AI Security tracks Security in the Era of AI. Browse the hub for AI acceptable use policy, aimed at CTOs and delivery teams putting AI into real work.
AI Enablement
A background agent opened a PR at 2 a.m. and the gate let it through, because the gate was built for a worker who could be reasoned with. The DevOps job is no longer writing infrastructure. It is owning the bounded environment agents act inside.
AI Security
Connecting an MCP server is not enabling a feature. It is taking on a code dependency that holds execution and data rights nobody reviewed. You already govern packages and APIs as a supply chain. Your MCP fleet is the same risk under a new name.
AI Security
For two years teams filed prompt injection under "someone else's problem." That filing expired. The moment an agent reads content it did not author, every author of that content can rewrite its instructions.
AI Security
Three lines of hidden text in a README can exfiltrate your AWS credentials while Claude finishes your task. That is not a thought experiment. It is a documented production attack vector.
AI Security
You blocked ChatGPT on the corporate network and added an acceptable-use policy. The incident log did not change, because shadow AI is not a discipline problem. It is a workflow problem: people take the faster path you did not give them.
AI governance
Every AI failure I have investigated had a human who pushed the button. Automation is a delivery mechanism, not a transfer of responsibility.
AI Security
Most AI rollouts ship the tool before the policy. By Q3 the org has the habits the policy was meant to prevent. Ship policy first - in days, not quarters.