AI security and red teaming guides
Guides on AI red teaming, prompt injection, RAG security, AI agent permissions, MCP risks and frameworks such as the OWASP LLM Top 10 and MITRE ATLAS.
Practical guides for teams that build with LLMs, retrieval and agents. Each one explains a risk, shows how testers check for it, and lists fixes that limit the damage. Facts carry their sources and the date we checked them.
Agents and tools
Agent memory poisoning: how persistent AI memory gets attackedAgent memory poisoning plants hostile text in an AI agent's long-term memory so it shapes later sessions. Two documented cases, an 8-step test plan and fixes.AI agent permissions: how to scope tools and credentialsAI agent permissions: give each tool one task, one scoped credential and an approval rule. Includes a copyable permission matrix and a 7-step test plan.Excessive agency in LLM apps: causes, tests and fixesExcessive agency lets an LLM app take damaging actions on bad model output. Covers the three root causes, a tool review table, a test method and OWASP's fixes.Human approval bypass in AI agents: how confirmations failHuman approval bypass in AI agents: why confirmations fail (approval fatigue, vague prompts, trigger words, Always Allow) and a 14-row approval UX test table.MCP security risks: tool poisoning, confused deputy and token passthroughMCP security risks and what the official spec says about each: tool poisoning, confused deputy, token passthrough. Includes a 22-point server review checklist.
AI red teaming basics
AI red teaming tools: open-source scanners and frameworks comparedAI red teaming tools checked on their official repos on 9 Nov 2026: garak, PyRIT, promptfoo, DeepTeam, Giskard and Inspect, with license, use and limits.AI red teaming vs penetration testing: differences and when you need eachAI red teaming vs pentesting: compare target, method, proof and cost drivers, use the decision table to pick, and see one finding that needs both.What is AI red teaming? Definition, scope and what testers deliverWhat is AI red teaming? The NIST definition, a six-layer scope map for LLM apps and agents, a sample test, and how it differs from safety evals and pentests.
RAG and data
Data exfiltration through markdown images in LLM appsLLM data exfiltration via markdown images: how a rendered image carries chat data out, five documented cases from 2023 to 2025, and the fixes that close it.RAG security: how to test retrieval authorization and poisoningRAG security means the retriever enforces who may read each document. See the main risks and a 12-row, two-tenant test matrix for retrieval access.
Frameworks
EU AI Act red teaming: what the Act says about adversarial testingEU AI Act red teaming: which articles cover adversarial testing (Art. 55, 15, 9), who each binds, and the application dates after the 2026 Digital Omnibus.MITRE ATLAS: the attack matrix for AI systems, with technique IDsMITRE ATLAS explained: how it differs from ATT&CK and the OWASP LLM Top 10, with a table of LLM, RAG and agent technique IDs checked in release v2026.10.NIST AI RMF and red teaming: what AI 100-1 and AI 600-1 sayNIST AI RMF red teaming: what AI RMF 1.0 and the Generative AI Profile (AI 600-1) say, with suggested action IDs mapped to Govern, Map, Measure and Manage.OWASP Top 10 for Agentic Applications: ASI01 to ASI10 and how to test themOWASP agentic AI threats: the Top 10 for Agentic Applications (ASI01 to ASI10) with each ID, the earlier OWASP threat model, and a test question per risk.OWASP Top 10 for LLM Applications: the 2026 list, 2025 mapping and how to test each riskOWASP Top 10 for LLM Applications: exact IDs and names for the 2026 and 2025 lists, a 2025-to-2026 mapping, and a tester's check for each risk.
Planning an assessment
How to scope an AI red team engagement: questions, access and stop conditionsHow to scope an AI red team engagement: eight questions on purpose, users, models, data, tools and environments, plus test data, rules and stop conditions.Testing customer support chatbots: security and policy test planChatbot security testing for customer support bots: 24 test cases with pass conditions for refund promises (Moffatt v. Air Canada), leaks, handoff and tools.
Prompt injection
Indirect prompt injection: sources, real cases and how to test for itIndirect prompt injection hides instructions in content an LLM reads. A source inventory, real cases (Slack AI, GitHub MCP, EchoLeak) and a test plan.Jailbreak vs prompt injection: the difference and why it mattersJailbreak vs prompt injection: a jailbreak attacks a model's safety training, prompt injection attacks the app around it. Comparison table, tests and defenses.Prompt injection: what it is, how testers find it and how to reduce itPrompt injection makes an LLM app follow instructions that should be data. See direct and indirect types, 10 test cases with evidence to capture, and fixes.System prompt leakage: why secrets in prompts fail and how to test for itSystem prompt leakage exposes hidden instructions, tool schemas and secrets. Read the OWASP LLM07:2025 and LLM08:2026 wording, an 8-row test table and fixes.
Shipping an AI feature or agent?
Describe the system, the data it reads and the actions it can take. We reply with questions and a proposed scope.