Home | Secure Prompt

This website uses cookies

Read our Privacy policy and Terms of use for more information.

Secure Prompt

The authoritative newsletter on AI security, threats, and defense frameworks.

Written by

Secure Prompt

Featured Posts

Signal Report #006 - The streak we called reliable just broke. Here's what that taught us.

Jul 1, 2026

•

8 min read

Signal Report #006 - The streak we called reliable just broke. Here's what that taught us.

For three weeks the consumer-compromise surface was the most reliable pattern in our graph. This week it vanished - and the conversation pivoted to enterprise data theft and the first nation-state actor we've seen in the series. Plus: a two-part prediction that split down the middle.

Secure Prompt Team

Signal Report #005 - The conversation moved to Washington. The risk didn't.

Jun 24, 2026

•

7 min read

Signal Report #005 - The conversation moved to Washington. The risk didn't.

This week the AI-security discourse reorganized around governance and policy - while the actual exploitable risk kept climbing in silence. Plus: a prediction we made last week just failed, and the way it failed taught us more than a hit would have.

Secure Prompt Team

Threat Wire #005: The AI agent is the intrusion now

Jun 22, 2026

•

5 min read

Threat Wire #005: The AI agent is the intrusion now

One click in Copilot exfiltrates your inbox. A poisoned web page makes an AI agent run code on its own host. A hijacked npm org backdoors AI-framework packages. The week the agent layer became the attack surface.

Secure Prompt Team

Signal Report #004 - The gap nobody's bridging - until the government tried

Jun 17, 2026

•

6 min read

Signal Report #004 - The gap nobody's bridging - until the government tried

This week every structural blind spot in AI security shared one disconnected endpoint: the global stakes. The discourse won't connect macro AI risk to concrete failure - so the government did it by force. Plus: a prediction we called five weeks ago just landed.

Secure Prompt Team

Threat Wire #004: Opening a repo is now the exploit

Jun 15, 2026

•

4 min read

Threat Wire #004: Opening a repo is now the exploit

The Miasma/Hades worm hijacks four AI coding tools with one commit - no install required. LiteLLM hits CISA's KEV under active ransomware attack. And a NIST proof says no guardrail set can ever block every jailbreak.

Secure Prompt Team

Signal Report #003 - The orphan moved - what week-over-week graph analysis just caught

Jun 10, 2026

•

5 min read

Signal Report #003 - The orphan moved - what week-over-week graph analysis just caught

Last week's structural blind spot didn't close. It jumped platforms - Apple to Meta - in seven days. Plus: we score our first prediction, and we got it wrong.

Secure Prompt Team

Threat Wire #003: MCP became the attack surface this week

Jun 8, 2026

•

4 min read

Threat Wire #003: MCP became the attack surface this week

A HuggingFace RCE that defeats trust_remote_code. Google's MCP connector hijacked via CORS. 770+ exploitable flaws across 19,000 MCP servers. The protocol everyone rushed to adopt is the soft underbelly.

Secure Prompt Team

Signal Report #002 - The one AI bug actually being exploited is hiding at the gateway

Jun 3, 2026

•

5 min read

Signal Report #002 - The one AI bug actually being exploited is hiding at the gateway

9 clusters, one orphan - the surface users actually touch is walled off from everything securing it, and a KEV-listed gateway bug proves the point.

Secure Prompt Team

Threat Wire #002: The week trust boundaries collapsed across the AI stack

Jun 1, 2026

•

3 min read

Threat Wire #002: The week trust boundaries collapsed across the AI stack

Starlette auth bypass hits vLLM, LiteLLM, and MCP gateways. SymJack lands six AI coding agents. First LLM-agent-driven intrusion captured in production.

Secure Prompt Team

Signal Report #001 - Why agentic AI security isn't seeing the supply chain attacks

May 27, 2026

•

4 min read

Signal Report #001 - Why agentic AI security isn't seeing the supply chain attacks

Network analysis of this week's AI security discourse reveals a structural blind spot - and the EPSS top-50 confirms it.

Secure Prompt Team

Threat Wire #001: The AI supply chain just had its worst week of 2026

May 25, 2026

•

3 min read

Threat Wire #001: The AI supply chain just had its worst week of 2026

TeamPCP. OpenAI. TrustFall. ChromaDB. Five critical AI security stories in one week.

Secure Prompt Team

Newsletter Issue #12

Jan 30, 2026

•

13 min read

Newsletter Issue #12

I Built My Own AI Agent This Week. Here's What I Learned (The Hard Way).

Secure Prompt Team

2025 AI Security Year in Review

Jan 9, 2026

•

2 min read

2025 AI Security Year in Review

The AI security incidents, vulnerabilities, research, and regulations that defined 2025 - curated in one place.

Secure Prompt Team

Newsletter Issue #11

Dec 24, 2025

•

4 min read

Newsletter Issue #11

A year-defining week for AI security, a thank-you to our first subscribers, and a short holiday pause before we return in January.

Secure Prompt Team

Special Issue

Nov 19, 2025

•

6 min read

Special Issue

This week’s Secure Prompt: AI-Orchestrated Cyber Espionage: Inside GTG-1002.

Secure Prompt Team

Newsletter Issue #1

Sep 16, 2025

•

10 min read

Newsletter Issue #1

AI Security Shakeups: M&A moves, active threats, and a critical LLM vulnerability.

Secure Prompt Team

Latest Posts

Threat Wire #016: An agent found the DNS gap

Sep 28, 2026

•

5 min read

Threat Wire #016: An agent found the DNS gap

OpenAI paused tool use for its most capable models after an agent got through a DNS-filtering gap. Gambit reports at least 27 companies compromised between September 10 and 15 by an operator running open-source agent harnesses. And an unpatched SGLang RCE, rated 9.8 by its finder, sits outside its own published affected range.

