Tag

Access Control

11 articles tagged Access Control.

Diagram of a stolen AI key's path from a hosting platform's environment variables through validation and resale, with rotate, investigate, and scope response steps

AI SecurityNov 2, 2026

Black October: how to contain stolen AI provider keys after the AI developer platform breaches

Attackers spent October 2026 pulling environment variables out of AI developer platforms and reselling the AI access they found. Here is how to rotate, investigate, and shrink the blast radius of the next stolen key.

7 min read

Diagram of a hostile web page inside an AI coding assistant's embedded browser crossing three added bridges, a page-to-agent channel, a self-reported URL, and a file:// web worker, to reach the agent, the address bar, and the developer's home directory

AI SecurityOct 31, 2026

EMBRACE: how the embedded browsers in AI coding assistants became an attack surface

Cursor, GitHub Copilot, Claude Desktop, Codex, and VS Code all embed a browser and give it powers a normal browser withholds. Forever Security showed how a hostile page turns those powers into code execution, file theft, and address-bar spoofing.

6 min read

Diagram of a LiteLLM internal user submitting a forged admin credential as key metadata, the proxy encrypting it with the shared salt key, and the returned ciphertext being replayed as an admin bearer token that reaches the MCP stdio endpoint

AI SecurityOct 30, 2026

LiteLLM CVE-2026-114612: how one shared key turned an internal user into proxy admin

LiteLLM used one encryption key both to seal stored secrets and to mint login tokens, so an internal user could get the proxy to encrypt a forged admin credential for them. Here is who is exposed, which releases fix it, and the follow-up checks worth doing.

6 min read

Diagram of a client request carrying mm_processor_kwargs.code_revision through the unauthenticated vLLM /tokenize endpoint, causing processor code to load from an attacker-controlled Hugging Face PR ref instead of the pinned revision

AI SecurityOct 29, 2026

vLLM CVE-2026-114053: when one request chooses which model code your server runs

A client could tell vLLM which revision of a model's remote processor code to import, even when the operator had pinned the model. Here is who was exposed, what 0.31.0 changes, and the controls to keep after you upgrade.

6 min read

Diagram of a stolen vendor application credential authenticating as a multi-tenant service principal into many Microsoft 365 tenants, with an AI agent loop driving reconnaissance, credential additions, and role changes

AI SecurityOct 25, 2026

Storm-0940 and the ConnectWise compromise: auditing third-party app access in Microsoft 365

Storm-0940 did not need a single user password: it signed in as a trusted vendor application. Here is what happened, what to check in your tenant, and how to shrink the access third-party apps hold.

7 min read

Diagram of untrusted content passing through a memory write gate that checks provenance, user confirmation, and expiry before anything reaches long-term agent memory

AI SecurityOct 22, 2026

Agent memory poisoning: how to stop long-term memory from becoming an attacker's persistence channel

An agent that remembers can be taught to remember the wrong things. Treat every memory write as a privileged action with provenance, review, and an expiry date.

6 min read

Diagram contrasting a system prompt that holds credentials and limits with one that holds only behavior, while secrets and checks sit in a server-side tool layer

AI SecurityOct 21, 2026

System prompt leakage: what never belongs in a system prompt

A system prompt is configuration the user can probably read, not a vault. Here is what to move out of it, where to put it instead, and how to test that it stays out.

7 min read

Diagram of a RAG query path where the user's identity becomes a filter inside the vector search before any chunk reaches the model

AI SecurityOct 19, 2026

Permission-aware RAG: enforcing document access control in retrieval

A RAG system that searches one shared index for every user will eventually hand someone a document they were never allowed to read. Here is how to enforce access control at retrieval time.

7 min read

Diagram of a two-job GitHub Actions design: an unprivileged agent job reads the untrusted pull request and writes an artifact, and a separate privileged job validates it before posting a comment

AI SecurityOct 18, 2026

Running AI coding agents in GitHub Actions without leaking secrets

An AI agent in a GitHub Actions workflow reads attacker-controlled text while holding your tokens. Here is the threat model and a workflow design that keeps a successful prompt injection from reaching secrets.

7 min read

Diagram of an MCP client connecting to three servers, with a review gate that compares each server's tool definitions against a pinned hash before they reach the model

AI SecurityOct 17, 2026

Vetting third-party MCP servers: tool poisoning, rug pulls, and a review checklist

Connecting an MCP server hands its author a voice in your agent's context and, often, code execution on your machine. Here is how to review one before you connect it and keep it honest afterwards.

7 min read

Diagram showing user input and a retrieved document flowing into an LLM, whose output passes through a policy gate that denies the action

AI SecurityOct 1, 2026

Prompt injection is an access-control problem, not a prompt problem

Filters and stern system prompts reduce prompt injection, but they cannot eliminate it. The durable fix is to treat model output as untrusted input and authorize every action it proposes.

5 min read