https://hedgerow.dev/blog Security research on AI software: model files, agents, LLM serving and scanners, from Hedgerow. en Fri, 06 Nov 2026 07:29:02 +0100 https://hedgerow.dev/blog/clean-or-just-not-alarmed https://hedgerow.dev/blog/clean-or-just-not-alarmed Fri, 06 Nov 2026 07:29:02 +0100 Five model-file scanners on 222 benign files. Counting warnings changes the false-positive picture, verdict coverage changes it again, and default gates trade benign blocks against missed attacks. Including our own. https://hedgerow.dev/blog/the-agent-said-nothing https://hedgerow.dev/blog/the-agent-said-nothing Fri, 30 Oct 2026 20:30:49 +0100 An AI agent sent our sales totals to a server it had never heard of, then answered with an empty message. What models actually do with a poisoned CSV, what a detector missed, and what stopped the code. https://hedgerow.dev/blog/hayward-1-4-rowan-0-4 https://hedgerow.dev/blog/hayward-1-4-rowan-0-4 Fri, 23 Oct 2026 08:36:02 +0200 Hayward 1.4 checks a model file at the one point every payload must pass, while it loads. Rowan 0.4 is the MCP release: it finds agent tools however they are registered, and reports fewer things that are not bugs. https://hedgerow.dev/blog/ai-gateways-strong-locks-open-toolboxes https://hedgerow.dev/blog/ai-gateways-strong-locks-open-toolboxes Sun, 18 Oct 2026 10:55:35 +0200 We tested nine AI gateways and proxies. They enforced routes and keys well, but none had a configuration-only policy that refused a chat request for switching on a provider-hosted tool. https://hedgerow.dev/blog/your-bank-writes-like-an-attacker https://hedgerow.dev/blog/your-bank-writes-like-an-attacker Tue, 29 Sep 2026 10:02:41 +0200 We tested 12 open prompt-injection detectors on email. One widely downloaded model flags the language of customer notices, thresholds tuned on synthetic mail fail on transactional mail, and polite rewrites cut detection for 11 of 12. Probes, scores and paper are public. https://hedgerow.dev/blog/langchain-threat-model https://hedgerow.dev/blog/langchain-threat-model Fri, 21 Aug 2026 21:24:10 +0200 The parts of a LangChain app that make it capable, its loaders, tools, stores, checkpoints, and caches, are the parts that decide what a steered model can reach. A component-level model mapped to the published CVE record, with the configuration discipline that a hardened deployment is assembled from. https://hedgerow.dev/blog/inference-threat-model https://hedgerow.dev/blog/inference-threat-model Mon, 17 Aug 2026 20:31:07 +0200 The parts of an inference stack built to make it fast are the parts that decide who can read whose data. Eleven ways that breaks, each with one check you can run against your own deployment, plus the full threat model with evidence classes and citations. https://hedgerow.dev/blog/langfail https://hedgerow.dev/blog/langfail Fri, 31 Jul 2026 08:16:31 +0200 We built a working MLOps platform, planted 82 vulnerabilities and 50 decoys inside it, and scored eight reproducible runs against the same answer key. The best found 91%. Four bugs were missed by every run, and none of them contains a dangerous line of code. https://hedgerow.dev/blog/the-taint-microkernel https://hedgerow.dev/blog/the-taint-microkernel Sat, 27 Jun 2026 07:46:25 +0200 If frontier models are this good, why build a taint engine at all? Because a model can describe a vulnerability beautifully but can’t hand you a reproducible, auditable proof. Put the deterministic engine at the center as the kernel and let the model ride shotgun as the coprocessor. https://hedgerow.dev/blog/closing-the-seam https://hedgerow.dev/blog/closing-the-seam Sat, 27 Jun 2026 07:46:25 +0200 How we layered repository-wide, cross-file taint analysis on top of OpenGrep’s intra-file engine, so the bug that lives between two files stops being invisible. SCC-converged propagation, parameter-indexed summaries, an incremental cache, and the day the benchmark caught a zero that was impossible. https://hedgerow.dev/blog/wrong-report https://hedgerow.dev/blog/wrong-report Fri, 05 Jun 2026 14:08:30 +0200 When your scanner is faster than your threat model. A post-mortem on submitting a high-severity RCE report, getting it closed as expected behavior, and what we actually missed in the process.