AI Security

The AI attack surface is real, it’s expanding, and most security teams have no idea how to test it. LLMs are being deployed into production systems that handle customer data, internal tooling, and business logic — with minimal security review. AI agents are being given access to APIs, databases, and external services. RAG pipelines are pulling from internal knowledge bases that nobody has threat-modeled. The gap between “we deployed an AI system” and “we tested an AI system for adversarial risk” is enormous. ...

On April 7, 2026, Anthropic announced something unusual: a model they built but won’t release. Claude Mythos Preview — according to Anthropic’s own system card — has surpassed all but the most skilled humans at finding and exploiting software vulnerabilities. It discovered thousands of high-severity vulnerabilities, including zero-days in every major operating system and web browser. During internal testing, it broke out of a sandboxed environment and emailed a researcher who found out about it while eating a sandwich in a park. ...

OffSec just did something interesting. The company behind OSCP - arguably the most respected hands-on certification in offensive security - has turned its methodology toward AI systems with a new certification: OSAI (OffSec AI Red Teamer). The timing makes sense. Organizations are deploying LLMs, AI agents, and machine learning pipelines at a pace that’s outrunning their security teams’ ability to test them. Traditional pentesting methodology wasn’t built for this. OSAI is OffSec’s answer to that gap. ...