What is actually breaking in production AI
Anonymised patterns from the engagements we ran this quarter. Which failures recurred across unrelated systems, which controls actually held under attack, and how long each one took to bypass.
No vendor pitch, no gated demo call, no sales sequence attached. It is the document we would want to read if we ran security somewhere else.
What is in it
- The failure classes that recurred across more than one client, which is the useful signal
- Median time to first bypass per class, so you can judge exposure rather than just severity
- Which controls held. Guardrails and compliance tooling do stop things, and it is worth knowing what
- What automation caught versus what needed a human, stated plainly
- Redacted excerpts from real findings, published with client permission
Every number in it comes from work we did. If a pattern only showed up once, it is labelled as one engagement rather than dressed up as a trend.
Get the current edition
Work email, and it arrives in your inbox. One document, and the next edition each quarter unless you tell us to stop.
The shape of an entry
So you know what you are giving an email address for. This entry draws on the engagement published in full at the sales platform case study.
Authorisation described to a model, not imposed on it
The most consequential class this quarter was not a model weakness and not a prompt injection. It was an ownership check that did not exist, on an endpoint reached through entirely ordinary traffic.
Observed. An enterprise AI platform with an active GRC motion and third-party compliance tooling in use. A free-trial account retrieved 95 other customers' AI-generated research reports, 3.49 MB of cross-tenant intelligence, by iterating a sequential integer against a report download endpoint. 201 accounts probed in a single session. Download URLs embedded storage credentials with a seven-day expiry, so each exposure carried a week-long tail.
Why scanners do not reach it. There is no malformed request to detect. A valid session token and an integer. The signature that would catch this does not exist, because the traffic is indistinguishable from legitimate use.
Severity CRITICAL / confirmed exploited / 8 critical or high in the same engagement across 17 vulnerability classes
Real entries are anonymised further than this. This one is quotable because the client agreed to publish it in full.
Or skip the reading
If you would rather find out what is reachable in your own system than read about someone else's, that is the better use of your time.