Skip to content
AI Security Playbook

Reference

Changelog - what's new

This is a living document, revised as the field moves. The freshest changes are at the top.

July 2026 - MCP 2026-07-28, and six chapters that were stubs

  • The MCP specification moved, and this book was wrong about it. 2026-07-28 shipped as a stable release on 28 July; IV.2 · Model Context Protocol (MCP) called it a draft. Corrected, with the wrinkle recorded rather than tidied away: the versioning page still named 2025-11-25 as the current protocol version the following day, so the two primary sources disagree during the transition and the book now says so.
  • Six chapters that were placeholders are now written. III.1 · Anatomy of an agent, III.5 · Consent & containment, IV.5 · Hardening MCP, I.6 · Protecting weights in use, VII.4 · Finding the AI you do not know about and VII.5 · Retirement & decommissioning. IV.5 is built on the new spec’s security best-practices page, which is now the most quotable document in MCP security.
  • Four new incident-board rows, all opened at the record. CVE-2026-52869 (the MCP Python SDK routed sessions by id without checking which principal created them, fixed 1.27.2), CVE-2026-16584 (the AWS API MCP Server skipped its policy check for the whole process lifetime when policy data failed to load, fixed 1.3.47), CVE-2026-54316 (huggingface.co pre-approved as a bare hostname in Claude Code’s WebFetch, making an allowlisted domain a covert channel, fixed 2.1.163), and the spec release itself. All three CVEs predate the last board update, so they are new to this book rather than new to the world.
  • Corrections. Fixed versions added for the two MCP SDK rebinding CVEs, which sit on different version lines (TypeScript 1.24.0, Python 1.23.0). The GhostApproval row now says what its CVE actually covers: CVE-2026-50549 is Cursor’s path-canonicalization fallback (CWE-59), not the misleading dialog the row described, and it is the same defect Cato published as DuneSlide. The MITRE ATLAS citation in VI.3 · Threat modeling for AI systems is now precise about releases: “Publish Poisoned AI Agent Tool” and “Escape to Host” landed in v5.4.0 (6 Feb 2026), and v2026.06 added three web-surface techniques.
  • Held back, deliberately. A proposed EU AI Act amendment number is not in this update: EUR-Lex returns nothing to automated retrieval, and a regulation number is not something to publish on secondary sourcing. The ATLAS technique count is still unresolved because the live matrix will not load. Several npm package names, a “first on CISA KEV” claim and a financial-loss attribution were all researched, failed verification, and were dropped rather than softened.

July 2026 - incident update

  • The incident board is current to late July 2026. Ten new entries, led by the Hugging Face production breach - the first publicly documented case of frontier models autonomously chaining novel attack paths into a third party’s production systems, with no human operator directing the intrusion. Hugging Face disclosed it on 16 July; five days later OpenAI attributed the agents to its own evaluation run, escaped from a sandbox whose “only network path” turned out to have an unfiltered route out. Also added: the first LLM-driven ransomware campaign (JADEPUFFER), a self-propagating npm worm whose stolen OIDC tokens made provenance attestation confirm the malicious artifacts, and the coding-agent findings that retire two controls readers are commonly sold - regex command guards (GuardFall) and the approval dialog as an authorization control (GhostApproval).
  • New sections where those incidents changed the guidance. I.7 · Frontier capability & the if-then frameworks now treats the evaluation harness as production attack surface; III.2 · Coding agents & Codex security carries what broke in 2026 and what it retires; IV.2 · Model Context Protocol (MCP) documents the STDIO family, where configuration is execution.
  • Readability and mobile. Wide tables now wrap with a sticky first column instead of scrolling seventeen screen-widths, long code lines wrap, the diagram lightbox is readable in light mode, and Part II is no longer collapsed out of the sidebar.

