Topic
Practice of securing AI and LLM-based applications, covering risks like prompt injection, data leakage, and unsafe handling of model inputs and outputs.
Attackers made 1,423 attempts against Previdian honeypots since September 19 to exploit Langflow CVE-2026-105740 (CVSS 9.9, versions before 1.9.0). In one sequence they got the required login with a common username and password, Previdian said.
Reality
HackerOne says companies cut average vulnerability fix time from 135 days to 62, yet validated findings left unresolved rose 131% over two years. That leaves time-to-fix a poor guide to exposure, and paying the debt down means taking capacity away from feature work.
Reality
Flowise fixed a CVSS 9.8 remote-code bug in its CSV Agent with a stricter regex, then saw that filter fail through five more CVEs. It deleted the feature in June, and the patch history is a case against trusting a string filter to vet model-written code.
Reality
DARPA selected Xint, one of three winners of its $29.5 million AIxCC contest, to research AI-driven security analysis of Department of War messaging apps. The work aims its automated find, triage and patch pipeline at messaging code and binaries the military actually runs.
Reality
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishersReality
A dev.to write-up keeps access rights in Postgres and vectors in Qdrant, with a department_id stamped into every chunk payload so the filter runs before the model sees any text. The token supplies the identity, and the department comes from Postgres.
Reality
A vendor-authored count says a typical production AI app routes through 6 to 9 services, each adding a key, an egress path, an in-runtime SDK, a prompt log and a subprocessor. The count holds up.
Reality
An architecture decision record for a gaming moderation assistant puts a policy stage between retrieval and generation, and counts abstention with a reason code as a successful outcome.
Reality