AI Agent Security in 2026: LLM Vulnerabilities and Defenses
AI agent security in 2026: prompt injection, sandbox escapes, agent hijacking, and how to defend LLM agents with least privilege and continuous verification.
We publish what we learn
Security Research & Analysis
Original computation on public data. Experiments with reproducible setups. Novel findings when we earn them. Every piece is labeled for exactly what it is.
Continuous Verification vs Annual Pentest: 2026 Guide
Continuous verification vs annual penetration testing in 2026: how they differ, why the once-a-year model misses 67% of exploited vulns, and how to run both.
Read analysis →
Trending7 entries
Vulnerability Prioritization 2026: What CVSS Misses
Vulnerability prioritization in 2026: what CVSS misses, and how EPSS, CISA KEV, and exploit evidence fix it. A reference model with real CVE examples.
Why AI-Built Apps Need a Different Pentest
Prompt injection, over-permissioned agents and secrets in generated code fall outside a standard pentest. What testing an AI-built app should actually cover.
Does SOC 2, ISO 27001, or PCI DSS Require a Penetration Test?
PCI DSS requires penetration testing; SOC 2, ISO 27001 and HIPAA don't name it but expect it. Where a pentest is mandatory versus strongly expected.
Does AI Make SOC 2 Faster? We Fact-Checked the Claims
Compliance vendors claim AI makes SOC 2 50-90% faster. We checked which claims disclose any methodology. Most don't. What's substantiated, and what isn't.
Securing AI-Generated Code: What 23 Studies Show
We reviewed 23 studies on AI-generated code security. About one in three AI code samples contains a vulnerability, a rate that hasn't improved. What works.
Annual Pentests Miss 67% of Exploited Vulnerabilities
We measured the disclosure-to-exploitation window for all 245 CVEs added to CISA KEV in 2025: a 26-day median. Annual pentests would miss 67.5% of them.