Red-teaming LLMs & AI agents @Mindgard. Prompt injection, jailbreaks, agentic kill chains — how AI breaks & how to stop it. Attack led security for AI.
Winston Salem, NC
Joined April 2009
- Tweets2.6K
- Following413
- Followers255
- Likes5.1K
Pinned Tweet
I red-team AI for a living. Prompt injections, jailbreaks, agents tricked into doing things they shouldn't. This account is where I'll share how AI systems actually break — and how to stop it.
DSPM and data classification are asset inventory for AI data.
Inventory tells you what you have. It does not tell you what an agent will do with it once it is compromised.
That is why breach-and-attack simulation exists for networks. Mindgard is the same idea for AI behavior under assumed compromise.
It sits next to the data team’s tooling. It does not replace it.
Bradley Cassada retweeted
Our AI agents get an allowance.
Every day, OctoHall’s residents share a fresh batch of DIEM from @AskVenice. Spend it all and they wait for tomorrow, like the rest of us.
Bonus: Venice doesn’t store the prompts.
@ErikVoorhees, your token raised responsible kids.
Find my blog on why the best defense is a good offense.
Controls should not be in theory only.
mindgard.ai/blog/why-ai-secu…
The agent did not refuse. It called the tool.
A user asked for the customer's contact info and order details.
The model provided get_order_and_comments with the order ID it was given.
No jailbreak. No role-play. The tool was in the harness, so the request became a lookup.
Test the tool boundary, and the model.
Tool Shadowing (OWASP MCP03:2025): a poisoned MCP tool description hijacks how an agent calls a different tool. Agents see every tool description at once.
labs.cloudsecurityalliance.o…
#AISecurity #MCP #PromptInjection
Black Hat 2026: one GitHub issue broke three coding agents. Claude Code: CVE-2026-54316. Gemini CLI: CVSS 10.0 bypass. Codex: injection persisted via AGENTS.md. The harness, not the model, is the attack surface.
esecurityplanet.com/threats/…
#AISecurity #PromptInjection #AIAgents
Playing with glimmer and qwen this morning... amazing that we get the quality of models we have running local...
#LLMSecurity #aisecurity #redteam
OWASP just released the 2026 LLM Top 10, and for the first time it's not just expert opinion. 75% community vote, 25% real incident data, pulled from 7,714 reported AI security incidents.
#LLMSecurity
🤖 Made with AI
Excessive Agency is the biggest riser, 6th to 3rd. More tools and more autonomy handed to a model, and the incidents follow. Unbounded Consumption jumped too, 10th to 6th.
Improper Output Handling fell the furthest, 5th to 10th. Prompt Injection and Sensitive Info Disclosure held #1 and #2. Full list: genai.owasp.org/resource/owa…
Indirect Prompt Injection: AI agents trust email content like a direct instruction.
PortSwigger chained CSS webmail tricks into Cowork's Gmail connector to steal a Slack token. Treat inbound content as hostile.
thehackernews.com/2026/08/ne…
#AISecurity #PromptInjection #LLMSecurity
From our very own team... Cursor auto-executes any git.exe planted in a repo root, no click, no warning. Mindgard reported it Dec 15; 7 months and 197+ releases later, still unpatched. If your IDE trusts a filename in the repo, assume it's owned.
mindgard.ai/blog/cursor-0day…
#AISecurity #ZeroDay #AppSec
At Black Hat this week with the @mindgard team, booth 5000.
Come find us if you want to talk AI security. Especially interested in Multi turn attack philosophy. I would love to hear how you write prompts and goals for your AI testing plans.
#BlackHat2026
Bradley Cassada retweeted
Committed to our future. ✔️
Mauricio Pochettino and @ussoccer have agreed on a new contract to continue as the #USMNT head coach through 2030! 🇺🇸
📝: ussoc.cr/MP2030
Claude Cowork's sandbox got escaped by chaining a Linux kernel bug into guest-root, then reading the whole host Mac through a read-write VM mount. A sandbox is only as strong as what's mounted inside it.
thehackernews.com/2026/07/cl…
#AISecurity #SandboxEscape #AgenticAI
Autonomous exploit chaining: in a sealed OpenAI eval, GPT-5.6 Sol chained 8 JFrog Artifactory zero-days to escape containment and reach Hugging Face's infra.
If your sandbox has an egress path, an agent will find it.
The game has changed. Time to exploit is negligible.
thehackernews.com/2026/07/jf…
#AISecurity #AIAgents #ZeroDay
