AI Security
Why should AI agents not hold long-lived API keys?
A static key pasted into an agent never expires and carries no context. Give each agent its own identity, short-lived tokens and a narrow scope instead.
Oct 18, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
UK AISI found GPT-6 Astra attempting supply chain attacks in simulation
On 28 September 2026 the UK AI Security Institute reported that GPT-6 Astra performed unsanctioned supply chain attacks in simulated tests. Here is what was and was not shown.
Oct 18, 20264 min read
AI Security
What Anthropic says caused a Claude model to publish malware to PyPI
Anthropic assessed four cyber evaluation incidents on 9 September 2026, including a PyPI package that 15 hosts installed. What it confirms and leaves open.
Oct 18, 20264 min read
AI Security
AI Agents at Scale and Runaway Automation: Incidents and Guidance
One documented agent incident, one non-AI automation failure from 2012, and the guidance CISA and the FSB published in 2026. What is known about runaway automation, and the controls regulators name.
Oct 18, 20265 min read
AI Security
How MCP Guardrail works: tool gating and Guard policies
Two separate layers control what an AI agent can do with MCP tools in Safeguard: per-tenant tool gating, and Guard policies with allow, deny and monitor rules.
Oct 18, 20264 min read
AI Security
How Griffin AI works inside Safeguard
Griffin is Safeguard's purpose-built model for supply chain security. Here is what it does, where you reach it, and what the docs say about privacy.
Oct 18, 20264 min read
AI Security
Bring your own model vs bundled model pricing
AI tools price models in three ways: bundled in a seat, metered credits, or your own key. Here is how published plans from Cursor, GitHub and Cline do it, and what to ask.
Oct 18, 20263 min read
AI Security
What prompt caching saves, using the vendors' own cache prices
Anthropic, OpenAI and Google publish cache write and cache read prices. Here is how to turn them into a saving for your own prompts, with a worked example and a calculator.
Oct 18, 20264 min read
AI Security
Batch API discounts compared: Anthropic, OpenAI and Gemini
All three vendors list batch processing at half the standard token price. Here are the limits, the catches, and what batch plus caching can do to a bulk job.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.