Turn specs into evals for any agent with ASSERT

A set of Microsoft Security Blog posts covering AI and software supply chain security. Key items: ASSERT — an open-source framework to convert natural-language specs into executable evaluations; a telemetry-driven playbook for reconstructing AI activity in Microsoft 365 Copilot and Azure AI; warning about threat actors abusing AI branding for social engineering. Several high-risk supply-chain and CI/CD incidents are described: a prompt‑injection flaw in the Claude Code GitHub Action that could expose workflow secrets, a large-scale npm “Miasma” campaign that compromised >90 @redhat-cloud‑serv​