Most Enterprise AI Tools Fail Security Standards, Says Codernic Audit

·2 views

A technical audit by Swiss firm Codernic found that the majority of enterprise AI solutions on the market are little more than wrappers around third-party cloud APIs, raising serious compliance and security concerns. One key risk is silent data leakage, where sensitive personal or medical information is transmitted to external servers in plain text, potentially violating GDPR and Swiss data protection law. Another identified flaw is RAG hallucination, where AI systems fabricate answers by extrapolating from irrelevant documents, leading to unreliable outputs for business decisions. A third vulnerability involves AI tools bypassing role-based access controls, allowing users to retrieve documents they are not authorized to view. Codernic says it has rebuilt enterprise AI infrastructure from scratch to address these issues through deterministic data scrubbing, corrective retrieval mechanisms, and access-control-aware document indexing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

EU Parliament Advances Controversial Chat Control Surveillance Proposal

The European Parliament has passed the first round of the Chat Control proposal, marking a significant step forward for the contentious legislation. The measure, which has faced strong opposition from privacy advocates, would require messaging platforms to scan private communications for illegal content. The vote took place in Strasbourg, reviving what critics describe as an earlier version of the proposal known as Chat Control 1.0. Supporters argue the legislation is necessary to combat child exploitation and other crimes, while opponents warn it would effectively end end-to-end encryption and mass-surveill citizens.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Why Silent Service Failures Go Undetected and How Absence Detection Fixes It

Silent failures occur when a service stops functioning without generating any errors or alerts, leaving monitoring systems falsely showing healthy status. A common example is a background worker being killed by the operating system mid-process, causing task queues to back up while every alert threshold remains unbreached. Traditional error-based alerting cannot detect these failures because it requires data to evaluate, and a dead service produces none. Absence detection addresses this by learning each service's normal activity baseline — accounting for time of day and day of week — and alerting when log volume, trace throughput, or metric reporting drops unexpectedly. Tools like Epok apply this logic across all signal types simultaneously, flagging the specific stream or metric that went dark rather than issuing a vague warning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Model Context Protocol: Why Tool Connections Determine AI Agent Success in Production

Model Context Protocol (MCP) is emerging as a critical layer that allows AI coding agents to connect with real-world services like databases, payment systems, and deployment platforms. Without MCP integrations, agents lack access to tools such as Postgres schemas, deploy logs, or authentication providers, limiting them to isolated, demo-like functionality. MCP works through a standardized handshake between an agent and external tools, with a growing ecosystem of supported services including Stripe, Sentry, Cloudflare, and Notion. Configuration is handled via simple JSON files at the repo level, enabling the same server setup to work across multiple agent environments like Cursor, Claude Code, and Windsurf. Experts argue that curating a small, focused set of five core tool integrations — covering database, payments, deployment, auth, and email — is more effective than exposing agents to a broad, uncurated catalog.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

RSA JWT Validation in .NET Can Fail Due to Algorithm Identifier Mismatch

Developers validating RSA-signed JWTs in .NET may encounter signature validation failures even when the public key is correct. The root cause is often a mismatch in algorithm identifier format within the ValidAlgorithms configuration parameter. Some identity providers, particularly older WCF-based or enterprise SSO systems, express the signing algorithm as a full URI such as 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256' instead of the standard short form 'RS256'. If only the short-form identifier is listed in ValidAlgorithms, tokens using the URI form are rejected despite carrying a cryptographically valid signature. The fix is to include both identifier formats in the ValidAlgorithms list, ensuring tokens are accepted regardless of which format the issuing service uses.

0 comments Read more at DEV Community