Category: AI

At ENISE 2026, Xygeni CEO Jesús Cuadrado showed how one sentence in a GitHub issue led to an unauthorized release, and left CISOs with four questions about AI coding agents.

The OWASP Agentic AI Top 10 names the ten ways AI agents fail. Here is what ASI01 to ASI10 actually mean in a real pipeline, where each risk gets in, and which ones you can stop before deploy.

A model extraction attack lets an attacker copy your model one query at a time, with no breach and no stolen file. Here is how model stealing works, and why the first defense is knowing every inference endpoint you expose.

Constrain the agent, recover faster, or contain it from below? Three practitioners, three answers, and one minimum they all agreed on.

Agent harness engineering turns models into useful agents. It also hands attackers a new target: the files that tell your agent what it can do.

AI application security dominated OWASP Porto and Karlsruhe. What ASPM really is, how it differs from SAST, and where AI triage and remediation help.

Four search terms, two completely different jobs. Managing the risk of AI is not the same discipline as using AI for risk management, and most organisations are staffing one while being sold the other. The interesting part is what happens when you realise they are the same programme.

Every board now asks the same question: what is our AI risk? Most teams answer with adjectives. Here are the AI risk metrics that produce a number, where each one comes from, and what an agentic AI strategy has to cover before any of them mean anything.

Two things get filed under the same heading and they are not the same problem. Attacks on AI systems and attacks powered by AI need different controls, different owners and different evidence. Ten threats, split into the two halves, and the one step that precedes all of them.

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.

AI pentesting tools are four different product shapes. What agentic pentesting changes, seven evaluation criteria, and what it cannot do.

Agents now plan, code, review, ship and operate. What the agentic SDLC changes in every phase, and which controls quietly stop working.