Topic
Threat modeling of retrieved content and model output as data crossing trust boundaries, referencing OWASP guidance for LLM applications.
DARPA selected Xint, one of three winners of its $29.5 million AIxCC contest, to research AI-driven security analysis of Department of War messaging apps. The work aims its automated find, triage and patch pipeline at messaging code and binaries the military actually runs.
Reality
The probes read Langflow's secret key file and grep the process environment for OpenAI and AWS credentials, which puts an AI orchestration tool on the same scanning clock as the Rails file-read bug of the same week.
Perspective Coverage
4 publishersReality
A dev.to write-up keeps access rights in Postgres and vectors in Qdrant, with a department_id stamped into every chunk payload so the filter runs before the model sees any text. The token supplies the identity, and the department comes from Postgres.
Reality
A vendor-authored count says a typical production AI app routes through 6 to 9 services, each adding a key, an egress path, an in-runtime SDK, a prompt log and a subprocessor. The count holds up.
Reality
An architecture decision record for a gaming moderation assistant puts a policy stage between retrieval and generation, and counts abstention with a reason code as a successful outcome.
Reality