See also Meta's disastrous rollout of AI conversation sharing – humans are very, very bad at understanding privacy settings
CYBERSECURITY
-
Anthropic tests Neptune V4 safety system
By
–
Anthropic started testing Neptune V4, a new version of a safety system around Claude models. Red teaming is expected to take around a week. 4.1 preparation continues
-
EU AI Act Requires Transparency, Red-Teaming, and Risk Management
By
–
Mais que fais l'Europe au juste ? L'europe et L’AI Act exige une documentation complète sur la transparence, des résumés des données d'entraînement, des tests de red-teaming, des plans de gestion des risques, des filtres pour les droits d’auteur, et des audits de cybersécurité
-
MCP servers security risks: protecting user data from theft
By
–
Right now users are being encouraged to mix and match MCP servers in a way that makes it trivial for people to steal their data – we are unfairly outsourcing decisions on how to stay secure to people who haven't got a fighting chance of staying safe
-
Flawed AI Security Mitigations Encourage Inherently Insecure Systems
By
–
When it comes to security I think flawed mitigations are actually harmful, because they encourage developers to build systems that are inherently insecure and can never be made safe for their users There are a LOT of things being built right now that should not be built
-
Prompt Injection Vulnerabilities Harder to Fix Than SQL Injection
By
–
If I report a SQL injection vulnerability to a product they can reliably fix it and close the security hole If I report a prompt injection vulnerability they can't
-
SQL Security vs LLM Prompt Injection Vulnerabilities
By
–
Re-read my post. We CAN achieve 100% security with SQL provided we don't make mistakes… and if we DO make mistakes we can fix them to get to 100% We can't do that with LLM prompt concatenation – we don't have a way to fix those mistakes! That's the difference here
-
Demanding Reliable Application Security Solutions
By
–
I disagree: when it comes to application security I think it's acceptable for us to demand solutions that reliably protect us
-
Prompt Injection Filter Risks vs Spam Filter Consequences
By
–
That only works if the damage caused by the occasional attack getting through the filter is acceptable A spam filter missing an email = you see one spam email in your inbox A prompt injection filter missing an attack could = now your private data has been stolen
-
LLM Security: Token Injection Risks and Tool Access Control
By
–
I have yet to see any truly credible protection for this, and I've been looking! You have to assume that anything that can get tokens into your LLM system will be able to trigger any tool that system has access to