The thinking behind AI security review.
Threat models, governance evidence, and the decisions that hold up under scrutiny. Written for security architects and the committees they report to.
New posts in your inbox,
when they publish.
Threat modeling, governance evidence, and what AI Committees actually need — written for security architects and AI governance leads. No cadence promises.
Reviewing Windsurf (now Devin Desktop) — the CVE that bypassed its own deny-list
A critical path-traversal flaw worked even with auto-execution off and the vulnerable tool explicitly deny-listed. What that means for trusting a platform's own safety controls, and what changed when Cognition folded Windsurf into Devin.
Reviewing Claude Code and the Claude Agent SDK — permissions, sandboxing, and bypass mode
Distinct from a Claude procurement review: this is Claude Code as a coding agent, its layered permission model, six-plus disclosed CVEs, and the containment guidance Anthropic pairs with its own "YOLO mode" warning.
Reviewing Databricks Mosaic AI Agent Framework — the gap Databricks names in its own framework
No disclosed CVE here — the real finding is Databricks' own AI Security Framework v3.0 naming a confused-deputy problem: Unity Catalog governs data at rest, but an agent inherits whatever its tools can reach.
Vector and embedding weaknesses — OWASP LLM08:2025 explained
OWASP LLM08:2025 — embedding-space attacks that recover source text from vectors and poison the retrieval space itself.
Reviewing Google's Agent Development Kit — the CI workflow that trusted the wrong identity
A path-traversal CVE, a Black Hat-disclosed unauthenticated dev assistant, and a GitHub Action that let anyone with issue-comment access trigger privileged code execution. Three separate ADK findings, one shared root cause.
Reviewing Amazon Q Developer — the MCP auto-execution CVE
CVE-2026-12957 let a single file in a cloned repository run arbitrary MCP server code and steal AWS credentials, with no prompt and no consent. What a review has to check before enabling IDE-integrated agents.
Reviewing UiPath Agentic Automation — what the AI Trust Layer certifies, and what it doesn't
ISO 42001 and AIUC-1 certification, zero third-party data retention, and centralized real-time policy evaluation are real. What still depends on how an individual agent's access is actually configured.
Unbounded consumption in LLM applications — OWASP LLM Top 10 explained
OWASP reframed model-DoS as Unbounded Consumption, covering all uncontrolled resource drains. What reviews must now check.
Fyxer AI security review — full inbox access is the highest-risk AI category
Security review framework for Fyxer AI: OAuth scopes, email content exposure, unidentified LLM provider, and what procurement must verify.
Granola AI security review — meeting notes under the microscope
What a security team should assess before approving Granola: audio processing, sub-processor chain, PII exposure, and eight evidence gaps to close.
Claude AI security review — what a procurement team should assess
A security architect's framework for reviewing Claude before enterprise deployment: data handling, model governance, output safety, and evidence gaps.
Reviewing Microsoft Copilot Studio agents — three 2026 CVEs and the DLP gap they share
A patched prompt-injection vulnerability still exfiltrated data — because the exfiltration path ran through a legitimate, trusted action that DLP never questioned. What that teaches a review.
Free resources
Practical templates for every framework covered here.
AI Security Review Template
Full evidence pack with threat model, controls, and evidence grading.
OWASP Agentic Top 10 Controls
Each risk mapped to required controls and lifecycle gates.
Decision Memo
Clearance decision template with rationale and sign-off log.
AI Go-Live Security Checklist
Production gate checklist for security architects and CISOs.