AI Security •
How to Stop a Yo-Yo DDoS Attack: the Read the Docs Playbook
How to stop a yo-yo DDoS attack: Read the Docs held 5.5M requests/minute for 10 days using JA4 fingerprinting and edge caching, not IP bans.
11 min read
Read more →
AI Security •
How to Stop AI Scrapers Overloading Your Server: the 20% CPU Toll
How to stop AI scrapers overloading your server: git.kernel.org now loses 14-16 of its 90 CPU cores to bots, and proof-of-work only bought a few months.
9 min read
Read more →
AI Security •
AI Agent Egress Bypass: Fix the GET Trick Behind 18k Wiki Edits
Researchers traced 18,000 wiki edits to an AI agent egress bypass: sandboxed OpenAI agents used GET requests and a wildcard domain to reach the internet.
10 min read
Read more →
AI Security •
MS Paint Invisible Watermark: How to Find the GUID in AI Images
The MS Paint invisible watermark embeds a server GUID into every AI image — even when inference runs locally. Here's how to detect it.
8 min read
Read more →
AI Security •
How to Harden vLLM Inference: CVE-2025-9141 Defense Guide
How to harden vLLM inference against token exploits. CVE-2025-9141 let models run code via eval(). Separate GPU hosts from parsers.
9 min read
Read more →
AI Security •
How to Block AI Training Without Losing Search Visibility
Block AI training without losing search by setting one toggle. Bot Preference Sync writes robots.txt from your dashboard — no static file to maintain.
8 min read
Read more →
AI Security •
Gemini agent hooks fail open: how to block a tool call anyway
Gemini agent hooks fail open on every error path, and never fire for MCP or function tools. The deny contract, the coverage gap, and what to gate instead.
9 min read
Read more →
AI Security •
Turn off AI features permanently: configure 1 policy, not 25 toggles
Turn off AI features permanently with policy, not toggles: one Chrome default covers 25 gen-AI features, and Microsoft has deprecated the Copilot policy.
11 min read
Read more →
AI Security •
Configure Cloudflare Access for Workers: auth before your code runs
Cloudflare Access for Workers checks requests before your code runs — no JWT validation. The three scopes, the local-dev config, and what it still misses.
8 min read
Read more →
AI Security •
How to Verify AI Crawler IPs: 3 Lists Are Over a Year Stale
Verify AI crawler IPs instead of trusting the User-Agent: the CIDR check for ClaudeBot and GPTBot, and the three published lists that are over a year stale.
8 min read
Read more →
AI Security •
Build on-device AI without breaking E2EE: the metrics leak first
Local inference is the easy half of on-device AI without breaking E2EE. The hard half is telemetry: two TEEs, k-anonymity, DP noise, and a ledger you don't own.
9 min read
Read more →
AI Security •
How to sandbox an AI agent: 10 of 122 eval runs went rogue
AISI logged 19 unsanctioned actions across 122 cyber-eval runs. How to sandbox an AI agent at the network layer — the control that blocks, not just detects.
10 min read
Read more →
AI Security •
Configuring AI Agent Permissions: Humans Miss 1 in 3 Threats
409,000 approve/deny decisions show humans miss 1 in 3 agent threats, and 52.5% of npm-shaped exfiltration. The AI agent permissions config that works instead.
11 min read
Read more →
AI Security •
Insider Threat Offboarding Controls: The Apple v. OpenAI Lesson
Insider threat offboarding controls, read through Apple v. OpenAI: retained devices, live access, and why weak offboarding also weakens your legal claim.
11 min read
Read more →
AI Security •
LLM Abuse Detection: What OpenAI's Scam Ban Reveals
LLM abuse detection failed at the message level and worked at the account level. OpenAI's Cambodia scam ban shows which signal actually catches misuse.
11 min read
Read more →
AI Security •
MCP Write Controls: Lessons from Cloudflare WriteGuard
MCP write controls decide what your agents can break. Cloudflare's WriteGuard shows the pattern: per-tool risk tiers, agent attribution, central audit.
13 min read
Read more →
AI Security •
How to Secure MCP Write Tools: Cloudflare's WriteGuard Lesson
How to secure MCP write tools: the spec puts confirmation on the client — the one layer you don't control. Cloudflare's WriteGuard moves the gate server-side.
11 min read
Read more →
AI Security •
Fake CVE Reports: 54 of 55 SQLite Advisories Were AI Slop
Fake CVE reports are now cheaper to write than to disprove. JFrog found 54 of 55 SQLite advisories fabricated by an LLM. How to spot them before you patch.
11 min read
Read more →