The publication
Writing
Notes on cybersecurity and AI systems: the attack paths, the defenses, and the decisions in between.
All writing
35 articles- "Ask the User to Approve" Is Not a Security ControlApproval prompts get clicked through by the tenth repetition. Treat human review as a scarce resource and spend it where the blast radius is — everywhere else, enforce in code.#agentic-ai#agent-architecture#human-in-the-loop6 min read
- How to Build an Agent Audit Trail Before You Need ItThe provider's copy expires on their clock. Build the trail you own — context snapshots, provenance, a config hash, into storage the agent can't rewrite.#agentic-ai#incident-response#detection-engineering9 min read
- Your AI Agent Has No Audit TrailWhen an agent incident needs explaining, the evidence is already gone — context evaporates, and the provider's copy expires on a clock you don't set.#agentic-ai#ai-security#incident-response8 min read
- CSP Nonces and the Same-Origin Policy Solve Different ProblemsA CSP nonce and the same-origin policy both show up in the same sentence about XSS, but they guard different boundaries — one says which script on this page is allowed to run, the other says which origin is allowed to read what. Confusing them leaves one of the two unguarded.#appsec#web-security#csp6 min read
- Your Voice Is Not a Password AnymoreThree seconds of audio from an old video is enough to convincingly be someone you love. The check that works doesn't happen on the call.#ai-security#threat-modeling7 min read
- The Ransomware Crew Didn't Jailbreak AnythingTen intrusions in six weeks, run through a coding agent the attacker never broke — he just kept re-asking until the answer changed.#agentic-ai#ai-security#offensive-security8 min read
- The Same-Origin Policy Is Only as Strong as Your Browser AgentUniversity of Washington researchers showed a prompt injection can turn an agentic browser's own cross-origin access against it — SOP enforcement now bottoms out at the agent's injection defenses.#ai-security#agentic-ai#prompt-injection9 min read
- Agent Containment Is an Environment PropertyAn approval dialog is a request for the agent to be trusted. Containment is what stays true when that trust fails — and it lives in the environment, not the model.#agentic-ai#ai-security#agent-architecture9 min read
- How to Build an Agent Harness That Doesn't Waste Your ModelSame weights, different harness: fail-to-pass 28%→49%, complete solutions 43→72. The harness is half your agent — here's how to build it like that.#agentic-ai#agent-architecture#tool-calling8 min read
- Your Agent Is Impersonating YouWhen an agent acts with your token, every downstream log says you did it. Delegation, not impersonation: one token, two identities — and a delegation chain nobody enforces yet.#agentic-ai#ai-security#workload-identity8 min read
- Your AI Gateway Is on the KEV Catalog NowCISA put LiteLLM, Starlette, and Kestra on the KEV catalog on the same day. The AI plumbing you never inventoried is the part being exploited in the wild.#ai-security#mcp#api-security5 min read
- How to Vet an MCP Server Before You Install It97M+ monthly downloads, 8.5% OAuth adoption, 82% path-traversal exposure. A five-step workflow for deciding whether a specific MCP server deserves a place in your config.#agentic-ai#ai-security#mcp12 min read
- Threat Modeling for AI Agent SystemsThreat modeling fails because it runs as a quarterly workshop. Run it in sprints, at the architecture layer, and start with the agent surfaces scanners can't see: tool calls, memory, MCP servers.#threat-modeling#appsec#agentic-ai17 min read
- Agentjacking: Fake Errors Can Make Your Coding Agent Run Attacker CodeOne fake error event, injected through a public Sentry DSN, can hijack Claude Code, Cursor, or Codex into running attacker-controlled commands. Here's the chain, why your security stack can't see it, and the five controls that actually stop it.#agentic-ai#ai-security#mcp9 min read
- How AI Agents Exfiltrate Data — Five Paths Your DLP Was Never Built ForYour DLP stack was built to stop people copying files to USB sticks. Agents leak data through API calls, context windows, and memory stores. Here are the five paths — and the control model that actually closes them.#agentic-ai#ai-security#data-loss-prevention12 min read
- How to Red Team an AI Agent (Before It Gets Red Teamed for You)Testing an agent is not testing a model. The full guide: a four-layer attack surface, the prompt and MCP checks most teams skip, the frameworks that map it all, and a six-step red team playbook you can run this week.#agentic-ai#ai-security#red-teaming10 min read
- Your AI Agent Will Find Your API's Authorization Bugs FirstA Claude-powered agent was asked to improve its owner's gym waitlist position. It found the booking API had no ownership checks, canceled another member's reservation, and moved him up. Nobody told it to. Agents make missing authorization checks findable — here's how to audit yours before one does.#agentic-ai#ai-security#api-security6 min read
