Topic
AI guardrails now come as gateways, cloud APIs, Python frameworks and small safety models. They differ less in what they detect than in where they sit and what traffic they can see. Nine tools, compared against published criteria, with the gaps each one leaves.
The phrase now means two things: Anthropic's Claude Security scanner, and the job of keeping a coding agent with shell access from doing harm. Permission modes, the sandbox, managed settings, MCP policy and gateway routing, mapped to the incidents that shaped them.
The 2026 edition of the OWASP Top 10 for LLM applications is the first built partly on incident data. It reorders the list, renames one entry and hands agent risks to a separate Agentic Top 10. Each of the ten risks, with documented examples and the layer that can actually enforce its controls.
Every major lab, OWASP and the UK's National Cyber Security Centre now say the same thing about prompt injection. Models cannot reliably tell instructions from data, filters miss adaptive attacks, and the defenses that work limit what a manipulated model is able to do.
Two thirds of AI users reach AI services through personal accounts on corporate devices, and shadow AI now appears in 43% of the AI security incidents IBM studied. The risks, the four detection layers, the acceptable use policy and the controls that turn unsanctioned use into governed use.