Secure Prompt Team

Signal Report Special - For fifteen issues I mapped the conversation. Anthropic just published the incidents.

Sep 16, 2026

•

5 min read

Signal Report Special - For fifteen issues I mapped the conversation. Anthropic just published the incidents.

Anthropic released 154 pages covering nine months of real attacks it caught and shut down across seven harm areas. Three hours from a stolen token to full cloud admin. A surveillance platform on 25 million SIM cards that is still deployed after the account was banned. The techniques are old; the economics are not. Plus a prediction this report does not settle, and the 29-minute film version.

Secure Prompt Team

Threat Wire #015: Serve them worse answers

Sep 14, 2026

•

5 min read

Threat Wire #015: Serve them worse answers

The NSA, CISA and FBI jointly named six Chinese AI companies for extracting billions of tokens from US frontier models - and the defense they recommend is to subtly degrade the answers those companies get, without telling them. Anthropic published a fourth incident 34 days after its promised transcript deadline. And multiple high-severity AI advisories are missing from the feeds your vulnerability scanners actually read.

Secure Prompt Team

Archive

Threat Wire #016: An agent found the DNS gap

Sep 28, 2026

•

5 min read

Threat Wire #016: An agent found the DNS gap

OpenAI paused tool use for its most capable models after an agent got through a DNS-filtering gap. Gambit reports at least 27 companies compromised between September 10 and 15 by an operator running open-source agent harnesses. And an unpatched SGLang RCE, rated 9.8 by its finder, sits outside its own published affected range.

Secure Prompt Team

Signal Report Special - For fifteen issues I mapped the conversation. Anthropic just published the incidents.

Sep 16, 2026

•

5 min read

Signal Report Special - For fifteen issues I mapped the conversation. Anthropic just published the incidents.

Anthropic released 154 pages covering nine months of real attacks it caught and shut down across seven harm areas. Three hours from a stolen token to full cloud admin. A surveillance platform on 25 million SIM cards that is still deployed after the account was banned. The techniques are old; the economics are not. Plus a prediction this report does not settle, and the 29-minute film version.

Secure Prompt Team

Threat Wire #015: Serve them worse answers

Sep 14, 2026

•

5 min read

Threat Wire #015: Serve them worse answers

The NSA, CISA and FBI jointly named six Chinese AI companies for extracting billions of tokens from US frontier models - and the defense they recommend is to subtly degrade the answers those companies get, without telling them. Anthropic published a fourth incident 34 days after its promised transcript deadline. And multiple high-severity AI advisories are missing from the feeds your vulnerability scanners actually read.

Secure Prompt Team

Signal Report #015 - "Security" stopped holding this field together. Again.

Sep 9, 2026

•

5 min read

Signal Report #015 - "Security" stopped holding this field together. Again.

The concept holding AI security together flipped from "security" to "agent" for the second time - this time by the widest margin on record. Vendors shipped agent identity and per-action authorisation, and a bipartisan bill would put NIST behind it. Meanwhile the incident record shows four cases where a name badge would not have been the binding control.

Secure Prompt Team

Threat Wire #014: Three labs, three yardsticks

Sep 7, 2026

•

5 min read

Threat Wire #014: Three labs, three yardsticks

OpenAI says GPT-6 Astra is the first model to reach Critical cybersecurity capability. Anthropic's 212-page Mythos 5.1 system card says its strongest cyber model has yet to show novel offensive capability. Google DeepMind says it deliberately built for defence over exploitation. Meanwhile Unit 42 worked an intrusion that compressed more than fifty ATT&CK techniques into under ten hours, and Label Studio's lowest-privileged role can steal an administrator's API token with no fix to install.

Secure Prompt Team

Signal Report #014 - One report pulled the whole field back to the centre.

Sep 2, 2026

•

5 min read

Signal Report #014 - One report pulled the whole field back to the centre.

OpenAI's post-incident report on the Hugging Face breach collapsed the discourse graph from 11 clusters to 8 and pushed the hub to its widest lead in the series. Meanwhile seven of the eight CVEs on my AI/ML watchlist held exactly the same exploitation score as last week. Plus: a prediction that was dead before I published it.

Secure Prompt Team

Threat Wire #013: Twelve hundred agents found each other

Aug 31, 2026

•

5 min read

Threat Wire #013: Twelve hundred agents found each other

OpenAI published a 38-page postmortem of the Hugging Face incident, and METR and Redwood Research published an independent 91-page investigation the same day. Roughly 1,200 agents meant to be isolated found an unsanctioned message board and exchanged more than 70,000 messages and files. A ransomware crew drove Cursor's coding agent inside ten victim networks. And Chainlit hit CVSS 9.8 because its allowlist checked the executable and never the arguments.

Secure Prompt Team

Signal Report #013 - The second time the centre lost, it lost to something specific.

Aug 26, 2026

•

5 min read

Signal Report #013 - The second time the centre lost, it lost to something specific.

Twice now the general AI-security conversation has stopped being the largest cluster in the map. In July it was displaced by ordinary ransomware coverage. This week it was displaced by data, prompts, secrets and Copilot - and the hub's grip on the bridges fell to its lowest ever. Plus: the prediction I declined to bank on a technicality has now landed on its own terms.

Secure Prompt Team

Signal Report #012 - The money arrived. It's connected to nothing.

Aug 19, 2026

•

5 min read

Signal Report #012 - The money arrived. It's connected to nothing.

Money poured into AI security this week. In the discourse graph, the funding cluster is the endpoint of all three structural gaps - disconnected from code autonomy, from prompt attacks, and from the research. Plus: one of the year's largest AI supply-chain compromises came through a door my own watchlist doesn't have.

Secure Prompt Team

...