The article shows how LLMs use discrete role tags (like <user>, <think>, <tool>) to structure context but also rely on writing style, causing them to misclassify malicious commands in tool-tagged text as user instructions. Using linear probes to measure internal “roleness” (CoTness, Userness, etc.), the authors reveal why prompt injections succeed and suggest focusing research on the science of roles to defend against such attacks.

This article shows how to use the Claude Compliance API to feed full chat and file content into your SIEM, then write detections for AI-specific threats that live in the content. It covers prompt injections in uploaded files, jailbreaks, system-prompt leaks, data-laundering requests, sensitive disclosures, and insider data-flow risks.

Google integrates its computer use tool into Gemini 3.5 Flash, allowing agents to see, reason and act across browser, mobile and desktop environments for tasks like continuous software testing and accessibility audits. It uses adversarial training plus optional safeguards—explicit confirmations and auto-stop triggers—to reduce prompt-injection risks, and is accessible via the Gemini API and Enterprise Agent Platform.

This post breaks down Amazon’s lawsuit against Perplexity over its Comet AI agentic browser, which browses and transacts on users’ behalf while disguising itself as Chrome. It explains how these browsers work, the security risks they introduce—like prompt injection attacks—and why sites like Amazon demand transparent agent identification.

This issue covers a new AI-built SQL parser for PostHog that’s 70× faster, Linear’s move from styled-components to StyleX for better React performance, and a deep dive into misleading database benchmarks. It also highlights tools like Gemini 3.5 Flash’s computer use feature, the peerd automation extension, a breakdown of prompt injection vulnerabilities, and other AI and dev updates.

Gray Swan cofounders Zico Kolter and Matt Fredrikson explain why AI systems need a different security mindset, focusing on indirect prompt injection, agent vulnerabilities and correlated failures. They walk through automated red teaming tools like Shade and the Gray Swan Arena, discuss guardrails, and argue that bigger models aren’t inherently safer and require bespoke security, identity management, and compliance measures.

Trail of Bits crafted four malicious agent skills that bypass Cisco, Vercel, and ClawHub scanners by padding code or embedding payloads in docx and bytecode. The article shows how Siri-AI’s integration with private cloud compute and search can expose messages, emails, and calendars through prompt injection. It also covers a PyPI worm that auto-executes a hades-setup.pth hook to steal cloud and GitHub tokens, urging audits and immediate token rotation.