# Enforster AI Insights > Practical research, engineering guidance, and perspectives on AI security, governance, and trust from Enforster AI. Enforster AI publishes practical guidance on AI security, AI governance, compliance, and privacy for engineers, security teams, and risk owners. Every article is available as clean Markdown at the links below. The full text of all articles is at https://blog.enforster.ai/llms-full.txt. ## Articles - [Storm-0940 and the ConnectWise compromise: auditing third-party app access in Microsoft 365](https://blog.enforster.ai/md/storm-0940-connectwise-third-party-app-access-microsoft-365.md): How Storm-0940 used stolen ConnectWise app credentials and the ARTEX AI framework against Microsoft 365 tenants, and how to audit and contain vendor app access. - [AI-BOMs in practice: documenting models and datasets with CycloneDX ML-BOM and SPDX 3.0](https://blog.enforster.ai/md/ai-bom-cyclonedx-ml-bom-spdx-ai-profile.md): What an AI bill of materials should record for models and datasets, how CycloneDX ML-BOM and SPDX 3.0 represent it, and how to verify it in CI. - [The 302.ai leak: what an AI aggregator stores about your prompts, and how to vet one](https://blog.enforster.ai/md/ai-aggregator-data-exposure-vetting-model-gateways.md): An AI aggregator left 17.6 million files of chats, uploads, and generated media in an open Azure bucket. What to ask before routing traffic through one. - [Agent memory poisoning: how to stop long-term memory from becoming an attacker's persistence channel](https://blog.enforster.ai/md/agent-memory-poisoning.md): How prompt injection turns agent memory into a persistent backdoor, and the write gate, provenance, expiry, and rollback controls that contain it. - [LiteLLM 1.107.0 was compromised: how to check exposure and respond](https://blog.enforster.ai/md/litellm-1-107-0-supply-chain-compromise.md): LiteLLM 1.107.0 wheels and Docker images shipped a credential stealer and a remote code loader. How to check your hosts, clean up, and rotate secrets. - [LLM output is untrusted input: preventing XSS, SQL injection, and code execution from model responses](https://blog.enforster.ai/md/llm-output-is-untrusted-input.md): Treat every model response like user input: encode it for its sink, never exec it, allowlist generated queries, and block Markdown image exfiltration. - [PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to patch and how to mitigate](https://blog.enforster.ai/md/php2shell-cve-2026-109618-cve-2026-109619.md): PHP2Shell is a pair of critical unauthenticated RCE flaws in the PHP engine. Fixed versions, interim mitigations from the advisories, and detection steps. - [System prompt leakage: what never belongs in a system prompt](https://blog.enforster.ai/md/system-prompt-leakage-what-never-belongs-in-a-system-prompt.md): Assume your system prompt will leak. Keep credentials, authorization rules, and internal limits out of it, and enforce them in code the model cannot reach. - [Denial of wallet: rate limits and cost controls for LLM applications](https://blog.enforster.ai/md/denial-of-wallet-cost-controls-for-llm-applications.md): How to stop abuse and runaway agents from burning your LLM budget: per-user token budgets, max_tokens caps, provider spend limits, and alerts. - [Permission-aware RAG: enforcing document access control in retrieval](https://blog.enforster.ai/md/permission-aware-rag-document-access-control.md): How to stop a RAG assistant from retrieving documents the user cannot open: filter by identity inside the vector query, sync ACLs, and test for leaks. - [Running AI coding agents in GitHub Actions without leaking secrets](https://blog.enforster.ai/md/ai-coding-agents-in-github-actions-without-leaking-secrets.md): Why AI agents in CI leak secrets through PR titles and issue comments, and the workflow design that contains it: triggers, token scopes, and split jobs. - [Slopsquatting: how to stop hallucinated packages in AI-generated code from reaching production](https://blog.enforster.ai/md/slopsquatting-hallucinated-packages-in-ai-generated-code.md): Code assistants invent package names, and attackers can register them. Practical controls to keep hallucinated dependencies out of your builds. - [Vetting third-party MCP servers: tool poisoning, rug pulls, and a review checklist](https://blog.enforster.ai/md/vetting-third-party-mcp-servers.md): How to review and run third-party MCP servers safely: the tool poisoning and rug pull threat model, pinning tool definitions, and least-privilege controls. - [Loading third-party model weights safely: pickle, weights_only, and safetensors](https://blog.enforster.ai/md/loading-third-party-model-weights-safely.md): Why loading a pickled model file can run attacker code, and the concrete controls that stop it: safetensors, weights_only, pinned revisions, and CI gates. - [Prompt injection is an access-control problem, not a prompt problem](https://blog.enforster.ai/md/prompt-injection-is-an-access-control-problem.md): Why better system prompts will not stop prompt injection, and how to contain it with authorization checks on every tool call an LLM agent makes. - [A practical AI model inventory: what to record for every system in production](https://blog.enforster.ai/md/ai-governance-model-inventory.md): A field-by-field guide to building an AI model inventory that supports risk reviews, incident response, and audits without becoming shelfware. - [Logging LLM applications without creating a privacy problem](https://blog.enforster.ai/md/logging-llm-applications-without-a-privacy-problem.md): How to log prompts, completions, and tool calls well enough for incident response, while keeping personal data and secrets out of long-lived storage. ## Topics - [AI Security](https://blog.enforster.ai/category/ai-security) - [AI Governance](https://blog.enforster.ai/category/ai-governance) - [Privacy](https://blog.enforster.ai/category/privacy) - [Security Operations](https://blog.enforster.ai/category/security-operations) ## Optional - [About Enforster AI Insights](https://blog.enforster.ai/about) - [RSS feed](https://blog.enforster.ai/rss.xml) - [Enforster AI product site](https://enforster.ai)