The Compliance Brief for AI-built apps
Every Tuesday, the AI and app security stories from the past week, and what they mean for an app built quickly with AI tools.
Apps built with AI tools fail in familiar ways: missing authorization, secrets in the client, and LLM features that trust whatever comes back. The Compliance Brief tracks the attacks that exploit exactly that, one email a week.
Below are the stories from recent issues that bear on AI and app security, each with the short version and a link to the full take.
Free weekly email
Get the next issue on Tuesday
Join the list and the next issue arrives Tuesday morning. Or read a few below first.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Latest on AI security, LLM attacks and app security flaws
- Your AI agents are logging in as humans and SOC 2 cannot tell
A vendor-authored piece argues that AI agents often operate through human credentials, so actions taken by an agent look identical to actions taken by the person whose credentials it borrowed. - A stolen OAuth token from a former employee's laptop
CrowdSec confirmed that attackers took the contents of 170 private repositories from its GitHub organisation. - A regulator has now logged an AI agent as the attacker
The Spanish data protection agency received a breach report describing an attack carried out by an AI agent running on a known large language model. - AI coding agents are pulling packages nobody registered
Researchers scanned 6,214 live domains belonging to defence contractors, Fortune 500 and large tech companies and found 8,265 llms.txt and llms-full.txt files. - Two arrests in the TeamPCP open-source supply chain spree
The Australian Federal Police arrested two men in Western Australia, aged 21 and 23, over alleged membership in TeamPCP. - The LiteLLM fallout is a CI credential problem, not an AI problem
A 153GB archive stolen in the LiteLLM supply chain attack has surfaced, containing 433,909 files. - Hidden prompt injection is showing up in "Ask AI" buttons on marketing pages
Researchers observed production websites embedding hidden prompt injection payloads inside pre-filled deep links behind "Ask AI" buttons, including on marketing and competitor comparison pages.
Every issue on VibeCoded
- Issue 8: Your AI agents are logging in as humans and SOC 2 cannot tell
- Issue 7: A regulator has now logged an AI agent as the attacker
- Issue 5: AI coding agents are pulling packages nobody registered
- Issue 4: Two arrests in the TeamPCP open-source supply chain spree
- Issue 2: The LiteLLM fallout is a CI credential problem, not an AI problem
- Issue 1: Hidden prompt injection is showing up in "Ask AI" buttons on marketing pages
Every issue in full, including the stories outside AI security, LLM attacks and app security flaws, is in the archive on traztech.ca. Issues with nothing on AI security, LLM attacks and app security flaws are listed there and not here.
Questions
How often does The Compliance Brief arrive?
Once a week, on Tuesday morning. Each issue covers the past week in five stories or so, with what happened and a short take on what it means for founders shipping AI-built and vibe coded apps.
What does it cost?
Nothing. It is written by Jacob Masse, Principal at TrazTech Inc., which operates VibeCoded. There is no paid tier.
Will signing up here send me anything else?
No. The form on this page adds you to The Compliance Brief and nothing else. Downloading a checklist elsewhere on the site is a separate signup, and it says what it sends before you give an address.
How do I stop it?
Every issue ends with a one-click unsubscribe link, and it is honoured immediately. Replying to any issue also reaches Jacob directly.
Free weekly email
Get it every Tuesday
One email a week on AI security, LLM attacks and app security flaws. Free, and one click to leave.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.