A threat model for Claude in Chrome, agentic browsers risks. Claude in Chorme JS tool resulting risks, and what you should be aware of when adopting Claude in your org.

How should we reason about machines taking over

ALT: a woman is drinking a cup of coffee while wearing a blue tank top .

Soft boundaries are created by training AI real hard not to violate control flow, and hope that it doesn’t. Hackers don’t care about what happens most of the time.

Discover how prompt injections can lead to zero-click exploits threatening AI agents built using Copilot Studio. Learn about real-world risks, including data leakage and security blind spots. Bypass C...

This post shares the local optima Manus arrived at through our own "SGD". If you're building your own AI agent, we hope these principles help you converge faster.

Black Hat

This is part 2 on OpenAI’s Security Research Conference. Here is part 1.

The conversation around AI is always about vibes. So let’s talk about the vibes at OpenAI’s inaugural Security Research Conference last week.

The InfoSec community is strongest when it can collaborate openly. Few organizations can fend off sophisticated attacks alone—and even they sometimes fail. If we all had to independently discover ever...

Copilots and agents are a new access vector; How to build an AppSec program that scales to the level of citizen development

Naming is powerful. An excellent name does more than frame the problem, it hints at ownership, solutions, and urgency to address it. In a very real sense, they are like equivalence proofs in mathemat...

An offensive security toolset for Microsoft 365 focused on Microsoft Copilot, Copilot Studio and Power Platform - mbrg/power-pwn

YouTube video by Microsoft Security Response Center (MSRC)