// model security

All signals tagged with this topic

Jul 13

AI Agent Tools Create New Hijacking Surface for Prompt Injection

WebMCP's architecture gives AI agents access to named, callable tools, creating a direct attack vector for prompt injection that bypasses traditional safeguards. Chrome's security guidance now flags tool exposure as a critical configuration problem, placing production teams under immediate pressure to redesign tool interfaces or accept operational compromise. The shift from theoretical LLM vulnerabilities to weaponizable exploits in deployed systems is forcing enterprises to recalibrate how they grant agent permissions and isolate access.

theme-ai model security IP Rights competitive threat

Jun 25

Anthropic accuses Alibaba of systematically reverse-engineering Claude

Source: Bloomberg (paywall)

Anthropic's formal complaint to U.S. officials alleges that Alibaba used roughly 25,000 accounts to query Claude nearly 29 million times over three months—a pattern consistent with extracting training data to build competing models rather than legitimate usage. The complaint escalates commercial and geopolitical tensions over AI model access, forcing cloud providers and regulators to distinguish between normal API consumption and coordinated intelligence gathering. It also signals that frontier AI companies now treat their models as defensible intellectual property worth protecting through government intervention.

theme-ai ai safety model security ai agent vulnerabilities

Jun 24

Fake AI Agent Skill Bypassed All Security Scanners

Source: The Next Web

A security firm demonstrated that malicious AI agent skills can pass every automated defense mechanism on marketplace platforms. A deliberately crafted fake skill reached 26,000 installations before detection, exposing a gap: current vetting infrastructure treats AI agent code as lower-risk than it is. Compromised skills can execute arbitrary actions on behalf of enterprises across data, finance, and infrastructure systems. Marketplace operators and enterprise AI teams are now racing to address this as agent architectures become standard infrastructure.

theme-ai ai safety model security ai alignment

May 13

AI Agent Skills Create New Supply Chain Attack Surface

Source: The Register: Biting the hand that feeds

As developers integrate third-party AI agent skills into production systems—granting them access to secured resources and data—they're installing privileged code with minimal vetting. A compromised skill package can pivot from its intended function to exfiltrate credentials, manipulate databases, or move laterally across infrastructure, all while appearing to execute legitimate AI-assisted tasks. This mirrors npm/PyPI vulnerabilities but with higher stakes: agents operate with standing access rather than one-time execution, so a poisoned skill can affect the entire enterprise.