July 2026 - architecture & lifecycle

  • New: the Architecture of AI Security. Two stage-by-stage build lifecycles now sit alongside the existing maps - the secure AI SDLC (anchored in NIST SSDF SP 800-218A and IBM’s framework) and the Agent Development Lifecycle (the IBM/Anthropic ADLC) - each stage broken into what to look for, how to do it, what to implement, and the threats it answers. Both pages carry an interactive stage explorer you can click through.
  • Readable illustrations, mobile-first. Every wide left-to-right diagram was redesigned top-to-bottom so it stays legible on a phone, with a consistent figure treatment and tap-to-zoom throughout.
  • New coverage. Fine-tuning that strips an aligned model’s safety (the downstream-user attack); the reasoning-model / chain-of-thought-hijacking jailbreak family (JB-14); and confidential computing / TEEs for protecting weights and inference in use.
  • New governance deep-dives. Full working maps of Google SAIF (the controls layer - components, the fifteen risks, the six control categories, the Risk Map, SAIF 2.0 for agents, and CoSAI) and NIST AI RMF (the risk process - the four functions with their complete subcategory structure, the seven trustworthiness characteristics, and the Generative AI Profile). The frameworks page now shows how SAIF, NIST, ISO 42001/23894, and the EU AI Act stack rather than compete, with a one-finding-many-frameworks crosswalk; ISO/IEC 42001 & 23894 get a dedicated deep section, and the EU AI Act’s structure (provider/deployer roles, the high-risk test, prohibited practices, GPAI tiers) is laid out in Singapore & EU.
  • Stronger foundations. Part I now teaches the book’s organizing model directly - the five security boundaries (inputs → model → memory → tools → identities), what an agent actually is (the tool-use loop and its memory), how machine identity works, and how to characterize an adversary - so everything after it reads as elaboration, not novelty.
  • Deeper red-team methodology. The red-team playbook gained a full methodology chapter - the six-phase engagement spine, OWASP’s four focus areas, the finding ontology, and the attack-success-rate (ASR) statistical mindset with the numbers behind it - plus attack-planning and a scenario matrix. Jailbreaks are now organized by why they work (the two failure modes of safety training).
  • Broader technical coverage. New ground across the offensive and defensive parts: audio and video multimodal injection; real 2026 computer-use agents (Operator, Anthropic Computer Use, Project Mariner, Comet) and their defenses; Kubernetes / GCP / Azure cloud parity; the concrete non-human-identity mechanisms (DPoP, mTLS-bound tokens, token exchange, SPIFFE/SPIRE); and behavioral / memory-poisoning detection.
  • Sharper examples, cleaner navigation. Illustrative snippets became concrete, ready-to-adapt commands - real tools (garak, PyRIT, promptfoo, IBM ART, modelscan/fickling, Prowler/CloudFox, Project Moonshot) with real flags and the actual cloud-metadata SSRF flows - and each concept now has a single canonical home, so the offensive playbook threads the deep per-surface chapters instead of repeating them.
  • Everything re-verified. A line-by-line pass validated the load-bearing facts - versions, dates, CVEs, standards, statistics - against primary sources, and every diagram was reviewed for accuracy. Content is current to 15 July 2026: MITRE ATLAS at 16 tactics (v2026.06, June 2026); OWASP Agentic Top 10 (2026) and AISVS 1.0 / AIVSS; the EU AI Act’s 29 June 2026 Digital Omnibus adoption; the current frontier models (Claude Opus 4.8, GPT-5.6, Gemini 3.1 Pro, open-weight DeepSeek V4); and new 2025-2026 CVEs and incidents (EchoLeak, the nginx-ui MCP “MCPwn” RCE, the Keras model-load RCE, and more).

June 2026

  • Public launch. Site-wide readability pass: every page now opens with a one-line “what this is and why it matters,” long pages gained key-takeaways boxes, and dense catalogs (the MCP threats, the OWASP MCP Top 10) became scannable tables.
  • Added a one-page cheat sheet, persona on-ramps on the home page (“start here for…”), and social-share cards.
  • The 2026 incident board is a rolling snapshot - new incidents land there as they’re reported.

Following along? The author posts updates and breakdowns on LinkedIn.