Adversarial · Technique
Indirect prompt injection through retrieved documents — 78% of enterprise agents are susceptible.
A technical walkthrough of the attack class we see succeed most often, why standard guardrails fail against it, and three mitigation patterns that actually work in production.
A. Kulikov14 APR 2026
Regulatory · Analysis
EU AI Act Article 15 in practice — what "continuous monitoring" actually requires.
Reading Article 15 with a compliance lawyer and a model red-teamer in the room. What regulators will accept, what they will not, and how the August 2026 deadline changes procurement.
Certius Labs02 APR 2026
Incident · Analysis
Anatomy of a $441K agent transfer — the Lobstar Wilde failure, reconstructed.
We walked through the public postmortem and reproduced the failure in our lab. Four guardrails should have stopped it. Three were misconfigured. The fourth did not exist.
A. Kulikov22 MAR 2026
Market · Data
The AI insurance gap, quantified — 90% demand, 4% coverage.
Cross-referencing the Geneva Association survey, Deloitte forecasts, and our own customer interviews. Where the gap is widest, and which carriers are moving first.
Certius Labs11 MAR 2026
Adversarial · Technique
Shadow AI discovery — how we found 37 agents in a company that claimed to have 5.
A field report from a discovery engagement at a mid-market SaaS company. What we looked for, what we found, and how the security team responded to the gap.
A. Kulikov28 FEB 2026
Regulatory · Analysis
Colorado AI Act, section by section — what the 02 Feb 2026 effective date means for operators.
Impact assessments, disclosure requirements, algorithmic discrimination liability. How it diverges from the EU AI Act and why US-only operators still need to pay attention.
Legal Partner19 FEB 2026
Incident · Analysis
Alibaba ROME — anatomy of a rogue agent that mined crypto.
What happens when an agent with tool access and no spending cap gets jailbroken. A reconstruction from public reporting and vendor disclosures.
A. Kulikov05 FEB 2026
Adversarial · Technique
Why "prompt a prompt" jailbreaks still work — a 2026 update.
The jailbreak landscape after a year of frontier model patches. What stopped working. What started. What we suspect is coming.
A. Kulikov24 JAN 2026
Regulatory · Analysis
Singapore's agentic AI governance framework — the first of its kind, annotated.
Singapore moved first. The framework is short, specific, and likely to be copied. We annotated it and translated it into operator questions.
Certius Labs14 JAN 2026
Incident · Analysis
Air Canada v. Moffatt — the first chatbot liability precedent, three years later.
Revisiting the 2024 ruling with two years of downstream case law. How courts are extending the principle to agents that take actions, not just statements.
Legal Partner02 JAN 2026
Market · Data
Verisk's AI exclusions, line by line — what is and is not still covered.
A careful read of the exclusion language spreading through commercial general liability renewals. What it covers, what survives the carve-out, and what it means for enterprise AI programs.
Certius Labs18 DEC 2025
Regulatory · Analysis
ISO/IEC 42001 — how the audit market actually works.
What a 42001 audit looks like, how auditors are ramping up, and where the process is still maturing. Useful if you are sitting an audit in 2026.
Certius Labs05 DEC 2025