Generative AI

<body>Speed is the most common theme among developers and appsec teams working with LLMs and agents, from trying to keep up with patterns for deploying agents to dealing with more code faster to how the latest models impact code quality and security. The OWASP GenAI Project is helping organizations keep up with the speed of those changes and engaging the appsec community for sharing effective ways to keep systems secure. Scott Clinton shares the latest progress on the the project, its roadmap for the year, and how appsec practitioners can shape its future.</body>

<body>Speed is the most common theme among developers and appsec teams working with LLMs and agents, from trying to keep up with patterns for deploying agents to dealing with more code faster to how the latest models impact code quality and security. The OWASP GenAI Project is helping organizations keep up with the speed of those changes and engaging the appsec community for sharing effective ways to keep systems secure. Scott Clinton shares the latest progress on the the project, its roadmap for the year, and how appsec practitioners can shape its future.</body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://genai.owasp.org/2026/04/28/finbot-ctf-is-live-a-hands-on-companion-to-the-owasp-genai-security-project/">https://genai.owasp.org/2026/04/28/finbot-ctf-is-live-a-hands-on-companion-to-the-owasp-genai-security-project/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://genai.owasp.org/2025/01/22/announcing-the-owasp-gen-ai-red-teaming-guide/">https://genai.owasp.org/2025/01/22/announcing-the-owasp-gen-ai-red-teaming-guide/</a></li><li><a rel="noopener" target="_blank" href="https://www.scworld.com/podcast-episode/3695-inside-the-owasp-genai-security-project-steve-wilson-asw-352">https://www.scworld.com/podcast-episode/3695-inside-the-owasp-genai-security-project-steve-wilson-asw-352</a> </li></ul></body>

<body>This segment is sponsored by The OWASP GenAI Security Project. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/owasp">https://securityweekly.com/owasp</a> to learn more about them!</body>

<body>This segment is sponsored by The OWASP GenAI Security Project. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/owasp">https://securityweekly.com/owasp</a> to learn more about them!</body>

Featured image for {“vendor”:”ppworks”,”type”:”segment”,”id”:”14824″} podcast from PPWorks

Application security

AI/ML

Keeping Up With the OWASP GenAI Project – Scott Clinton – ASW #381

Unlocking Potential Exploring the Power of Large Language Models

DevSecOps

News

LiteLLM exploited within 36 hours of disclosure via SQL injection bug

IT and security-team staffers fight to control a dark shadow spreading through their network.

battling-network-shadows-socialsight

Governance, Risk and Compliance

Security Program Controls/Technologies

Resource

Microsoft

Handling shadow AI at the source: Why the browser is the new control layer

Identity

Privileged access management

Microsoft patches Entra ID bug that let AI agents escalate privileges

Robots And Humans as AI or Artificial Intelligence facing off as a symbol of future technology and employment or unemployment as automation in society changing the global economy.

Robots And Humans

Government security

OWASP

AI-driven attacks target governments, cloud agents, supply chains

Firefox web browser under magnifying glass. Firefox is a free and open-source web browser developed by the Mozilla Foundation.

Firefox web browser

Threat Management

Firefox report offers early insight into Claude Mythos AI model

Claude, an artificial intelligence chatbot developed by Anthropic, based on a large language model LLM. Icon and logo isolated on a dark surface, 3D rendering

Security Operations

AI benefits/risks

Leadership

CISOs: Revamp security programs in the wake of Claude Mythos

<body>It's one thing to write secure code, it's another to release it into the wild. That code needs to be designed, built, tested, released, and maintained. Farshad Abasi and Cameron Walters explain how the OWASP Secure Pipeline Verification Standard picks up from where ASVS left off, how it complements other supply chain security efforts like SLSA, and why they updated it with explicit coverage for AI.</body>

<body>It's one thing to write secure code, it's another to release it into the wild. That code needs to be designed, built, tested, released, and maintained. Farshad Abasi and Cameron Walters explain how the OWASP Secure Pipeline Verification Standard picks up from where ASVS left off, how it complements other supply chain security efforts like SLSA, and why they updated it with explicit coverage for AI.</body>

<body>They show what goes into making a project relevant and -- most importantly -- successful at defending how supply chains are attacked. They're also looking for more feedback and participation! If you build software packages, consume software packages, or have an interest in helping organizations stay secure, check it out!</body>

<body>They show what goes into making a project relevant and -- most importantly -- successful at defending how supply chains are attacked. They're also looking for more feedback and participation! If you build software packages, consume software packages, or have an interest in helping organizations stay secure, check it out!</body>

