There is no shortage of writing about AI security; there is a serious shortage of writing worth reading more than once. This curated list of the best ai security articles is intentionally short. Each entry earns its place by changing a decision, a defense, or the way a real risk gets explained to a stakeholder. The list is grouped by what the article is for, not by who published it.
Scope note: this page covers writing: papers, blog series, and industry writeups. Courses, certifications, communities, and datasets live in our AI security resources hub, and prompt-injection-specific tooling lives in our prompt injection resources page.
Foundational Reading — Read These First
| Article | Why It Matters | Type |
|---|---|---|
| OWASP Top 10 for LLM Applications | The vocabulary every AI security conversation now uses | Reference |
| Greshake et al., Indirect Prompt Injection (arXiv 2302.12173) | The paper that named and demonstrated the most important attack class | Research paper |
| Simon Willison’s prompt injection archive | The single best ongoing chronicle of attack techniques in plain English | Blog series |
| NIST AI 600-1: Generative AI Profile | The control framework U.S. enterprise procurement is converging on | Government guidance |
If you read nothing else, read these four. The Greshake paper alone reframes how to think about every input an LLM ever sees. Simon Willison’s archive is the closest thing to a real-time threat intel feed for attack techniques.
On Prompt Injection — Attack Side
| Article | What It Adds |
|---|---|
| Anthropic — Many-shot jailbreaking | Shows how long context windows enable a new class of attack |
| Lakera — Prompt Injection Attacks Handbook | Practical taxonomy of injection patterns seen in production |
| OpenAI — Disrupting deceptive uses of AI | Lessons from real-world abuse on a major API |
For a curated, frequently-updated database of jailbreak prompts and techniques, jailbreakdb.com and the technical writeups at aisec.blog cover the offensive side in operational detail.
On Defense and Guardrails
| Article | What It Adds |
|---|---|
| Lilian Weng — Adversarial Attacks on LLMs | Comprehensive technical survey of attack classes and known defenses |
| Anthropic — Constitutional AI | The theoretical basis behind a major class of safety training |
| Microsoft — PyRIT release post | Practical view from one of the largest production red-team programs |
| Google DeepMind — Frontier Safety Framework | Capability-thresholds approach to model deployment risk |
The Lilian Weng survey is the most technically dense single reference for engineers building defenses. Defensive technique writeups also live at guardml.io.
On Red Teaming
| Article | What It Adds |
|---|---|
| Microsoft — Lessons from red-teaming 100 generative AI products | Patterns from a substantial corpus of real engagements |
| OWASP — GenAI Red Teaming Guide | Checklist-format guide aimed at organizations standing up the function |
| MITRE ATLAS — Case study series | Documented real-world AI attack scenarios mapped to ATT&CK-style techniques |
For tooling comparisons see our AI red teaming tools guide.
On Agent Security
The agent security literature is still young, but a few pieces are already canonical:
- Computer use safety considerations — Anthropic’s threat model for desktop-driving agents
- Prompt injection in MCP tool ecosystems — community writeups (see Simon Willison’s archive) that surface the new injection surface introduced by tool servers
- OWASP AI Exchange, where OWASP’s continuously revised AI security and privacy guidance now lives, including the material outside the LLM Top 10
Our own coverage of agent security tooling maps the defenses to these threats.
On Incidents and Real-World Failures
Reviewing actual incidents is the fastest way to calibrate intuition about what risks are real versus theoretical. ai-alert.org curates AI incident, CVE, and disclosure tracking as a running feed, and aiincidents.org documents individual failures and postmortems in longer form. Independent tool reviews live at aisecreviews.com.
On Governance and Policy
- EU AI Act explanatory guidance — keep one bookmark for the canonical text and one for high-quality plain-language explainers
- Cloud Security Alliance — AI Security Working Group outputs — vendor-neutral practitioner guidance
Policy commentary on the neuralwatch.org site tracks ongoing regulatory developments.
What Got Cut
Articles that don’t make this list: vendor blog posts that read as marketing without measurement, “Top 100” listicles, anything reliant on screenshots of jailbreak prompts in chat UIs without an underlying technique to teach. The bar for inclusion is that an experienced practitioner can read the piece and walk away with a different decision they’d make next week.
Update Cadence
This list is reviewed quarterly. Foundational entries are stable; the agent-security, MCP injection, and incident sections see the most churn quarter-to-quarter. New entries replace older ones rather than accumulate — the value of the list is its size.
