: how one shared key turned an internal user into proxy admin](https://blog.enforster.ai/md/litellm-cve-2026-114612-salt-key-privilege-escalation.md): LiteLLM CVE-2026-114612 lets an internal user forge a proxy admin token and run commands via MCP stdio. Affected versions, fixes, and what to check.
- [Brotli CVE-2026-111497: why AI agents that fetch URLs should be patched first](https://blog.enforster.ai/md/brotli-cve-2026-111497-ai-agents-url-fetching.md): CVE-2026-111497 is a critical Brotli decoder flaw now in CISA KEV. Why URL-fetching AI agents are exposed, fixed versions, and how to find hidden copies.
- [vLLM CVE-2026-114053: when one request chooses which model code your server runs](https://blog.enforster.ai/md/vllm-cve-2026-114053-code-revision-rce.md): vLLM CVE-2026-114053 let a request pick which revision of a model's processor code to import. Who is exposed, the fix in 0.31.0, and how to lock it down.
- [When MCP sign-in runs code: authorization URL injection in opencode and mcp-remote](https://blog.enforster.ai/md/mcp-oauth-authorization-url-command-injection.md): How a malicious MCP server turned OAuth sign-in into code execution in opencode and mcp-remote, and how MCP clients should validate and open auth URLs.
- [The AGENTS.md hijack: why coding agents should never start in your Downloads folder](https://blog.enforster.ai/md/agents-md-instruction-file-hijack-coding-agents.md): How a malicious AGENTS.md in ~/Downloads hijacked coding agents, which instruction files Codex and Claude Code load, and the controls that stop it.
- [Storm-0940 and the ConnectWise compromise: auditing third-party app access in Microsoft 365](https://blog.enforster.ai/md/storm-0940-connectwise-third-party-app-access-microsoft-365.md): How Storm-0940 used stolen ConnectWise app credentials and the ARTEX AI framework against Microsoft 365 tenants, and how to audit and contain vendor app access.
- [AI-BOMs in practice: documenting models and datasets with CycloneDX ML-BOM and SPDX 3.0](https://blog.enforster.ai/md/ai-bom-cyclonedx-ml-bom-spdx-ai-profile.md): What an AI bill of materials should record for models and datasets, how CycloneDX ML-BOM and SPDX 3.0 represent it, and how to verify it in CI.
- [The 302.ai leak: what an AI aggregator stores about your prompts, and how to vet one](https://blog.enforster.ai/md/ai-aggregator-data-exposure-vetting-model-gateways.md): An AI aggregator left 17.6 million files of chats, uploads, and generated media in an open Azure bucket. What to ask before routing traffic through one.
- [Agent memory poisoning: how to stop long-term memory from becoming an attacker's persistence channel](https://blog.enforster.ai/md/agent-memory-poisoning.md): How prompt injection turns agent memory into a persistent backdoor, and the write gate, provenance, expiry, and rollback controls that contain it.
- [LiteLLM 1.107.0 was compromised: how to check exposure and respond](https://blog.enforster.ai/md/litellm-1-107-0-supply-chain-compromise.md): LiteLLM 1.107.0 wheels and Docker images shipped a credential stealer and a remote code loader. How to check your hosts, clean up, and rotate secrets.
- [LLM output is untrusted input: preventing XSS, SQL injection, and code execution from model responses](https://blog.enforster.ai/md/llm-output-is-untrusted-input.md): Treat every model response like user input: encode it for its sink, never exec it, allowlist generated queries, and block Markdown image exfiltration.
- [PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch and how to mitigate](https://blog.enforster.ai/md/php2shell-cve-2026-109618-cve-2026-109619.md): PHP2Shell is a pair of critical unauthenticated RCE flaws in the PHP engine. Fixed versions, interim mitigations from the advisories, and detection steps.
- [System prompt leakage: what never belongs in a system prompt](https://blog.enforster.ai/md/system-prompt-leakage-what-never-belongs-in-a-system-prompt.md): Assume your system prompt will leak. Keep credentials, authorization rules, and internal limits out of it, and enforce them in code the model cannot reach.
- [Denial of wallet: rate limits and cost controls for LLM applications](https://blog.enforster.ai/md/denial-of-wallet-cost-controls-for-llm-applications.md): How to stop abuse and runaway agents from burning your LLM budget: per-user token budgets, max_tokens caps, provider spend limits, and alerts.
- [Permission-aware RAG: enforcing document access control in retrieval](https://blog.enforster.ai/md/permission-aware-rag-document-access-control.md): How to stop a RAG assistant from retrieving documents the user cannot open: filter by identity inside the vector query, sync ACLs, and test for leaks.
- [Running AI coding agents in GitHub Actions without leaking secrets](https://blog.enforster.ai/md/ai-coding-agents-in-github-actions-without-leaking-secrets.md): Why AI agents in CI leak secrets through PR titles and issue comments, and the workflow design that contains it: triggers, token scopes, and split jobs.
- [Slopsquatting: how to stop hallucinated packages in AI-generated code from reaching production](https://blog.enforster.ai/md/slopsquatting-hallucinated-packages-in-ai-generated-code.md): Code assistants invent package names, and attackers can register them. Practical controls to keep hallucinated dependencies out of your builds.
- [Vetting third-party MCP servers: tool poisoning, rug pulls, and a review checklist](https://blog.enforster.ai/md/vetting-third-party-mcp-servers.md): How to review and run third-party MCP servers safely: the tool poisoning and rug pull threat model, pinning tool definitions, and least-privilege controls.
- [Loading third-party model weights safely: pickle, weights_only, and safetensors](https://blog.enforster.ai/md/loading-third-party-model-weights-safely.md): Why loading a pickled model file can run attacker code, and the concrete controls that stop it: safetensors, weights_only, pinned revisions, and CI gates.
- [Prompt injection is an access-control problem, not a prompt problem](https://blog.enforster.ai/md/prompt-injection-is-an-access-control-problem.md): Why better system prompts will not stop prompt injection, and how to contain it with authorization checks on every tool call an LLM agent makes.
- [A practical AI model inventory: what to record for every system in production](https://blog.enforster.ai/md/ai-governance-model-inventory.md): A field-by-field guide to building an AI model inventory that supports risk reviews, incident response, and audits without becoming shelfware.
- [Logging LLM applications without creating a privacy problem](https://blog.enforster.ai/md/logging-llm-applications-without-a-privacy-problem.md): How to log prompts, completions, and tool calls well enough for incident response, while keeping personal data and secrets out of long-lived storage.

## Topics

- [AI Security](https://blog.enforster.ai/category/ai-security)
- [AI Governance](https://blog.enforster.ai/category/ai-governance)
- [Privacy](https://blog.enforster.ai/category/privacy)
- [Security Operations](https://blog.enforster.ai/category/security-operations)

## Optional

- [About Enforster AI Insights](https://blog.enforster.ai/about)
- [RSS feed](https://blog.enforster.ai/rss.xml)
- [Enforster AI product site](https://enforster.ai)