This article shows how to use the Claude Compliance API to feed full chat and file content into your SIEM, then write detections for AI-specific threats that live in the content. It covers prompt injections in uploaded files, jailbreaks, system-prompt leaks, data-laundering requests, sensitive disclosures, and insider data-flow risks.

• Claude's Compliance API streams full chat and file content into your SIEM, not just auth/admin logs—so an unrecognized identity querying compliance_api_accessed can see every chat in the org.
• Uploaded files can hide jailbreak instructions via zero-width characters, white-on-white text, or base64 blobs, so file_uploaded/project_document_created events need scanning for instruction-like language and suspicious encoding.
• Detections should focus on the assistant's output, not the prompt: a jailbreak attempt only matters if disallowed content or leaked system instructions actually appear in the response.
• Requests to encode, paraphrase, or strip PII from text are exfiltration red flags, and only the model's actual response confirms whether sensitive data got through.

This post breaks down Amazon’s lawsuit against Perplexity over its Comet AI agentic browser, which browses and transacts on users’ behalf while disguising itself as Chrome. It explains how these browsers work, the security risks they introduce—like prompt injection attacks—and why sites like Amazon demand transparent agent identification.

• Amazon's lawsuit claims Comet disguises itself as Chrome, hiding the AI agent's true identity from Amazon's systems.
• Agentic browsers share the user's actual cookies/passwords/session data, so a compromised AI agent can act with full access as if it were the user.
• Amazon's complaint cites a public report of prompt-injection attacks hijacking embedded AI assistants to steal private data.
• Amazon argues Comet's covert automation bypasses and degrades its personalized shopping features built over years.

This issue covers a new AI-built SQL parser for PostHog that’s 70× faster, Linear’s move from styled-components to StyleX for better React performance, and a deep dive into misleading database benchmarks. It also highlights tools like Gemini 3.5 Flash’s computer use feature, the peerd automation extension, a breakdown of prompt injection vulnerabilities, and other AI and dev updates.

• PostHog built an AI-generated SQL parser that's 70x faster than their old C++ ANTLR version, using property-based tests to guide the model, without changing the query language for users
• Linear is replacing styled-components with StyleX to reduce runtime style recalculations and cut style-sheet overhead, since styled-components hasn't kept up with React
• LLMs can't reliably distinguish system/user role tags because they follow tone rather than tag hierarchy, letting attackers embed commands like "ignore previous" inside user-level text to bypass safeguards

This article argues that using Markdown prompts and LLMs as a runtime interpreter for business rules is slow, expensive, unreliable, and insecure. It shows how mixing regular code, human approvals, and LLMs without a solid framework leads teams to overuse LLMs instead of writing proper code and handling state continuations.

• Using LLMs to interpret Markdown business logic runs ~10,000x slower, costs more, and invites hallucinations, privacy leaks, and prompt-injection attacks than writing regular code.
• The real cause is engineering friction: without a framework to pause/resume code and store continuations, teams dump logic into prompts and let the LLM manage state via conversation history instead of building proper state machines.
• ~90% of support queries follow predictable flows that deterministic code handles better and near-instantly, so LLMs should be reserved for genuinely unstructured tasks like image recognition, sentiment scoring, or free-form-to-query translation.

Researchers at Tenet Security showed how anyone with a public Sentry DSN can inject a fake error report that coding agents like Claude Code, Cursor, and Codex will treat as a fix instruction. The agent fetches the malicious payload via the Model Context Protocol and runs arbitrary commands on the developer’s machine, exposing environment secrets and credentials. Sentry won’t close the write endpoint, leaving the fix to agent runtimes to filter untrusted data.

• A public write-only Sentry DSN lets attackers inject fake error reports that coding agents (Claude Code, Cursor, Codex) blindly treat as trusted fix instructions, leading to arbitrary code execution on developer machines.
• Tenet's tests across 2,388 organizations (including 71 Tranco top-1M sites) got an 85% success rate with 100+ confirmed code executions, hitting even a developer at a $250B Fortune 100 firm.
• The attack is invisible to traditional defenses (firewalls, EDR, WAFs, IAM) since it never touches victim infrastructure or needs passwords, and prompt-level "ignore untrusted data" instructions failed to stop it.
• Sentry isn't closing the vulnerable write endpoint, so the only real fix is runtime-level gating in the agent itself to sandbox or reject commands sourced from external/unauthenticated data.

Gray Swan cofounders Zico Kolter and Matt Fredrikson explain why AI systems need a different security mindset, focusing on indirect prompt injection, agent vulnerabilities and correlated failures. They walk through automated red teaming tools like Shade and the Gray Swan Arena, discuss guardrails, and argue that bigger models aren’t inherently safer and require bespoke security, identity management, and compliance measures.

• Human red-teamers ranked only fourth in robustness testing against browser-based agents, behind specialized automated red-teaming models.
• Scaling model size doesn't automatically improve safety, and agents introduce new vulnerabilities distinct from traditional IT security risks.
• The "lethal trifecta" (untrusted data, private data, exfiltration paths) creates attack surfaces that make a major prompt-injection breach feel inevitable.
• Effective AI defense will require machine-driven interpreters and agent-native identity/permissions systems, since humans can't keep pace with automated attack tools.

SkillSpector scans AI agent skills for vulnerabilities, malicious patterns, and CVEs before installation. It combines fast static checks with optional LLM analysis, covers 64 patterns across 16 categories, and outputs risk scores and detailed reports.

• SkillSpector scans AI agent skills before installation, checking 64 vulnerability patterns across 16 categories (prompt injection, data exfiltration, privilege escalation, etc.) plus real-time CVE lookups via OSV.dev.
• It runs a fast static scan by default, with an optional deeper LLM-based semantic check using providers like OpenAI, Anthropic, or NVIDIA's build.nvidia.com.
• Scans output a 0-100 risk score with severity labels and suggested fixes, in formats including JSON, Markdown, or SARIF for CI/CD pipelines.
• Even without LLM analysis (--no-llm flag), it still catches known code patterns and CVEs.