<body><ul><li><a rel="noreferrer noopener" target="_blank" href="https://owasp.org/www-project-spvs/">https://owasp.org/www-project-spvs/</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://github.com/OWASP/www-project-spvs/blob/main/1.5/Release_Notes_OWASP_SPVS_1.5-AI-Pipeline-Security.md">https://github.com/OWASP/www-project-spvs/blob/main/1.5/ReleaseNotesOWASPSPVS1.5-AI-Pipeline-Security.md</a></li><li><a rel="noreferrer noopener" target="_blank" href="https://youtu.be/-WoqGDdivGw?si=kK5-csbnTw8Y4g2J">https://youtu.be/-WoqGDdivGw?si=kK5-csbnTw8Y4g2J</a> -- The Story Behind OWASP SPVS</li><li><a rel="noreferrer noopener" target="_blank" href="https://slsa.dev">https://slsa.dev</a></li></ul></body>

<body>Zero Trust That Actually Ships: Moving From Strategy Decks to Real Security</body>

<body>Zero Trust That Actually Ships: Moving From Strategy Decks to Real Security</body>

<body>Most enterprise organizations have been working at Zero Trust for years and fail to deliver truly secure environments. Rohan Ravindranath shares insights that Zappsec has gained from guiding the global teams that are succeeding at protecting their orgs. Discover the common pitfalls so you can deploy a solution that works.</body>

<body>Most enterprise organizations have been working at Zero Trust for years and fail to deliver truly secure environments. Rohan Ravindranath shares insights that Zappsec has gained from guiding the global teams that are succeeding at protecting their orgs. Discover the common pitfalls so you can deploy a solution that works.</body>

<body>This segment is sponsored by Zappsec. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/zappsecrsac">https://securityweekly.com/zappsecrsac</a> to learn more about them!</body>

<body>This segment is sponsored by Zappsec. Visit <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/zappsecrsac">https://securityweekly.com/zappsecrsac</a> to learn more about them!</body>

<body>Cloning Attacker Tradecraft: Why AI Pentesting is Becoming Essential</body>

<body>Cloning Attacker Tradecraft: Why AI Pentesting is Becoming Essential</body>

<body>Enterprises ship code continuously, but most security validation still happens in snapshots. Novee CEO and co-founder Ido Geffen explains what “AI penetration testing” means, why it’s different from automated scanning, and why it’s becoming essential as attackers adopt AI to move faster. He breaks down what separates best-in-class AI pentesting: operator-like reasoning across real environments, validated exploitability, and the ability to uncover business logic flaws and multi-step attack chains. Ido covers the technology behind Novee’s AI penetration tester: a proprietary LLM model, built independently of “frontier” LLMs (like Claude, ChatGPT, Cursor, etc.), and consistently outperforming them at browser exploitation tests. Finally, he shares what buyers should demand in a live evaluation and how continuous retesting closes the loop after fixes ship.</body>

<body>Enterprises ship code continuously, but most security validation still happens in snapshots. Novee CEO and co-founder Ido Geffen explains what “AI penetration testing” means, why it’s different from automated scanning, and why it’s becoming essential as attackers adopt AI to move faster. He breaks down what separates best-in-class AI pentesting: operator-like reasoning across real environments, validated exploitability, and the ability to uncover business logic flaws and multi-step attack chains. Ido covers the technology behind Novee’s AI penetration tester: a proprietary LLM model, built independently of “frontier” LLMs (like Claude, ChatGPT, Cursor, etc.), and consistently outperforming them at browser exploitation tests. Finally, he shares what buyers should demand in a live evaluation and how continuous retesting closes the loop after fixes ship.</body>

<body>This segment is sponsored by Novee Security. See what your attackers already know at <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/noveersac">https://securityweekly.com/noveersac</a>.</body>

<body>This segment is sponsored by Novee Security. See what your attackers already know at <a rel="noreferrer noopener" target="_blank" href="https://securityweekly.com/noveersac">https://securityweekly.com/noveersac</a>.</body>

Generative AI

Keeping Up With the OWASP GenAI Project – Scott Clinton – ASW #381

LiteLLM exploited within 36 hours of disclosure via SQL injection bug

Handling shadow AI at the source: Why the browser is the new control layer

Microsoft patches Entra ID bug that let AI agents escalate privileges

AI-driven attacks target governments, cloud agents, supply chains

Firefox report offers early insight into Claude Mythos AI model

CISOs: Revamp security programs in the wake of Claude Mythos

Securing Software’s Journey with the OWASP SPVS – Cameron W., Farshad Abasi, Rohan Ravindranath, Ido Geffen – ASW #378

Fast Five

Selected by the SC Media Editorial team every Tuesday.