Wiki / Blog
/ Attacks and defence
Attacks and defence
9 articles on attacks and defence from the Penaxtra engineering, security research, and compliance teams.
9 articles, newest first. Click a category in the left sidebar to narrow the list; the column headers below are static labels.
| Article | Category | Read | Published |
|---|---|---|---|
| The Q1 2026 GenAI Exploit Round-up: Eight Incidents, One CVE A read-through of the quarter's eight notable GenAI security incidents, why only one of them carried a CVE, and what that gap means for how you track AI risk. | Attacks and defence | 8 min | |
| The First Autonomous AI-Agent Intrusion: What It Means for Defenders An LLM agent reportedly ran a full intrusion, from RCE to database exfiltration, in under an hour with no operator. What changed, and where you catch it. | Attacks and defence | 7 min | |
| The Self-Propagating AI Worm: Separating the Signal From the Panic Researchers demonstrated an open-weight LLM driving a self-propagating worm across a simulated network. Here is what actually changed for defenders, and what did not. | Attacks and defence | 7 min | |
| AI Security in the First Half of 2026: The Breaches That Ended the Debate H1 2026 AI security review: the breaches that turned theory into incident queues, why posture management is now essential, and the H2 outlook. | Attacks and defence | 11 min | |
| Frontier Agents Cut Both Ways - Opus 4.8, Dynamic Workflows, and the First In-the-Wild LLM-Agent Intrusion The week frontier models learned to run a thousand parallel subagents is the same week someone pointed one at a network and dumped a database in under an hour. Notes for anyone shipping agents to production. | Attacks and defence | 10 min | |
| MCP Tool Poisoning - How the Attack Works and How to Stop It MCP tool poisoning explained: line jumping, rug pulls, and the malicious tool descriptions that hijack AI agents, with byte-level payloads and the seven runtime controls that actually held. | Attacks and defence | 13 min | |
| MCP Security Checklist - Securing Model Context Protocol Servers in Enterprise AI Systems Practical checklist for security teams reviewing MCP server deployments. Covers tool surface, permission scoping, indirect injection, confused deputy, and runtime enforcement. | Attacks and defence | 6 min | |
| Prompt Injection Testing for Enterprise LLM Apps How to test enterprise LLM applications against prompt injection in a way that produces auditor-acceptable evidence. Covers direct injection, indirect injection via RAG, tool-output injection, and judge bias. | Attacks and defence | 7 min | |
| OWASP Agentic Top 10 Walkthrough - What Actually Matters in Production A practitioner's reading of the OWASP Agentic Top 10 T1-T15 list. Which entries we see exploited in the wild, which are still mostly theoretical, and the controls that work. | Attacks and defence | 6 min |