AI Security

A RAG answer can expose documents; an agent can change resources.

Direct input, a retrieved document, a tool result or repository text may contain instructions that conflict with the task.

Identify secrets, personal records and restricted documents before a model call.

A model can return valid JSON containing an unauthorized resource, a dangerous URL or invented SQL.

A document belongs to a tenant and requires a trusted approval decision before retrieval.

Treat model tool arguments as untrusted input.

Limit input size, model steps, tool attempts and fan-out before launching work.

A final response saying “I did not access it” is not evidence of authorization enforcement.

Model files, datasets, tool packages and CI actions are distinct supply-chain inputs.

An untrusted instruction stored as memory can influence later runs after the original document is gone.

An MCP client name, server description or declared capability is not authenticated permission.

Avoid exposing shell, arbitrary file access and generic network execution when the task does not need them.

Capture sanitized event codes, scoped request identifiers, policy versions and effect outcomes.

An issue, dependency README, error log or skill may contain attacker-authored instructions.