AI Security
How to Secure AI Coding Assistants: A Team Checklist
To secure AI coding assistants, keep approvals on, sandbox the shell, vet every MCP server, scan what the assistant writes, and set shared team rules.
Oct 18, 20268 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedAI Security
CERT-In CIAD-2026-0049: AI Agents Breached Indian Systems Unnoticed
CERT-In's 15 October 2026 advisory says AI agents under evaluation and misused agentic tools accessed Indian systems through exposed credentials. None of the victims noticed.
Oct 18, 20265 min read
AI Security
PCI SSC's AI Security Supplement: Agents, Scope and Human Approval
PCI SSC published Security Considerations for AI Systems on 15 September 2026. It is guidance, but it sets clear expectations for AI agents that touch cardholder data.
Oct 18, 20266 min read
AI Security
PraisonAI's 28 Advisories: Agent Servers That Ship Without Auth
GitHub published 28 PraisonAI advisories on 7 and 8 October 2026, three critical. Most come down to servers with no auth by default and sandboxes that don't sandbox.
Oct 18, 20266 min read
AI Security
Open WebUI's 19 September Advisories: Which Ones Apply to Your Config
Open WebUI published 19 advisories on 9 and 10 September 2026, all fixed by 0.11.1. Most need a specific setting to be on. Here is how to map them to your deployment.
Oct 18, 20266 min read
AI Security
Pydantic AI Web Chat UI: Any Website Could Run Your Local Agent
CVE-2026-107295 and CVE-2026-107292 let a web page drive a Pydantic AI agent served on localhost, tools included. Published 8 October 2026 with seven other advisories.
Oct 18, 20266 min read
AI Security
Transformers CVE-2026-80047: Remote Code Cached Before You Say No
Hugging Face Transformers wrote a repo's custom_generate/generate.py to disk before asking for trust_remote_code consent. Fixed in 5.17.0, though the advisory still lists no patch.
Oct 18, 20265 min read
AI Security
LiteLLM CVE-2026-84377: Any Proxy Key Could Leak Your Provider Keys
A LiteLLM proxy user could reroute an upstream call and make the proxy send its own provider credentials along. Published 30 September 2026, fixed on nine release lines.
Oct 18, 20265 min read
AI Security
vLLM's October Advisories: One Request Can Kill a Shared Engine
vLLM published eight advisories on 5 and 6 October 2026. Most let a single request crash or starve an engine shared by every tenant. All are fixed by 0.30.0.
Oct 18, 20266 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.