jain.com — data centers, connectivity and security, analyzed daily

Tag: prompt injection

  • NeuralTrust’s London Office and the AI Agent Security Gap

    NeuralTrust’s London Office and the AI Agent Security Gap

    TL;DR · 30-second read

    The Short Version

    Companies are starting to let artificial intelligence software act on its own — sending emails, moving money, pulling up customer records — without a person approving each step. If one of those systems is tricked or badly set up, it can leak data or take a wrong action in seconds.

    NeuralTrust, a Barcelona company that sells software to watch and restrain those systems, has opened an office in London to serve British banks, airlines and large firms. It says it raised twenty million dollars in June to expand.

    NeuralTrust, a Barcelona-headquartered platform for securing AI agents, announced on 7 September 2026 that it has opened a dedicated London office at 167 Great Portland Street. The company says the site will serve as its hub for UK customers, partners and hiring, supporting a client base spanning financial services, technology and other large enterprises, and that it plans to recruit across sales, customer success and engineering in the coming months.

    The expansion follows a $20 million seed round the company raised in June 2026, which it describes as the largest cybersecurity seed financing by an EU company to date. NeuralTrust now lists offices in Barcelona, London and New York, and says its customers include global banks, airlines, energy companies and government agencies.

    Executive Summary

    The announcement is, on its face, a routine go-to-market step: a well-funded European security startup putting staff on the ground in one of the world’s largest financial centres. What makes it worth reading closely is the problem it is chasing. Enterprises are moving from AI systems that answer questions to AI agents — software that takes actions on a company’s behalf, calling internal tools, querying databases and triggering transactions, often with no human approving each step.

    That shift breaks a core assumption behind most existing security controls. Traditional tooling is built to police users, devices and network traffic against rules that are known in advance. An agent’s behaviour is generated at runtime from natural-language input, which means an attacker can attempt to redirect it with text — the class of attack known as prompt injection — rather than with code. NeuralTrust sells three products aimed at that gap: TrustGate, a gateway that sits between applications, agents, tools and models to enforce policy and control access; TrustGuard, runtime monitoring that blocks unsafe agent behaviour as it happens; and TrustTest, a red-teaming tool that probes AI systems for weaknesses before attackers find them.

    The strategic read is that NeuralTrust is betting UK buyers — particularly regulated banks and airlines, where an unauthorised automated action carries immediate legal and operational consequence — will pay for agent governance sooner than buyers elsewhere. The company’s UK managing director, Cameron Brown, frames the office in exactly those terms. Whether that bet pays off depends on questions the announcement does not settle.

    Why Agent Security Is Not Just Application Security

    The security industry has spent two decades learning to defend systems whose behaviour is deterministic: given the same input, the same code path runs. Agents break that. They are given goals in plain language, decide which tools to call, and chain those calls together in sequences nobody wrote down in advance. A firewall sees an outbound API request; it does not see that the request was the third step in a plan an agent improvised after reading a malicious instruction hidden in a customer support ticket.

    This is why the gateway pattern NeuralTrust is selling with TrustGate has become the consensus architecture across this young market. Putting a control point between the agent and everything it can touch — models, internal tools, data stores — restores the thing traditional security depends on and agents destroy: a chokepoint where policy can be enforced and activity can be logged. It is the same instinct that produced API gateways and, before them, web proxies. The harder part is TrustGuard’s job: deciding, in real time and without adding latency a user would notice, whether a given agent action is legitimate. That is a detection problem with no settled ground truth, and vendors across the category are still establishing what good looks like.

    Red teaming, NeuralTrust’s third product line, is the least glamorous and arguably the most immediately saleable piece. Security teams asked to sign off on an agent deployment need evidence, and “we attacked it ourselves and here is what broke” is evidence a CISO can take to a risk committee. It also maps cleanly onto assurance processes enterprises already run for conventional software.

    A Crowded Layer of the Stack

    NeuralTrust is not entering an empty field. The control point between an application and a model is contested by several groups at once: cloud providers shipping native guardrail and filtering services with their own model platforms; established API management and identity vendors extending existing gateways to cover model traffic; a cohort of AI-security startups funded through 2025 and 2026; and open-source projects that give engineering teams a serviceable proxy for free. Each has a structural advantage. The hyperscalers own the deployment surface and can bundle. The incumbents own the buyer relationship and the procurement slot. Open source owns the price.

