December 2025 Summaries

As California prepares to enforce new AI regulations on January 1, 2026, the state is focusing on controlling how AI systems interact with users in real-time, particularly in sensitive contexts. Two laws, SB 243 and AB 489, will require AI systems that engage with users to have mechanisms to avoid self-harm content, prevent misleading medical advice, and maintain transparency about their non-human nature. These regulations emphasize the need for AI systems to have dynamic guardrails that can adjust to real-world interactions, rather than relying solely on static rules. Lakera's Guard tool offers solutions for teams to enforce these requirements by allowing them to define precise policies and intercept inappropriate responses. While a federal executive order has been issued to review state-level AI regulations, California's laws remain set to take effect, highlighting the state's pioneering role in bringing AI governance into practical application.

In the fourth quarter of 2025, the evolution of agentic AI systems presented new challenges and opportunities for both developers and attackers. As these systems began interacting with documents, tools, and external data, the threat landscape shifted, with attackers quickly adapting to exploit new vulnerabilities. The primary goal for attackers was system prompt extraction, using techniques like hypothetical scenarios and obfuscation to reveal sensitive information. Additionally, content safety bypasses became more subtle, with attackers framing prompts in ways that circumvented direct policy challenges. Exploratory probing emerged as a tactic to understand model vulnerabilities, while agent-specific attacks revealed attempts to access confidential data and embed malicious instructions in external content. Indirect attacks, which required fewer attempts than direct injections, highlighted the growing complexity of AI systems. As AI continues to advance, these trends underscore the need for comprehensive security measures to cover every interaction and anticipate new attack vectors.