Blog

A recruiter runs 400 applications for a remote developer role through an AI shortlister, then books three video interviews. The top candidate interviews well, clears the background check, and asks for the laptop to go to a new address.

Two of those steps involved AI, and both can fail in ways the recruiter never sees. The shortlister may have dropped qualified people for reasons nobody chose, and the person on camera may not be the person on the documents.

A finance analyst asks Copilot for last year’s travel budget. The answer comes back with the right total, and underneath it a citation to a spreadsheet holding every employee’s salary.

Nobody hacked anything. The file had been shared with the whole company years earlier, and until that morning nobody had gone looking for it.

If you are planning October and looking for “the” 2026 theme, you will find two of them. That is not a mistake in someone’s blog post. The two organizations that co-founded the campaign published different wording this year, and knowing which is which saves you an awkward correction in front of your exec sponsor.

Most October campaigns are a poster, a company-wide email, and one 45-minute video that people click through with the tab muted. Then the click rate dips for three weeks and goes back to normal.

The plan below is the opposite shape. One small thing per working day, four themed weeks, and nothing that needs more than 20 minutes of anyone’s time.

Every category in the OWASP MCP Top 10 now has a dedicated exercise on RansomLeak. Ten scenarios covering the ten ways the connection between an AI agent and its tools fails. All free, no account required.

The OWASP MCP Top 10 lists the security risks of the Model Context Protocol, the standard that lets agents call external tools and read external data. This course turns each category into a scenario you work through rather than a definition you read.