Froxlor Remembered-2FA Bypass: When User IDs Lose Their Namespace
An analysis of GHSA-9fq7-9w8p-c3qh, where missing account-type binding let a customer remembered-2FA token satisfy an administrator login.
Read articleTechnical insights
Cybersecurity and AI security, explained with evidence.
Practical guidance on penetration testing, model and application security, test harnesses, trust boundaries, and security validation.
Latest articles
Research, methods, and implementation guidance.
Written for security and engineering teams that need clear assumptions, reproducible methods, and practical controls.
Threat Modeling LLM Applications: Trust Boundaries and Abuse Paths
A step-by-step method for modeling LLM application assets, trust boundaries, attacker capabilities, abuse paths, controls, and validation evidence.
Read articleSecurity Regression Testing for AI Systems
A practical methodology for turning AI security findings into repeatable datasets, statistical evaluations, deterministic checks, and release gates.
Read articleSecure Tool Invocation Boundaries for AI Agents
An engineering guide to capability design, authorization, approvals, argument validation, and audit controls for tool-using AI agents.
Read articleAI Model Supply Chain Security: Provenance, Signing, and Deployment Gates
A detailed control model for AI artifact provenance, signing, model and data inventories, registry policy, evaluation gates, and safe rollback.
Read articlePrompt Injection Testing for LLM Applications: A Systematic Method
A rigorous method for testing direct and indirect prompt injection across retrieval, tools, memory, approvals, and application trust boundaries.
Read articleMulti-Tenant RAG Security: Authorization Before Retrieval
A deep guide to tenant isolation, permission-aware retrieval, ingestion integrity, cache safety, provenance, and security testing for RAG systems.
Read articleAI Red Teaming vs. Penetration Testing: Choosing the Right Assessment
A detailed comparison of AI red teaming and penetration testing, including objectives, scope, evidence, deliverables, and when to combine them.
Read articleSandboxing AI Coding Agents: Filesystem, Process, Network, and Credential Isolation
A deeply technical architecture for isolating AI coding agents with disposable workspaces, kernel controls, brokered capabilities, and escape testing.
Read articleAI Browser Agent Security Testing: Navigation, State, and Actions
A deep method for testing browser-using AI agents across navigation, prompt injection, profiles, credentials, approvals, downloads, and automation endpoints.
Read articleAI Agent Memory Poisoning: Cross-Session Integrity and Security Testing
A deeply technical guide to memory provenance, write policy, consolidation, tenant isolation, delayed prompt injection, and cross-session security tests.
Read articleEvidence-based delivery
Have a system that needs real assurance?
Start with a focused scope covering the assets, attack paths, constraints, and evidence your team needs.