AI Security
Run agent actions as the user, not a shared service account
OWASP advises running agent actions in the individual user's context, not a generic high-privilege account. Here is why and how to build it.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
RLAIF vs RLHF: training with AI feedback instead of human labels
RLHF uses human preference labels; RLAIF uses an LLM to produce them. What a 2023 study reported, what it costs you, and the risks of AI judges.
Oct 18, 20263 min read
AI Security
Restricting agent tool calls after retrieving untrusted data
When should an AI agent pause for approval after reading untrusted text? A decision guide built on the ATLAS tool invocation and approval mitigations.
Oct 18, 20263 min read
AI Security
Replit agent deleted a production database: what was reported
What The Register reported about the July 2025 SaaStr and Replit database deletion incident, what remains unconfirmed, and what teams should take from it.
Oct 18, 20264 min read
AI Security
Registering MCP servers and agents in Guard: what the inventory does
Guard needs a record of each MCP server and agent to target policy, track health and block an agent. What registration involves and a few sharp edges.
Oct 18, 20263 min read
AI Security
Ten security questions to ask an AI vendor before you buy
Ten questions about data use, model providers, retention, access controls and incident handling for reviewing an AI vendor in your third-party process.
Oct 18, 20263 min read
AI Security
Prompt logs for debugging: sampling and redaction choices
You need some prompts to debug an AI feature, but not all of them. How to choose between full capture, sampling and metadata only, and who may read them.
Oct 18, 20263 min read
AI Security
Prompt injection risks in AI code review bots
A review bot reads untrusted text from pull requests. How indirect prompt injection applies to it, and the OWASP mitigations that matter most.
Oct 18, 20263 min read
AI Security
Prompt injection in SOC AI assistants: logs are untrusted input
Attackers control some of the text a SOC assistant reads. Learn how indirect prompt injection reaches log data and how to limit what the model can do.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.