Prompt injection, apparently, is role confusion, in a newsletter that also hits PHP hardening and the new MCP spec.

Can enterprise AI agents be trusted without attested execution, or is this just logging with a conference badge?

A post-quantum checklist for AI agents: ML-KEM, ML-DSA, hybrid rollouts, and the usual cryptography panic.

PCI SSC interview with Utimaco on HSMs, key management, AI crypto risk, and PQ migration, because governance needed another acronym.

Long essay on Hilbert's axioms, then somehow hashes, TLA+, Circom, OPA, SHAP, and SBOMs end up in the same security sermon.

Security roundup: package proxies, AI-agent canary benchmarks, and OpenAI's Daybreak/Codex updates, plus the usual cloud mess.

Frontier models are being pointed at open source bugs, with humans still stuck doing validation, disclosure, and the patch.

Post-quantum migration is the easy part; the real mess is keeping AI agents from leaking data and swallowing deepfakes.

Paper on auditable machine unlearning via passport-embedded reps, so forgetting gets a cryptographic key and a paper trail.

Guide to hardening MCP deployments with mTLS, sandboxing, policy controls, and hybrid PQ crypto for the usual future-proofing theater.

What did tl;dr sec #332 pick out this week? OpenAI hire, AWS supply-chain advice, OIDC/Lambda abuse, and AI threat notes.