Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied Research Center. Our SARC focuses on evaluating systems
Tool calling gives injection attacks a path to backend/agentic actions. If a model can call functions, browse, read files, hit APIs, or drive a desktop, then untrusted input may be able to steer those actions. We have already looked at two pieces of this problem from the Sentry side.
Large Language Models introduce security issues reminiscent of early-2000s software bugs. Special Token Injection (STI) exploits how LLMs parse structured prompts. This post breaks down what STI is, how it works, where it appears, and why it matters—through a pentester’s lens.
Drinor was awarded $150,000 for CVE-2026-20685 targeting Apple's Private Cloud Compute, the inference backbone of Apple Intelligence capabilities. This work is my contribution to Sentry's AI Security research initiative, run through SARC, the Sentry Applied Research Center. Our SARC focuses on evaluating systems
Deep link hijacking occurs when a mobile app trusts a link route that lacks a platform verification mechanism binding it to a single legitimate application. On Android, a custom URI scheme such as exampleapp:// can be registered by any installed application. When a magic-link login flow places an authentication
If you are building or improving a SIEM, start with the logs before you start with the rules. A detection rule is a query over stored events. It works only when the SIEM receives the events the rule expects, parses the fields analysts need, and keeps the data long enough
Tool calling gives injection attacks a path to backend/agentic actions. If a model can call functions, browse, read files, hit APIs, or drive a desktop, then untrusted input may be able to steer those actions. We have already looked at two pieces of this problem from the Sentry side.
Prompt injection is OWASP's #1 ranked vulnerability for LLM applications, but the term covers two fundamentally different attack classes. Semantic prompt injections manipulate meaning. They use natural language to trick the model into interpreting a malicious instruction as legitimate. Token-based injections exploit the tokenization layer itself: techniques
If you work in cybersecurity, you already know the feeling of having more to investigate than hours in the day. The security research backlog grows while you sleep. Threat feeds update faster than you can read them. Incident reports pile up. So when AI tools showed up offering to help
Side-channel attacks are a method of extracting information from systems by observing their physical implementation rather than attacking the theoretical weaknesses in algorithms. These attacks focus on the unintended information leakage that occurs during a system's operation. This guide covers web side-channel attacks—timing signals, response-
Over the last few years, I’ve found myself coming back to the same question when thinking about AI systems: what actually makes them dangerous in practice? I was specifically interested in environments with real infrastructure, real incentives, and real failure modes as it pertains to practical AI security leaders
What are LLM API Misconfigurations and why do they happen? Large Language Model (LLM) APIs like Responses, Completions, Messages provide flexible interfaces for building multi-turn conversations, tool integrations, and agent pipelines. These APIs accept structured input such as messages[], roles, function calls, and other model-relevant parameters, and return
Large Language Models introduce security issues reminiscent of early-2000s software bugs. Special Token Injection (STI) exploits how LLMs parse structured prompts. This post breaks down what STI is, how it works, where it appears, and why it matters—through a pentester’s lens.
OAuth 2.0 has become the cornerstone of modern authorization, powering secure API access for countless applications. Yet not every OAuth flow fits every scenario. While some flows are designed for backend, server-to-server communications, others are intended for public clients. In this piece, we explore why using the
This blog details how attackers exploit Unconstrained Delegation in Active Directory to achieve domain takeover. You'll see a step-by-step breakdown of capturing a Domain Controller's TGT, why it's critical, and, of course, learn actionable steps to prevent this threat. Unconstrained delegation is