Definitions, method and lessons from the public record on securing software against AI-enabled attackers and AI-written code.https://app.matt.security/enhttps://app.matt.security/blog/what-mythos-safe-means/https://app.matt.security/blog/what-mythos-safe-means/Mythos Safe is a testable state: every security assumption in a product written as a rule and re-tested on every release against what frontier models can do.Thu, 10 Sep 2026 00:00:00 GMTDefinitionMATT Researchhttps://app.matt.security/blog/hugging-face-breach-lessons-for-cxos/https://app.matt.security/blog/hugging-face-breach-lessons-for-cxos/OpenAI's models escaped a test sandbox and ran code on Hugging Face servers for four days with no human steering. Five lessons for leadership, from the record.Thu, 03 Sep 2026 00:00:00 GMTThe recordMATT Researchhttps://app.matt.security/blog/why-annual-pentests-fail-against-ai-attackers/https://app.matt.security/blog/why-annual-pentests-fail-against-ai-attackers/The annual pentest assumed a vulnerability took an expert weeks to find. In 2026 it takes a prompt. Where the model breaks and what replaces it.Thu, 27 Aug 2026 00:00:00 GMTMethodMATT Researchhttps://app.matt.security/blog/ai-written-code-the-checks-reviewers-skip/https://app.matt.security/blog/ai-written-code-the-checks-reviewers-skip/Generated code is syntactically clean, passes review and omits the ownership check the author assumed. The failure modes of AI-written code, with tests.Thu, 20 Aug 2026 00:00:00 GMTAI-written codeMATT Researchhttps://app.matt.security/blog/soc-2-in-the-age-of-agentic-attacks/https://app.matt.security/blog/soc-2-in-the-age-of-agentic-attacks/SOC 2 proves controls existed on audit day; agentic attackers test them every day. How to turn compliance evidence into live test results auditors accept.Thu, 13 Aug 2026 00:00:00 GMTComplianceMATT Research