The Security Blog

What we are finding in AI agent security: MCP exposure, runtime guardrails, supply chain attacks, and the CVEs worth your afternoon.

Claude Said No to Its Own Author

I asked Claude three times to publish my own article on my company’s website, and it refused every time. Then I typed /model opus, and it said yes in one reply.

Prismor Research Team · October 19, 2026

All articles

Agent Security

How to Run AI Agents Safely in Your Company: A 90-Day Roadmap

October 12, 2026

Agent Security

10 Security Checks Before Installing Any MCP Server

October 5, 2026

Agent Security

Hooks or a Proxy for Agent Runtime Security: What Each One Sees and When to Use It

October 1, 2026

The Security Blog

Claude Said No to Its Own Author

All articles

How to Run AI Agents Safely in Your Company: A 90-Day Roadmap

10 Security Checks Before Installing Any MCP Server

Hooks or a Proxy for Agent Runtime Security: What Each One Sees and When to Use It

A Classifier in Front of the LLM Judge: Prompt-Injection Screening at 1.1s per 12,000 Characters

For Coding Agents, Harness Alignment Matters More Than Model Alignment

Prismor OSS Ships Three Governance Modes for AI Coding Agents, and What Each One Gives Up

The Definition of a Wrong Agent Action Depends on Org Context That Drifts

Why Agent Identity Needs More Than OAuth Delegation

Where AI Agent Security Tools Attach, and What Each One Misses

How to Build a Trustworthy AI Control Plane for Enterprises

Hugging Face Was Breached by an Autonomous AI Agent, Then Had to Use an Open-Weight Model to Investigate It

The EU AI Act Is in Motion: Scope, Timelines, and What Your Team Actually Has to Do

Beyond the Binary: Why Agent Governance Is an Optimization Problem

AI SOCs Need an Execution Boundary Before They Gain Autonomy

Google Dialogflow CX Rogue Agent Showed How One Playbook Editor Could Reach Every Code Block Agent

AI Agent Security in 2026: Why the Control Plane Has to Sit at the Tool-Call Boundary

Exposed MCP Servers in 2026: What the Scans Found

Why We Built Prismor to Secure AI Coding Agents at the Tool-Call Boundary

143 Mastra npm Packages Backdoored via easy-day-js Dependency Swap

TrapDoor: 34 Malicious Packages Stole Crypto Wallet Keys and SSH Credentials Across npm, PyPI, and Crates.io

AntV npm Packages Compromised via Hijacked Maintainer Account

CVE-2026-42945: NGINX Rewrite Module Heap Overflow Enables Unauthenticated Code Execution

TanStack and Mistral npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack

Microsoft Patches Critical ASP.NET Core DataProtection Flaw That Breaks Cryptographic Signatures

Vercel got breached. Here is what that means for everyone downstream.

When the System Built to Warn Us Can No Longer Keep Pace

Claude Code .env Secrets: Keep API Keys Out of Transcripts

What Secrets Can AI Coding Agents Access?

When a core npm dependency becomes the attack path: lessons from the Axios compromise

When the AI dependency becomes the attack path: lessons from the LiteLLM PyPI compromise

When the security scanner becomes the attack path: lessons from the Trivy compromise

Critical Path Traversal Vulnerability in jsPDF Library (CVE-2025-68428)

MongoBleed: Unauthenticated Memory Disclosure in MongoDB (CVE-2025-14847)

Critical Remote Code Execution in n8n Workflow Automation: CVE-2025-68613

The Return of Shai-Hulud: npm's Worm Strikes Back

Critical Chrome Zero-Day Exploited: Google Rushes Emergency Patch for CVE-2025-0411

Critical Remote Code Execution Vulnerability in React Server Components