Security & Compliance Articles
23 articles · Page 1 of 2
The Five Eyes Published an Unusually Specific AI Agent Advisory
The Five Eyes published the first joint guidance on agentic AI security. For CX builders it's specific: tool permissions, schema injection, and human oversight.
Agentjacking: how attackers hijack production AI agents
Agentjacking is a new attack class that targets the data your agent trusts, not the model itself. Learn how attackers exploit CRM notes, tool responses, and knowledge bases to hijack production CX agents, and how to stop them.
The OWASP Top 10 for agentic AI: a CX builder's field guide
OWASP published its first Top 10 for Agentic Applications in 2026. Here's what every team building CX agents needs to know, including the three risks that traditional AppSec was never designed to catch.
Your AI agents need their own identity
Most CX agents share a single API key with every other service on your stack. Here's how to implement proper agent identity: OAuth 2.0, scope minimization, JIT provisioning, and instant kill switches.
When your agents call other agents, don't assume trust
Multi-agent systems create delegation chains where each agent trusts the one that called it. That assumption is how prompt injection and privilege escalation get in. Here's how to enforce scoped trust instead.
Agent containment: what Microsoft's MXC means for CX
Microsoft unveiled MXC at Build 2026: OS-level sandboxes for AI agents with policy-driven containment and Entra-backed identity. Here's what it means for teams building CX agents.
How to Build Production-Safe Credentials for AI Agents
After PocketOS lost its production database to a nine-second AI agent error, here's the credential model that would have stopped it: vaults, scoping, RBAC, and boundary tests.
The EU AI Act Deadline Is 11 Weeks Away. Your CX Agent Is Probably High-Risk
The EU AI Act's high-risk compliance deadline is August 2, 2026, just 11 weeks away. Here's what CX teams building AI agents for European markets need to have in place before then.
Build a Save-Desk Voice Agent That Won't Get You Sued
FTC click-to-cancel was vacated. State laws still bite. The cancel-first architecture, one-shot offers, and audit trail for a save-desk voice agent.
How to Build a Healthcare Appointment Voice Agent (FHIR, 270/271, HIPAA)
Most voice AI tutorials stop after hello. The real build: identity verification, FHIR slots, 270/271 eligibility, A2P SMS, escalation, with HIPAA gates intact.
Building an AI Nurse Line Without Practicing Medicine
Health systems pay $20-30 per nurse-line call. AI is the obvious cost play, but every triage agent raises a malpractice question. Here's the safe architecture.
Build a KYC Voice Agent: 4-Minute Account Open, 5-Year Audit Log
Voice collects name, DOB, SSN. SMS hands the camera the rest. OFAC screens before the next word. Architecture of a KYC voice agent that survives a BSA exam.
Learn Agentic AI
Weekly. Patterns for shipping agents that work. MCP, scorecards, regression tests, prompts, model comparisons.
