GitHub upgrades AI secret detection and outlines new checks
Existing alert scans get a new model while additional checks have separate rollout and billing plans.
AI Safety and Security
AI safety and security examines how AI systems fail, how they can be misused, and which safeguards have evidence behind them. This category covers model evaluations, prompt injection, data exposure, misuse testing, and the practical limits of protective measures. We look at the conditions of a test, the behavior it measured, and whether the results support the conclusions being drawn. Coverage also asks how containment, permissions, monitoring, and human review affect the consequences of an error or attack. Findings from AI research help explain emerging risks and the methods used to investigate them. The growing use of AI agents with access to tools makes questions about authority and access especially relevant. A useful assessment states its evidence limits, including missing tests, uncertain assumptions, and behaviors that may change in a different setting. The goal is to help readers evaluate safety claims and understand which controls address a specific risk.
AWS previews Strands Box for controlling AI agent actions
Strands Box combines local isolation with rules based on earlier actions. Its macOS preview leaves direct file grants outside policy history.
HygieneRoboBench tests whether robot plans remember contamination
A new benchmark separates safe task completion from efficient resource use.
Study finds limits to power based AI compute audits
A preprint tests what electricity measurements can establish about computation.
Selective agent audits use fewer tokens but miss more unsafe runs
A new preprint measures the cost and detection tradeoff in agent monitoring.
Claude Code tightens permission checks during plugin restarts
Claude Code 2.1.292 repairs plugin permission checks and uses base branch CLAUDE.md rules when a pull request edits them.
Hack The Box opens AI Range to enterprise security teams
The edition tests agents against cybersecurity job roles.
Brennan retest finds chatbots overlooking image origin data
A September check of three synthetic images found uneven use of embedded provenance, with important limits on what the results establish.
Irregular details containment checks before AI cyber evaluations
The evaluator tests security boundaries before measuring a model’s cyber capabilities.
Claude Code update repairs permission checks and scheduled tasks
Claude Code 2.1.290 fixes permission enforcement and task recovery with a compaction limit.
LTM launches AgenTraceIQ services for governing AI agents
The offering combines Rubrik controls with LTM assessments, deployment and ongoing governance.
Zscaler announces Lightwell collaboration with IBM and Red Hat
The collaboration links network protections with software fixes. Zscaler’s shield remains in early access.
OpenAI opens optional text watermarking for API customers
API customers can enable textGrain for selected models. OpenAI also plans an EU rollout for ChatGPT and Codex in the coming weeks.
zkAPI targets the billing trail behind AI requests
Experimental API credits leave providers able to see prompts
C1 Egress puts AI agent credentials behind network policy
C1 details credential vending and destination controls while its linked AppHub code still requires production validation
ZoneClaw study tests defenses against poisoned agent memory
Memory checks reduce attacks in a controlled agent study
BlackFog expands ADX Vision with controls for AI agent prompts
BlackFog introduces prompt checks and optional auditing as ADX Vision expands into AI agent workflows
Meta extends AI containment rules to training and evaluation
Meta updates its framework with training controls and open weight considerations
VeriSpec audits AI behavior rules for hidden conflicts
VeriSpec checks written AI rules and leaves final judgments to reviewers
Claude Code reinforces managed controls and teammate tracking
Claude Code 2.1.289 repairs policy checks and extends teammate events
AI uncertainty study shows why warning accuracy matters
Puzzle study separates useful warnings from weak model signals
RSA Agent ID targets risky AI actions with human approval
RSA plans a November release for agent discovery and access controls, with broader governance scheduled for 2027
Microsoft report says AI accelerates familiar cyberattack methods
Microsoft’s annual security report separates controlled AI evaluations from observed intrusions and emphasizes identity controls.
Study finds limits in simple AI safety embedding scores
A new paper tests a simple safety scoring shortcut. Adding a reference improves ranking, while deployment limits remain substantial.