Security

26 posts in Security

What Mini Shai-Hulud Teaches Us About AI Supply Chain Security

The Mini Shai-Hulud worm pushed malicious npm packages with valid SLSA Level 3 attestations. Here’s why signing isn’t enough — and what defense actually requires.

ai - 7 min read

Signing Is Not Enough: Why AI Artifact Provenance Needs to Be a Graph

Signing your AI models isn’t enough. Learn why fine-tuned model provenance requires graph traversal, not just attestations, to close the supply chain gap.

ai - 13 min read

Claude Managed Agents: What It Solves and What Enterprises Still Need

KitOps - 16 min read

Automated AI Compliance Gates: From Training Data to Production with Cryptographic Proof

Learn how to build automated compliance gates for AI deployments using KitOps, Jozu Hub, and OPA. This tutorial walks through packaging, scanning, policy enforcement, and cryptographic attestation so every model in production can prove it belongs there.

KitOps - 12 min read

Audit Logging for ML Workflows with KitOps and MLflow

Learn how to build an end-to-end ML audit trail using MLflow for experiment tracking, KitOps for model packaging, and Jozu for centralized governance and visibility.

ai - 1 min read

Hackread–Amazon Q AI Assistant Compromised by Hacker Injecting Data-Wiping Commands

Hacker injects malicious data-wiping commands into Amazon’s Q AI coding assistant through GitHub pull request. Jozu releases PromptKit to prevent AI security vulnerabilities with auditable prompt management.