#nist-ai-rmf
12 posts
Weekly AI Cybersecurity News Roundup — July 14–20, 2026
White House launches AI and cybersecurity coordination group, SANS warns of AI governance gap as adoption surges to 78%, Check Point report reveals AI now drives cyber attacks not just assists them, CISA adds two new KEV entries, novel agent data injection attack makes AI agents misclick, and ChatGPT single-prompt full cyber attack chain demonstrated.
AI-Generated Zero-Day Exploits: When Autonomous Agents Become the Weapon
A deep research analysis of how AI agents are now autonomously discovering and weaponizing zero-day vulnerabilities — from Google's confirmation of the first AI-created zero-day to PROMPTSPY's Gemini-powered Android backdoor and the supply chain attacks targeting AI infrastructure.
Giskard Review: Open-Source LLM + ML Security Testing, Tested
Giskard is the only open-source AI testing framework that covers both LLM security and traditional ML model quality in a single Python library. We test its autonomous red teaming agents, RAGET toolkit, 40+ vulnerability probes, and how it fits into a modern AI security stack alongside Garak and Promptfoo.
RAG Pipeline Security: Preventing Data Leakage, Poisoning, and Injection in AI Knowledge Bases
A practical guide to securing Retrieval-Augmented Generation pipelines in production — covering knowledge base poisoning, indirect prompt injection, data leakage through vector stores, and access control patterns for SaaS teams.
Agentic AI Security in 2026: Why One in Eight Breaches Now Involves Autonomous Agents
A comprehensive deep research analysis of the agentic AI security landscape — from prompt injection and memory poisoning to the OWASP Top 10 for Agentic Applications and the defense architectures that can actually protect autonomous agent deployments.
Lakera Guard Review: Check Point's Runtime AI Security Firewall, Tested
Lakera Guard is the most widely deployed runtime AI security API for stopping prompt injection and jailbreak attacks in real time. Now part of Check Point after a $300M acquisition, we test its detection accuracy, latency, integration path, and how it fits into a modern LLM security stack alongside red-teaming tools like Promptfoo and Garak.
AI Supply Chain Security in 2026: The Hidden Link That Controls Your Model Pipeline
A comprehensive deep research analysis of AI supply chain security — from PyTorch dependency poisoning and Hugging Face model backdoors to NIST AI 600-1 provenance requirements, ML-BOM mandates, and the defense controls that actually work for production AI pipelines.
AI Model Extraction: How Attackers Steal $3M Models for $200 in API Queries
A comprehensive deep research analysis of AI model extraction attacks — from Tramèr et al.'s foundational 2016 work to 2026's distributed multi-client bypasses, CerberusAI framework, entangled watermarks, and the emerging cold-copy threat from Bleeding Llama (CVE-2026-7482).
Garak Review: NVIDIA's Open-Source LLM Vulnerability Scanner, Tested
Garak (8.2k GitHub stars, Apache 2.0) is NVIDIA's open-source LLM vulnerability scanner with 50+ probe modules for prompt injection, jailbreaks, encoding bypasses, and data leakage. We test it against real model endpoints, break down the CLI workflow, compare it to PyRIT and Promptfoo, and tell you whether it deserves a spot in your AI security stack.
Secrets Management for AI Pipelines: A Practical Security Guide
A step-by-step guide to securing API keys, tokens, and credentials in AI-powered automation pipelines — covering detection, rotation, vaulting, and CI/CD hardening with real-world incident data.
LLM Prompt Injection: The #1 AI Security Threat in 2026
A comprehensive deep research analysis of the prompt injection landscape — from academic taxonomies and real-world CVEs (EchoLeak, Copilot RCE) to enterprise defense strategies and the emerging agent hijacking threat model.
Securing the AI Stack: A Practical Guide to Hardening Agent Pipelines
A hands-on guide to securing AI agent pipelines, from API key management to rate limiting and isolation zones — based on real production hardening of a 6-blog AI publishing empire.