    The independent vendor’s counter-argument is portability. An enterprise running agents across multiple model providers, several clouds and a mix of internal and third-party tools cannot govern that estate from any single provider’s native console, and will not want its policy layer to be an artefact of a vendor it may want to leave. NeuralTrust’s positioning — a platform spanning “every platform and endpoint” — is aimed squarely at that argument, and the customer profile it describes, global banks and airlines with heterogeneous estates and hard regulatory obligations, is where it is most persuasive.

    The commercial risk is timing rather than technology. If the market consolidates before independent vendors reach durable scale, the natural outcome is acquisition by a platform security company rather than category leadership. A $20 million seed is substantial for the stage, and larger than typical for European cybersecurity, but it is not the war chest of a firm intending to outspend cloud providers on distribution. Spreading a round of that size across Barcelona, London and New York simultaneously is an aggressive allocation, and it implies the company expects revenue to arrive quickly enough to fund the next phase.

    Why London, and What an Office Actually Proves

    London is a rational first international bet for this product. The concentration of banks, insurers and airlines in the UK gives a vendor a dense cluster of buyers who share the same risk profile, and financial services firms operate under supervisory expectations around operational resilience and third-party technology risk that push governance spending forward rather than leaving it to discretion. Sales cycles in the sector are slow and reference-driven, which rewards local presence: a named managing director and a staffed office change how a procurement committee reads a vendor’s commitment.

    It is worth being precise about what an office opening does and does not demonstrate. It is a genuine cost commitment and a credible signal of intent, and paired with disclosed funding it is more than a press exercise. It is not evidence of revenue, contracted capacity or customer count in the market being entered. NeuralTrust states that it partners with major UK industry bodies and serves financial services, technology and enterprise clients in the region, but attaches no names, numbers or contract values to those statements. Both things can be true at once: the expansion is real, and its commercial scale is unquantified.

    Reading the Supporting Claims

    NeuralTrust cites a Gartner prediction that by 2027, 40% of enterprises will demote or decommission autonomous AI agents because governance gaps surface only after something has gone wrong in production. That figure is a forecast, not a measurement of anything that has happened, and forecasts of AI adoption have proven volatile in both directions. It is nonetheless directionally consistent with what enterprise buyers report: pilots that reach production and then stall when nobody can answer basic questions about what the agent did, why, and who is accountable. Used as a description of a pattern, it is useful. Used as a market-size proxy, it should carry a wide error bar.

    The company also describes itself as a category leader recognised by Gartner, KuppingerCole and MarketsandMarkets, and its June round as the largest cybersecurity seed financing by an EU company to date. These are checkable claims of different weight. Analyst recognition depends heavily on which specific report, which category and which evaluation criteria — details the announcement does not specify. The funding superlative is narrowly scoped by geography, sector and stage, which is how such records are usually constructed; it says something real about European cybersecurity funding levels and less about NeuralTrust’s standing against globally funded competitors.

    None of this undercuts the underlying thesis, which is the strongest part of the announcement. The gap between how quickly enterprises can deploy agents and how quickly security teams can build monitoring, policy and incident response for them is real, widely reported by practitioners, and unlikely to close on its own. A vendor addressing it with a gateway, runtime controls and adversarial testing is addressing the right problem. The open question is execution, not diagnosis.

    Background

    Enterprise adoption of generative AI moved through a recognisable sequence: internal chat assistants, then retrieval systems answering questions over company documents, and now agents that take actions. The final step is where the security model changes, because an agent that can call an internal payments interface or update a customer record introduces operational risk in a way a chatbot does not. Security teams have found their existing tooling largely blind to it — identity systems were designed around human users, network controls around known traffic patterns, and neither explains why an autonomous system chose a particular sequence of steps.

    That gap produced a wave of specialist vendors from 2024 onward, converging on a common architecture of a policy-enforcing gateway, runtime behavioural monitoring and adversarial testing. NeuralTrust, founded in Barcelona, is among the more heavily funded European entrants, having raised a $20 million seed in June 2026 and previously launched what it describes as a runtime security mesh extensible across every AI agent. Its expansion into London places it in a market where financial-services regulation around operational resilience and third-party technology risk gives security buyers an unusually early mandate to govern AI systems in production.

    Sources

    Source: NeuralTrust Opens New London Office as UK Enterprises Race to Secure Their AI Agents — NeuralTrust’s 7 September 2026 announcement of a dedicated London office, its UK hiring plans and its TrustGate, TrustGuard and TrustTest product lines.

