Editorial desk
AI Sec Editorial
AI Sec Editorial is the publishing identity for AI Sec. It is a desk, not a person: no named author, no biography, no professional certifications.
Articles published under this byline are researched from primary sources — vendor and project documentation, published standards and specifications, research papers, and measurements published by whoever took them — drafted with AI assistance, and edited against those cited sources before publication. Nothing here is based on first-hand testing in a private lab, and any figure that appears is attributed to the source it came from.
Corrections go to hello@aisec.blog. More detail is on the about page and the editorial disclosure.
Posts (32)
- agent-security
APEX: Stopping Prompt Injection at the Execution Boundary
APEX stops indirect prompt injection at the execution boundary with a pre-compiled task contract and decoy probes. 0% ASR on five of six benchmarks.
- red-team
GPT Security: Attack Surfaces and Production Controls
A technical guide to GPT security covering prompt injection, custom GPTs, agent actions, data handling, and layered production controls.
- prompt-injection
ChatGPT Exploits: Injection, Memory Hijack, Plugin Abuse
How ChatGPT gets exploited: indirect prompt injection, CSRF memory poisoning, cross-plugin request forgery, agent tool abuse, and the controls that help.
- prompt-injection
FlashRT Cuts the GPU Bill on Long-Context Injection Attacks
A new red-teaming framework claims 2-7x speedup and 2-4x lower memory than nanoGCG on 32K contexts, putting GCG-class attacks within a normal budget.
- red-team
OSCP and CEH in 2026: What Carries Over to AI Red Teaming
A free OSCP and CEH study offer raises the question every pentester should answer: which of those skills transfer to AI red teaming, and which do not.
- red-team
Insecure Output Handling Examples: XSS, SQLi, RCE
See five insecure LLM output handling examples, from rendered XSS and query injection to code execution, plus the sink-side controls for each.
- jailbreak
Many-Shot Jailbreaking: How Long Context Breaks Alignment
Many-shot jailbreaking floods a long context with faux dialogues until refusal collapses. The power law behind it, why it transfers, and what blunts it.
- red-team
LLM Security Vulnerabilities: What Actually Gets Exploited
A list of LLM security vulnerabilities: the OWASP 2025 Top 10, the CVEs where they turned real, and controls for injection and insecure output handling.
- red-team
GPT-Red: What OpenAI's Prompt-Injection Attacker Proves
OpenAI says GPT-Red beat human red teamers 84% to 13% on prompt injection. Here is what those numbers measure, and what they leave unanswered.
- red-team
LLM Attack Taxonomy: Injection, Jailbreaks, Agent Abuse
A practitioner's map of LLM attack classes: direct and indirect prompt injection, jailbreaks, RAG poisoning, and agent tool-call abuse, mapped to OWASP.
- red-team
The Adversarial ML Attack Taxonomy: A Red Teamer's Reference
A working taxonomy of attacks against ML systems, covering evasion, poisoning, privacy, and abuse, mapped to attacker access and aligned to NIST and ATLAS.
- red-team
AI Red Team Engagement Methodology: Scoping to Reporting
The full lifecycle of an LLM red team engagement: scoping, threat modeling, the test plan by attack class, the tooling that runs it, and the report.
- prompt-injection
Prompt Injection in 2025: OpenAI vs. Broken Defenses
OpenAI's November 2025 injection advisory versus an October 2025 paper whose adaptive attacks broke most of 12 published defenses at over 90%.
- red-team
Why Red Teaming Cannot Certify Governance Claims
A position paper formalizes the mismatch between what AI governance frameworks ask evaluators to verify and what behavioral red teaming can actually show.
- agent-security
ARSM: A Defense Pipeline for Medical LLM Agents
ARSM-Agent chains six defense stages, from input risk perception to output control, for medical LLM agents. What each stage catches and where gaps remain.
- primer
LLM Security FAQ: Prompt Injection, Jailbreaks, and Defenses
Three foundational questions for anyone building or red-teaming LLM applications, covering jailbreaks, direct and indirect injection, and what defends.
- prompt-injection
Prompt Injection Examples: A Practitioner's Attack Library
A technical breakdown of real prompt injection examples across direct, indirect, multimodal, and RAG-poisoning attacks, with payloads and conditions.
- jailbreak
Jailbreaks automatizados: PAIR, GCG, TAP y transferibilidad
Descubre cómo PAIR, GCG y TAP automatizan jailbreaks, por qué los ataques se transfieren entre modelos y qué cambia en una evaluación de red team.
- primer
Inyección directa e indirecta de prompts: defensas
Distingue la inyección directa e indirecta de prompts por sus actores, superficies, impactos y defensas en aplicaciones con LLM.
- jailbreak
LLM bypass: ataques a la alineación y guardrails
Este análisis del bypass de LLM explica sufijos adversarios, ataques de fine-tuning y evasión de guardrails, con defensas para cada capa.
- jailbreak
Jailbreak de LLM: taxonomía, técnicas y defensas
Esta guía de jailbreak de LLM explica roleplay, codificación, many-shot y escalada multi-turno, además de defensas en capas.
- red-team
Seguridad de LLM: mapa de ataques y defensas
Esta guía de seguridad de LLM mapea inyección de prompts, fuga de datos, cadena de suministro, agencia excesiva y defensas en capas.
- red-team
Guardrails contra inyección de prompts: clases de bypass
Conoce cómo se evaden los guardrails contra inyección de prompts mediante ataques indirectos, codificación, contenido multimodal y abuso de herramientas.
- prompt-injection
Ejemplos de inyección de prompts para profesionales
Analiza ejemplos reales de inyección de prompts directa, indirecta y multimodal, incluido el envenenamiento RAG, con payloads y defensas.
- jailbreak
Automated Jailbreak Attacks and the Transfer Problem
How automated attack generation works — PAIR, GCG, and TAP — why jailbreaks port across model families, and what that does to an assessment's threat model.
- primer
Direct vs. Indirect Prompt Injection: Threats and Defenses
Direct and indirect prompt injection are fundamentally different attacks with different attack surfaces, threat actors, mitigations, and blast radius.
- agent-security
Agent Tool-Use Exfiltration: Attack Chains and Controls
Indirect prompt injection can make agents exfiltrate data, misuse tools, or execute code. Controls include least privilege, confirmation, and sandboxing.
- red-team
AI Red Teaming Hub: Your Guide to Offensive AI Security
The central index for offensive AI security on this site: prompt injection, jailbreaks, adversarial ML, red team methodology, and the tooling behind it.
- jailbreak
LLM Bypass Techniques: Attacks on Alignment and Guardrails
LLM bypass techniques span adversarial suffixes, alignment-removing fine-tuning, and guardrail evasion, with defenses for each attack layer.
- jailbreak
LLM Jailbreak Techniques: Attack Taxonomy and Defenses
LLM jailbreak attacks include roleplay, encoding, many-shot prompts, and multi-turn escalation, while layered controls limit their impact.
- prompt-injection
Prompt Injection Attack Compendium (2026 Edition)
A pillar reference on prompt injection against LLM systems: direct and indirect variants, real payloads, detection signals, and the defenses that work.
- red-team
Why Your Prompt Injection Guardrails Fail: Bypass Classes
Prompt injection guardrails miss indirect, encoded, multimodal, multi-turn, tool-call, and adversarial suffix attacks. It outlines layered defenses.