https://dcicyber.com/blog/ Technical writing on application security, product security and AI security from Digital Consulting, Inc. en-us Fri, 05 Jun 2026 18:02:28 +0000 https://dcicyber.com/blog/ai-generated-code-security-risks/ https://dcicyber.com/blog/?p=591 Fri, 05 Jun 2026 18:02:28 +0000 Secure by Design Over six weeks I rebuilt a 30-year-old poetry site with an AI coding partner and logged every security issue it produced: 59 of them, from a one-line config change that took the whole site down to a 90-minute triple credential leak. Two became actual incidents; a control caught all 59. Here is the pattern behind them, Self-Attested Safety, and the controls that caught every one. https://dcicyber.com/blog/render-blind-safety-evaluation-trust-boundary/ https://dcicyber.com/blog/?p=580 Thu, 19 Mar 2026 17:53:10 +0000 LLM Security Every major AI assistant endorsed a webpage as safe while it displayed a reverse shell command to the human reader. No bug. No jailbreak. A custom font and standard CSS were enough. The flaw is an architectural blind spot -- a rendering-layer trust boundary no AI safety framework has ever specified -- and it changes the threat model for every product team building AI-assisted content evaluation. https://dcicyber.com/blog/cve-2026-20127-management-plane-trust/ https://dcicyber.com/blog/?p=568 Fri, 06 Mar 2026 23:10:35 +0000 Secure by Design Cisco's SD-WAN peering authentication existed in the architecture, appeared in threat models, and passed functional tests -- for three years. It never enforced. CVE-2026-20127 reveals a design failure recurring across vendors: authentication gates running after request classification, creating request classes that bypass identity verification. Does any request path reach your processing logic before authentication runs? https://dcicyber.com/blog/api-enablement-privilege-escalation/ https://dcicyber.com/blog/?p=507 Tue, 03 Mar 2026 06:47:06 +0000 Secure by Design For over a decade, Google classified API keys as public billing identifiers -- safe for client-side code. When the Gemini API joined the platform, those same keys silently gained access to uploaded files, cached AI context, and billable inference. The architectural pattern behind this silent privilege escalation is not unique to Google, and the assumption it breaks is likely in your threat model too. https://dcicyber.com/blog/ai-agents-cognitive-blind-spots/ https://dcicyber.com/blog/?p=257 Wed, 25 Feb 2026 14:07:42 +0000 LLM Security AI agents don't invent new ways to fail -- they inherit ours. Peer-reviewed research confirms they amplify human cognitive biases and create feedback loops with no natural circuit breaker. This analysis maps ten catastrophic human failures to the biases that caused them, then projects how an AI agent would have made each one worse. https://dcicyber.com/blog/framework-eval-surfaces-ai-agent-memory/ https://dcicyber.com/blog/?p=165 Sat, 21 Feb 2026 02:18:13 +0000 AI Agent Security Three major AI agent frameworks shipped the same architectural flaw in fourteen months: a filter API that resolves caller-supplied strings through the host language's runtime. If your team treats vector store query interfaces as infrastructure rather than injection surfaces, this design pattern analysis explains what your threat model is missing. https://dcicyber.com/blog/compile-time-enforcement-at-a-runtime-boundary-why-n8ns-sandbox-kept-failing/ https://dcicyber.com/blog/?p=146 Tue, 17 Feb 2026 22:05:56 +0000 Secure by Design n8n's five critical CVEs in 90 days share a single architectural flaw: TypeScript type annotations used as runtime security enforcement -- but TypeScript annotations don't exist at JavaScript runtime. The patch for the first CVE was bypassed by the same mechanism two months later. If you build AI agent pipelines or any sandbox with compile-time security constraints, this CVE chain names the failure directly. https://dcicyber.com/blog/what-grp-obliteration-tells-you-about-your-ai-systems-threat-model/ https://dcicyber.com/blog/?p=119 Mon, 16 Feb 2026 07:47:44 +0000 ProductSecurity Microsoft researchers reversed LLM safety alignment across 15 models using a single adversarial training prompt. The attack exploits a fundamental design flaw: safety implemented as learned behavior can be inverted through training-based attacks. For product security teams deploying AI systems, the lesson is architectural - security properties must be enforced through system design, not statistical tendencies. https://dcicyber.com/blog/why-privileged-access-management-tools-must-be-designed-to-a-higher-security-standard-than-the-systems-they-protect/ https://dcicyber.com/blog/?p=112 Fri, 13 Feb 2026 20:56:20 +0000 AppSec When a Privileged Access Management platform is the target, the blast radius is everything behind it. CVE-2026-1731, a CVSS 9.9 pre-authentication OS command injection in BeyondTrust Remote Support, went from public PoC to confirmed in-the-wild exploitation in under 24 hours -- exposing 8,500+ unpatched on-premises instances. This article dissects the PAM Platform Paradox and what it demands from product security architecture. https://dcicyber.com/blog/six-zero-days-in-one-month-microsoft-february-2026-patch-tuesday-and-the-systemic-failure-of-security-feature-bypass-defenses/ https://dcicyber.com/blog/?p=108 Thu, 12 Feb 2026 22:12:44 +0000 Secure by Design Microsoft February 2026 Patch Tuesday: six actively exploited zero-days, most bypassing SmartScreen and Mark of the Web. Systemic bypass analysis.