  • OpenAI’s ‘Cybersecurity in the Intelligence Age’: AI as Attack Surface and Defense

    OpenAI’s ‘Cybersecurity in the Intelligence Age’: AI as Attack Surface and Defense

    OpenAI published a piece titled “Cybersecurity in the Intelligence Age,” surfaced via Google News on April 30, 2026. The title positions the company — best known for ChatGPT and its GPT family of models — as a direct voice in the cybersecurity conversation, framing artificial intelligence as both a new attack surface to be secured and a defensive capability in its own right.

    Executive Summary

    When the company building some of the world’s most widely used AI models publishes under a banner like “Cybersecurity in the Intelligence Age,” the publication itself is the news. It is a primary-source marker: OpenAI staking out a position at the intersection of AI and security, rather than leaving that framing to vendors, analysts, or critics.

    The dual framing implied by the title matters for anyone running infrastructure. “AI as attack surface” acknowledges that models, the applications built on them, and the data pipelines feeding them are now targets — through techniques such as prompt injection (tricking a model with malicious instructions embedded in its inputs) and model or data theft. “AI as defense layer” points the other direction: using models to triage alerts, analyze code for vulnerabilities, and augment understaffed security teams. We should be clear about sourcing: the syndicated item available to us carries the headline and publisher, not the full body text, so this analysis works from the framing OpenAI chose and the public context around it — not from claims we cannot verify.

    Why a Model Maker Talking Security Is Itself a Signal

    Security messaging from AI companies has historically been reactive — responses to incidents, red-team reports, or policy inquiries. A named, thesis-style publication like “Cybersecurity in the Intelligence Age” is different in kind: it is agenda-setting. It suggests OpenAI wants to define the vocabulary of AI-era security before regulators, competitors, and the security industry define it for them. For readers, that cuts both ways. Primary sources from the companies building frontier models carry information no third party has — telemetry on how attackers actually misuse models, for instance. But they are also written by a commercial actor with products to sell and rules to shape, so the claims deserve the same scrutiny any vendor white paper gets.

    The Attack-Surface Half: What Enterprises Actually Inherit

    Every organization that has wired a large language model into its workflows has, often without a formal decision, expanded its attack surface. Prompt injection, data leakage through model inputs and outputs, and the compromise of AI-powered agents that hold real credentials are categories of risk that barely existed three years ago. Infrastructure operators feel this concretely: AI workloads concentrate valuable data and compute in identifiable places, which makes the data centers, networks, and identity systems around them higher-value targets. Acknowledgment of this from a leading model provider is useful — it validates budget conversations security teams are already having — but acknowledgment is not mitigation, and the burden of securing deployments still lands mostly on the deploying enterprise.

    The Defense Half: Promise, and the Symmetry Problem

    The optimistic half of the framing — AI as a defense layer — rests on a real observation: security operations are chronically short-staffed, and models are genuinely good at the pattern-matching and summarization work that consumes analyst hours. The unresolved tension is symmetry. The same capabilities that help a defender triage a thousand alerts help an attacker write more convincing phishing at scale or probe code for exploitable flaws. Whether AI structurally favors defense or offense is one of the live debates in the field, and no publication — from OpenAI or anyone else — has settled it with public evidence. The practical takeaway for buyers is narrower and more durable: AI-assisted defense is becoming table stakes, and evaluating those tools on measured outcomes rather than framing is the discipline that matters.

    Background

    OpenAI was founded in 2015 and became a household name with ChatGPT’s launch in late 2022, which triggered the current wave of enterprise AI adoption. As large language models moved into production workflows, a parallel security conversation emerged: security vendors began embedding AI assistants into their products, researchers documented new attack classes such as prompt injection, and policymakers began asking who is responsible when AI systems are misused or compromised.

    Until recently, most of that conversation was led by security vendors, academic researchers, and government agencies. Publications from the model makers themselves — the companies with direct visibility into how their systems are attacked and abused — have been comparatively rare, which is what gives a titled piece like this one its significance as a primary source, whatever its full contents hold.

    Source: Cybersecurity in the Intelligence Age — OpenAI, an OpenAI publication surfaced via Google News on April 30, 2026; the syndicated item provided the headline and publisher only.

  • NSA and Allies Issue First Joint Guidance on Securing Agentic AI Systems

    NSA and Allies Issue First Joint Guidance on Securing Agentic AI Systems

    The U.S. National Security Agency (NSA) has joined the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) and other partner agencies to release joint guidance on agentic artificial intelligence systems — AI that doesn’t just answer questions but autonomously plans and executes tasks. Announced April 29, 2026, it is the first major multi-government security framework aimed specifically at AI agents, arguably the fastest-growing new attack surface in enterprise technology.

