The OWASP LLM Top 10: A Practitioner's Field Guide

I’ve spent the last couple of years watching teams bolt an LLM onto a product and then look genuinely surprised when it does something dumb, dangerous, or both. The pattern is always the same. Ship first, wonder about security later. So when OWASP put together a Top 10 specifically for LLM applications, I was relieved. Finally there’s a shared vocabulary I can point at during a review instead of explaining prompt injection from scratch for the hundredth time. ...

July 5, 2026 · Carl Sampson

Book Review: The Developer's Playbook for Large Language Model Security: Building Secure AI Applications

I’ve been doing application security long enough to get twitchy whenever a book has “AI” on the cover. Most of what crosses my desk in that genre is hype wearing a lab coat. Lots of talk about the future, very little you can use on a Monday morning. So I cracked open Steve Wilson’s The Developer’s Playbook for Large Language Model Security: Building Secure AI Applications expecting the usual letdown. I was wrong, and I’m glad to say so. ...

June 22, 2026 · Carl Sampson

MCP Tool Poisoning: Hidden Attack Surface

I run about a dozen MCP servers in my daily workflow. Playwright for browser automation, Raindrop for bookmarks, Todoist for tasks, a couple of custom ones. Every time I start a Claude Code session, my agent loads all of their tool descriptions into context and uses them to decide what to call. Last month I started thinking about what would happen if one of those tool descriptions was lying to me. ...

April 3, 2026 · Carl Sampson

What is GitHub CoPilot?

GitHub Copilot is an AI-powered coding assistant developed by GitHub in collaboration with OpenAI. It uses large language models trained on public code repositories to suggest code completions, generate entire functions, and assist with a wide range of programming tasks directly in your editor. Quick Answer: What is GitHub Copilot? GitHub Copilot is an AI-powered coding assistant that: Suggests code completions and entire functions in real-time Uses OpenAI’s language models trained on billions of lines of public code Integrates directly into popular editors (VS Code, JetBrains, Neovim) Supports dozens of programming languages and frameworks Helps developers write code faster by understanding context and intent Works like “autocomplete for code” but with AI understanding of programming patterns How It Works Copilot is powered by OpenAI’s Codex and GPT-4-class models (the underlying models have evolved significantly since launch). It analyzes the context of your current file — comments, function signatures, variable names, surrounding code — and generates suggestions in real time. ...

May 2, 2023 · Carl Sampson