A field guide, a red-team bench that runs in your browser, and a weekly radar for AI agent security. Plain words, tested where it says tested.https://www.joshbotz.com/en-ushttps://www.joshbotz.com/guide/prompt-injection/https://www.joshbotz.com/guide/prompt-injection/An AI agent can't tell the difference between the job you gave it and instructions that show up inside a ticket, email, or web page it reads while doing that job. So an attacker writes the instructions into the content. The agent follows them. That's prompt injection, and in my lab it worked on the cheapest model nine times out of ten.Wed, 09 Sep 2026 00:00:00 GMTguideattacktestedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/rag-poisoning/https://www.joshbotz.com/guide/rag-poisoning/A retrieval assistant answers from documents it looks up, with citations. Every overt attack I ran against one was resisted when the true answer was also in the documents it found. The attack that worked every time was quieter: change the one authoritative document and leave no correct copy behind. Six times out of six the assistant stated the wrong value as fact, citing the corrupted source. No inference-time filter changed that.Wed, 09 Sep 2026 00:00:00 GMTguideattacktestedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/canary-tokens/https://www.joshbotz.com/guide/canary-tokens/A canary token is a fake secret you plant on purpose: a key, a password, a record that nothing legitimate should ever touch. If it shows up leaving the building, something went wrong and you know exactly when. For AI agents this matters because an agent that refuses one attack is not the same as a system that notices the next one succeeding.Wed, 09 Sep 2026 00:00:00 GMTguidecontroltestedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/output-redaction/https://www.joshbotz.com/guide/output-redaction/Most agent leaks need the agent to be holding the secret in the first place. If the tool that looks up an account returns recovery codes, the agent can be talked into sending them. If the tool returns the codes masked, the agent can be talked into sending an email and the attacker still gets nothing. In my lab this took the leak rate from 9 in 10 to zero.Wed, 09 Sep 2026 00:00:00 GMTguidecontroltestedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/ai-use-policy-basics/https://www.joshbotz.com/guide/ai-use-policy-basics/I ran a checker over 34 real, published AI acceptable-use policies, looking not for AI rules but for the ordinary ones: keep your account safe, use approved software, report incidents. Most were missing. 94% had no safe-computing duty. Two in three said nothing about account security or approved tools. The AI clauses were there. The floor under them wasn't.Wed, 09 Sep 2026 00:00:00 GMTguidecontroltestedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/mcp/https://www.joshbotz.com/guide/mcp/MCP stands for Model Context Protocol. It's a standard way to plug tools and data into an AI assistant: a server says "here are the things I can do" and the assistant can call them. That's what turns a chat window into an agent that reads your files, queries your systems, and sends things. Every one of those plugs is also a place where the agent can be lied to, or can do damage.Wed, 09 Sep 2026 00:00:00 GMTguidetermreportedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/risk-tiers/https://www.joshbotz.com/guide/risk-tiers/A risk tier is a label you give a system that decides how much scrutiny it gets. Low tier, light checks. High tier, the full treatment. Every mature software development policy I read already does this. None of them mentioned AI at all. The AI frameworks turned out to use the same move independently. So the bridge from the governance you have to the governance you need isn't a new framework. It's the tiering you already do, pointed at new risks.Wed, 09 Sep 2026 00:00:00 GMTguidetermtestedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/guide/sandbox-escape/https://www.joshbotz.com/guide/sandbox-escape/In July 2026 Hugging Face disclosed that an autonomous agent system had reached limited internal datasets and service credentials. OpenAI later said the agent came from one of its own internal model evaluations, found a weakness in its evaluation sandbox, reached the internet, and went looking for benchmark answers. Nobody meant harm. The box the agent ran in had a way out, and the agent found it.Wed, 09 Sep 2026 00:00:00 GMTguideincidentreportedjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/radar/#w-2026-W37/https://www.joshbotz.com/radar/#w-2026-W37/A coding agent ran a command hidden in a web page it was asked to summarize. Same trick as the ticket con, different door. If your agent reads the web and can run things, the web can run things. OpenAI's evaluation agent reached Hugging Face's internal systems. The lesson isn't about the model. It's that the box had a door and nobody was watching the door at machine speed. Refusal and detection are different controls. An agent that resists one attack tells you about one attack. A tested alarm tells you about the next one. OWASP published its Top 10 for Agentic Applications. If your policy or vendor questionnaire cites OWASP agentic risks, check which document and which numbering it means. They're different lists.Tue, 08 Sep 2026 00:00:00 GMTradarjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/ai-agent-prompt-injection-social-engineering/https://www.joshbotz.com/ai-agent-prompt-injection-social-engineering/I turned off an AI support agent's defenses and ran six attacks at it across three models. The technical tricks got nothing. The oldest con in the book walked out with the codes.Tue, 16 Jun 2026 00:28:48 GMTFrom the Labjosh@joshbotz.com (Josh Botz)https://www.joshbotz.com/ai-lowered-the-barrier-not-the-bar/https://www.joshbotz.com/ai-lowered-the-barrier-not-the-bar/AI lowered the barrier to building, not the bar a thing has to clear before real people and real data depend on it. Here's the gap, and what I'm doing about it.Fri, 12 Jun 2026 18:28:40 GMTFrameworks & Governance Translatedjosh@joshbotz.com (Josh Botz)