    Executive Summary

    According to the announcement, the NSA — alongside ASD’s ACSC and other unnamed partner agencies — has published guidance on agentic AI systems: software built on large language models that can take actions on a user’s behalf, such as browsing, writing code, calling APIs, or operating other software. That autonomy is precisely what makes agents useful, and precisely what makes them dangerous when compromised: an attacker who subverts an agent inherits everything the agent is allowed to do.

    The release matters less for any single recommendation than for what it signals. When signals-intelligence agencies from multiple allied nations co-sign a document about a technology category, that category has crossed a threshold — from experimental tooling to infrastructure that governments believe adversaries are actively probing. Enterprises deploying AI agents now have an authoritative reference point, and vendors selling them have a bar to be measured against.

    Autonomy Changes the Threat Model

    A conventional chatbot that gets manipulated produces bad text. An agentic system that gets manipulated produces bad actions — because agents are wired to tools, credentials, file systems, and APIs. The security community has spent two years documenting how techniques like prompt injection (hiding malicious instructions in content an AI reads, such as a webpage or email) can redirect an agent’s behavior. When the agent can send messages, move money, or modify infrastructure, a manipulated input stops being an embarrassment and becomes the equivalent of a compromised employee account.

    That is why agentic AI merits its own guidance rather than a footnote to existing AI security advice. Earlier frameworks focused on securing models, training data, and deployment pipelines. Agents add a different problem: the model’s outputs are now inputs to real systems, so classic security disciplines — least privilege, sandboxing, audit logging, human approval for consequential actions — must be rebuilt around a component that behaves probabilistically rather than deterministically.

    The Allied Playbook: Guidance Before Regulation

    This release fits a well-established pattern. The NSA, ASD’s ACSC, and partners including the UK’s NCSC and the U.S. CISA have jointly published a sequence of AI security documents since late 2023 — guidelines for secure AI development, for deploying AI systems securely, and for AI data security. Each followed the same model: non-binding, principles-based guidance issued jointly so that multinational enterprises face one aligned reference instead of a patchwork.

    Non-binding does not mean toothless. In practice, joint government guidance tends to become a de facto procurement standard — government buyers cite it in contracts, insurers and auditors reference it, and regulators later treat it as evidence of what “reasonable” security looked like at the time. Vendors of agent platforms and the enterprises deploying them should read this release as an early draft of tomorrow’s compliance expectations, arriving while the market is still young enough to adapt cheaply.

    What It Means for Enterprise and Infrastructure Operators

    For organizations already piloting AI agents, the immediate implication is organizational: agent deployments now belong in the security team’s scope, not just the innovation team’s. That means treating agents as privileged identities — with scoped credentials, network segmentation, activity logging, and defined blast radius — rather than as features of a productivity suite. Buyers evaluating agent platforms gain a useful question set: how does the vendor constrain what the agent can do, log what it did, and contain it when it misbehaves?

    For infrastructure providers — data centers, cloud and connectivity operators — agentic AI is both a workload to host and a tool their customers will point at their own environments. Isolation, observability, and identity infrastructure become selling points as enterprises look for places to run agents with enforceable boundaries. Government attention at this level tends to accelerate, not chill, enterprise adoption: clear security expectations reduce the uncertainty that keeps cautious industries on the sidelines.

    Background

    Governments began issuing coordinated AI security guidance almost as soon as generative AI reached enterprises: allied agencies including the NSA, CISA, the UK’s NCSC, and ASD’s ACSC jointly published guidelines for secure AI system development in November 2023, guidance on deploying AI systems securely in April 2024, and AI data security guidance in 2025. The NSA’s Artificial Intelligence Security Center, created in 2023, has anchored the U.S. side of that effort.

    Over the same period, the industry’s center of gravity shifted from chatbots to agents — AI that can use tools, browse, code, and act with limited supervision — driven by rapid capability gains in frontier models. Security researchers flagged early that autonomy plus tool access creates a fundamentally new attack surface; this April 2026 release is the first time that concern has been addressed head-on at the multi-government level.

    Source: NSA joins the ASD’s ACSC and Others to Release Guidance on Agentic Artificial Intelligence Systems — National Security Agency announcement of joint international guidance on securing agentic AI, published April 29, 2026.