Practical AI Security for Professionals

AI meeting notetaker privacy: one participant consents while the rest of the room is recorded

AI Meeting Notetaker Privacy: Who Agreed to Be Recorded?

September 30, 2026

Otter asks users to obtain permission before sharing recordings. That does not settle every legal duty. Storage, training, and participant controls also differ across meeting tools.

AI agent payment permissions: a signed approval covering only the final step of a longer chain

AI Agent Payment Permissions: What the Protocols Don’t Cover

September 26, 2026

AP2 treats agents as potential attackers and uses signed mandates to constrain purchases. Those signatures do not establish that product claims are true or settle who pays for every mistake.

AI Agent Memory Poisoning: Why Deleting a Chat May Not Be Enough

September 22, 2026

A poisoned memory can influence later sessions. Two research demonstrations show different entry points, while product settings determine what survives and what you need to delete.

Real prompt injection attack examples: four disclosed vulnerability chains where the exfiltration path was an existing security control

Real Prompt Injection Attack Examples in Production Tools

September 8, 2026

Four disclosed prompt injection chains in Salesforce, GitHub, ChatGPT and Grafana. Separate researcher demonstrations from confirmed breaches and examine the data paths each chain used.

A filter catching some passing items and missing others, the measured reality of prompt injection detection

How Prompt Injection Detection Works (and Where It Fails)

August 29, 2026

Prompt injection detection rates depend on the false alarm threshold and evaluation data. Learn what benchmark figures mean, which comparisons hold, and what controls to pair with detection.

A single page of policy pinned where a team can see it, the practical form of an AI acceptable use policy

AI Acceptable Use Policy: A One-Page Starter

August 27, 2026

A one-page AI acceptable use policy you can copy and edit today, with the four clauses that carry the weight, and the owner and request path that decide whether anyone actually follows it.

A written policy document beside a running system that does not reflect it, the gap an AI agent security policy has to close

AI Agent Security Policy: What Yours Is Missing

August 26, 2026

Check whether your AI agent security policy covers software acting on delegated authority. Review ownership, identity and enforcement, then test the controls behind the document.

A document being sorted at a checkpoint before it reaches an AI chat box, the decision to make before you upload company data to AI

How to Safely Upload Company Data to AI (Checklist)

August 23, 2026

A checklist to run before you upload company data to AI: sort the input first, check which account it lands in, strip what does not need to be there, and know what to do if you already pasted it.