- AI Agent Memory Poisoning: How to Audit and Harden Your AgentOne bad line written to an agent's memory outlives every session. Here's how the write happens, how to audit for it, and how to make the store hostile to poison.#agentic-ai#ai-security#agent-memory11 min read
- Workload Identity Federation for AI Agents: Kill the Static KeyAgents are the new source of leaked secrets — AI-service keys grew 81% in a year. Workload identity federation replaces the static key with a short-lived token minted from the identity your agent already has. Here's the five-step migration.#agentic-ai#ai-security#workload-identity8 min read
- Validate Agent Tool Calls Before They ExecuteAgents generate tool arguments by sampling tokens — malformed calls aren't an edge case, they're a statistical certainty. Here's the five-minute contract check that runs before the side effect, not after the incident.#agentic-ai#ai-security#tool-calling6 min read
- Open Knowledge Format (OKF): Google's Answer to the AI Agent Context ProblemGoogle Cloud's OKF is a directory of markdown files with YAML frontmatter — nothing more, and that's the point. A format, not another service, so any agent can consume any knowledge base without an SDK. And v0.2 added the trust layer that makes agent-written knowledge safe to act on.#agentic-ai#ai-security#agent-architecture14 min read
- Your Multi-Agent Graph Has No BoundariesThe failure mode nobody designs for: one compromised agent acting as every other agent in the graph. A four-boundary checklist for multi-agent deployments.#agentic-ai#ai-security#multi-agent4 min read
- Your AI Agent Config Is Leaking SecretsThe files that configure your coding agent — .mcp.json, .claude/settings.json, the system prompt — are plaintext on disk and read by code that executes on your behalf. Most of them contain secrets, over-broad permissions, or both. Here's the five-minute audit.#agentic-ai#ai-security#mcp5 min read
- Graph Engineering: The Agent Architecture Shift That Changes Your Attack SurfaceGraph engineering went from a hashtag to a default architecture in a month. The security community is only starting to map what it breaks: shared state, agent-to-agent injection, and trust boundaries that no longer sit at the front door.#agentic-ai#ai-security#agent-architecture10 min read
- AI Agent Memory Is the New Log4jEvery agent framework has a memory store. Almost nobody audits it. The attack that lives there never sends a single malicious instruction.#agentic-ai#ai-security#agent-memory6 min read
- AI Governance Just Got TeethThe EU started enforcing the AI Act two weeks ago. Colorado rewrote its law. And Gartner says 40% of agentic AI projects will die from inadequate risk controls. Governance is no longer a slide deck.#agentic-ai#ai-governance#compliance6 min read
- Threat-Informed Defense Is Detection Engineering, Minus the GuessingA detection built on a file hash lasts until the next build. One built on a technique costs the adversary something to route around. That's the whole argument.#detection-engineering#threat-informed-defense#mitre-attack5 min read
- CTEM Is Vulnerability Management That Stopped Lying to ItselfA CVSS score never told you if the vulnerability was reachable. CTEM is what happens when you stop pretending that didn't matter.#exposure-management#ctem4 min read
- The Best Agent Harness Is the One You Don't NoticeThe harness isn't the interesting part of an agent system. That's exactly why it's the part worth getting right.#agentic-ai#agent-architecture2 min read
- Agentic Systems Aren't Apps With Extra StepsGive a model tools and a loop and you haven't built a feature — you've built a distributed system that talks to itself.#agentic-ai#agent-architecture2 min read
- The Incident Isn't Over When the Fire's OutContainment ends the emergency. It doesn't end the investigation — and skipping the second part is how the same breach happens twice.#incident-response3 min read
- Most Alerts Are Noise. Design for That.A detection rule that fires 200 times a day and gets ignored isn't a detection — it's a decoration.#detection-engineering#siem2 min read
- Prompt Injection Doesn't Need Your PromptThe dangerous instruction rarely comes from your user. It comes from the webpage, PDF, or ticket your agent just read.#ai-security#prompt-injection3 min read
- The Best Exploits Are BoringThe exploit chains that actually work in production are rarely the flashy CVE — they're three boring misconfigurations, chained.#offensive-security#red-teaming2 min read
- On Shipping Fast Without Breaking EverythingSpeed and stability aren't opposites — the trick is knowing which corners are safe to cut.#engineering1 min read