// Archive
Writing
Notes on cybersecurity and AI systems.
Categories
- NOT-025Your AI Gateway Is on the KEV Catalog NowCISA put LiteLLM, Starlette, and Kestra on the KEV catalog on the same day. The AI plumbing you never inventoried is the part being exploited in the wild.#ai-security#mcp#api-security5 min read
- NOT-024How to Vet an MCP Server Before You Install It97M+ monthly downloads, 8.5% OAuth adoption, 82% path-traversal exposure. A five-step workflow for deciding whether a specific MCP server deserves a place in your config.#agentic-ai#ai-security#mcp12 min read
- NOT-023Threat Modeling for AI Agent SystemsThreat modeling fails because it runs as a quarterly workshop. Run it in sprints, at the architecture layer, and start with the agent surfaces scanners can't see: tool calls, memory, MCP servers.#threat-modeling#appsec#agentic-ai15 min read
- NOT-022Agentjacking: Fake Errors Can Make Your Coding Agent Run Attacker CodeOne fake error event, injected through a public Sentry DSN, can hijack Claude Code, Cursor, or Codex into running attacker-controlled commands. Here's the chain, why your security stack can't see it, and the five controls that actually stop it.#agentic-ai#ai-security#mcp9 min read
- NOT-021How AI Agents Exfiltrate Data — Five Paths Your DLP Was Never Built ForYour DLP stack was built to stop people copying files to USB sticks. Agents leak data through API calls, context windows, and memory stores. Here are the five paths — and the control model that actually closes them.#agentic-ai#ai-security#data-loss-prevention11 min read
- NOT-020How to Red Team an AI Agent (Before It Gets Red Teamed for You)Testing an agent is not testing a model. The full guide: a four-layer attack surface, the prompt and MCP checks most teams skip, the frameworks that map it all, and a six-step red team playbook you can run this week.#agentic-ai#ai-security#red-teaming10 min read
- NOT-019Your AI Agent Will Find Your API's Authorization Bugs FirstA Claude-powered agent was asked to improve its owner's gym waitlist position. It found the booking API had no ownership checks, canceled another member's reservation, and moved him up. Nobody told it to. Agents make missing authorization checks findable — here's how to audit yours before one does.#agentic-ai#ai-security#api-security6 min read
- NOT-018AI Agent Memory Poisoning: How to Audit and Harden Your AgentOne bad line written to an agent's memory outlives every session. Here's how the write happens, how to audit for it, and how to make the store hostile to poison.#agentic-ai#ai-security#agent-memory10 min read
- NOT-017Workload Identity Federation for AI Agents: Kill the Static KeyAgents are the new source of leaked secrets — AI-service keys grew 81% in a year. Workload identity federation replaces the static key with a short-lived token minted from the identity your agent already has. Here's the five-step migration.#agentic-ai#ai-security#workload-identity8 min read
- NOT-016Validate Agent Tool Calls Before They ExecuteAgents generate tool arguments by sampling tokens — malformed calls aren't an edge case, they're a statistical certainty. Here's the five-minute contract check that runs before the side effect, not after the incident.#agentic-ai#ai-security#tool-calling6 min read
- NOT-015Open Knowledge Format (OKF): Google's Answer to the AI Agent Context ProblemGoogle Cloud's OKF is a directory of markdown files with YAML frontmatter — nothing more, and that's the point. A format, not another service, so any agent can consume any knowledge base without an SDK. And v0.2 added the trust layer that makes agent-written knowledge safe to act on.#agentic-ai#ai-security#agent-architecture13 min read
- NOT-014Your Multi-Agent Graph Has No BoundariesThe failure mode nobody designs for: one compromised agent acting as every other agent in the graph. A four-boundary checklist for multi-agent deployments.#agentic-ai#ai-security#multi-agent4 min read
- NOT-013Your AI Agent Config Is Leaking SecretsThe files that configure your coding agent — .mcp.json, .claude/settings.json, the system prompt — are plaintext on disk and read by code that executes on your behalf. Most of them contain secrets, over-broad permissions, or both. Here's the five-minute audit.#agentic-ai#ai-security#mcp5 min read
- NOT-012Graph Engineering: The Agent Architecture Shift That Changes Your Attack SurfaceGraph engineering went from a hashtag to a default architecture in a month. The security community is only starting to map what it breaks: shared state, agent-to-agent injection, and trust boundaries that no longer sit at the front door.#agentic-ai#ai-security#agent-architecture10 min read
- NOT-011AI Agent Memory Is the New Log4jEvery agent framework has a memory store. Almost nobody audits it. The attack that lives there never sends a single malicious instruction.#agentic-ai#ai-security#agent-memory6 min read
- NOT-010AI Governance Just Got TeethThe EU started enforcing the AI Act two weeks ago. Colorado rewrote its law. And Gartner says 40% of agentic AI projects will die from inadequate risk controls. Governance is no longer a slide deck.#agentic-ai#ai-governance#compliance6 min read
- NOT-009Threat-Informed Defense Is Detection Engineering, Minus the GuessingA detection built on a file hash lasts until the next build. One built on a technique costs the adversary something to route around. That's the whole argument.#detection-engineering#threat-informed-defense#mitre-attack5 min read
- NOT-008CTEM Is Vulnerability Management That Stopped Lying to ItselfA CVSS score never told you if the vulnerability was reachable. CTEM is what happens when you stop pretending that didn't matter.#exposure-management#ctem4 min read
- NOT-007The Best Agent Harness Is the One You Don't NoticeThe harness isn't the interesting part of an agent system. That's exactly why it's the part worth getting right.#agentic-ai#agent-architecture2 min read
- NOT-006Agentic Systems Aren't Apps With Extra StepsGive a model tools and a loop and you haven't built a feature — you've built a distributed system that talks to itself.#agentic-ai#agent-architecture2 min read
- NOT-005The Incident Isn't Over When the Fire's OutContainment ends the emergency. It doesn't end the investigation — and skipping the second part is how the same breach happens twice.#incident-response3 min read
- NOT-004Most Alerts Are Noise. Design for That.A detection rule that fires 200 times a day and gets ignored isn't a detection — it's a decoration.#detection-engineering#siem2 min read
- NOT-003Prompt Injection Doesn't Need Your PromptThe dangerous instruction rarely comes from your user. It comes from the webpage, PDF, or ticket your agent just read.#ai-security#prompt-injection3 min read
- NOT-002The Best Exploits Are BoringThe exploit chains that actually work in production are rarely the flashy CVE — they're three boring misconfigurations, chained.#offensive-security#red-teaming2 min read
- NOT-001On Shipping Fast Without Breaking EverythingSpeed and stability aren't opposites — the trick is knowing which corners are safe to cut.#engineering1 min read