Understanding Prompt Injection In Order to Contain It

Julie Brunias is an AI Security Architect and independent researcher with 14 years of experience securing critical infrastructure, banking, telecommunications, and manufacturing environments. She specialises in adversarial AI testing, agentic system security, and AI governance — with a focus on the gap between what organisations believe their AI systems do and what those systems actually do under real-world conditions. A frequent international speaker, she has presented at DEF CON AI Village, InCyber, GoSec, HackMiami, The Diana Initiative, Microrbit Paris, and Black Hat SecTor. - InfoSec World is introducing a fresh experience for 2026, with new voices, a new venue, and new topics reflecting the challenges security teams are facing now. Join practitioners and leading professionals from across industries in Orlando, October 12–14. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026. - AI is changing financial services fast. Join us December 9 in New York City for the Financial Services AI Security Forum, where industry leaders will tackle AI security, risk, fraud, governance, and resilience. Register by October 2 and save $400. Tickets are just $195, so secure your seat today at securityweekly.com/aiforum2026 Mike Shema - An alignment assessment of recent cybersecurity incidents Anthropic There's a section that stands out to me as both funny and emblematic of modern security, including the mistakes leading to agents going off-path. It starts out with noting how Anthropic's agents targeted PyPI and “...ultimately succeeded in uploading the package, which was soon installed on 15 third-party hosts.” However, you have to read further to realize that “...all 15 of these third parties were security vendors deliberately scanning for new packages and installing them in sandboxed environments to assess the package for security concerns.” And then the part that prompts a long sigh -- “One vendor’s scanner leaked its access credentials to the model while installing the package, which the model then used to access the vendor’s live database.” - OpenAI agents carried out an undisclosed cyber-attack on RubyGems Another example of agents targeting package repos, which doesn't seem much different or more novel than the history of humans targeting package repos. - CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key This stood out for a very specific detail. The system "...validated the join key's encoding but never its presence, so an unset configuration value became a signing secret that anyone could reproduce." That's an important nuance when dealing with null vs. empty string vs. arbitrary string vs. valid, signed string. - The Anthropic Glasswing Receipts Are Starting to Trickle In | Blog | VulnCheck It's always nice to see an analysis of data in the vuln management world and this is a great example. It's one thing to find vulns quickly, it's another to see that “...five months into Project Glasswing, only 9.8% of the findings have made it to a project maintainer…” And that leads to a bigger discussion about what the real risk might be that's associated with these bugs and whether every bug has to be prioritized just because it's been found. - Cybersecurity Benchmarking: Why, Why Not, When and How Why cybersecurity should look for measurements that indicate desirable improvements as opposed to just tracking activity. A big part of this is looking for leading indicators and proactive efforts. - Evaluating AGENTS.md: Are Repository-Level Context Files Helpful for Coding Agents? Speaking of benchmarks, a huge part of the nondeterminism of models is that it's hard to evaluate them consistently and even harder to evaluate the impact of tweaks in prompts and markdown files. But, as this paper argues, some of those markdown files don't even make a difference in behavior, just the amount of tokens you're paying for. - FYI: OWASP MCP Taxonomy · GitHub A list! But a useful one because it's geared towards education and establishing a shared language when talking about MCPs. It can foster better discussions when considering threat models, designs, and security controls. - FYI: Threat Model for the Web This has a good example of the "assume breach" mindset. The doc's “…value lies not in assuming that compromise is impossible, but in constraining what follows if compromise occurs.” It then details high-level boundaries within the browser environment and invariants whose properties should not change.