All articles
Every deep-dive, teardown and field note from the lab — newest first.
- July 9, 2026
Secure Agentic Engineering: Security by Design for AI Agents
Why agent security has to be designed alongside the architecture, not bolted on afterward — the concrete engineering-process points where the outcome of every future attack is actually decided.
Read → - June 24, 2026
Agent Tool Sandboxing: seccomp, gVisor, WASM, and microVMs as Layers of Containment
How to sandbox AI agent tools with seccomp, gVisor, WASM, and microVMs. A layered containment model that isolates untrusted-data processing and limits blast radius.
Read → - June 24, 2026
AI Agent Guardrails: Input and Output Filtering Against Prompt Injection
How AI agent guardrails work: input/output validation, prompt injection detection, content policies, and pre-action output checks that stop an agent before it acts.
Read → - June 24, 2026
AI Agent Incident Teardowns: Anatomy of Real Prompt-Injection and Exfiltration Breaches
Three real AI agent incidents torn apart: EchoLeak, Slack AI, and GitHub MCP. The attack chains, the root causes, and the lessons learned for defenders.
Read → - June 24, 2026
AI Agent Security Benchmarks: Mapping Your Eval Harness to MITRE ATLAS and the OWASP Top 10 for Agentic Applications
How to map AI agent security benchmarks and your eval harness to MITRE ATLAS techniques and the OWASP Top 10 for Agentic Applications (ASI). A practical guide.
Read → - June 24, 2026
The AI Agent Threat Landscape in 2026: Attack Surface, Emerging TTPs, and What Changed This Year
A field guide to the 2026 AI agent threat landscape: the autonomous-agent attack surface, the emerging TTPs that defined this year, and what actually changed.
Read → - June 24, 2026
Capability-Based Security for Agent Tools: Enforcing Least Privilege with Scoped, Per-Tool Tokens and Object Capabilities
How capability-based security, object capabilities, and scoped per-tool tokens let you enforce least privilege for AI agents, so a compromised tool cannot reach what it was never handed.
Read → - June 24, 2026
Cryptographic Identity for AI Agents: Issuing Verifiable Identity with mTLS, JWT, and SPIFFE/SPIRE
How to give non-human AI agents verifiable cryptographic identity using mTLS, JWT, and SPIFFE/SPIRE — why static API keys fail and how to issue short-lived workload identity.
Read → - June 24, 2026
CTF-Style Challenges for AI Agent Security: Building Reproducible Playgrounds and Scoring Agent Exploitation
How to design AI security CTF challenges that are reproducible, score real agent exploitation, and go beyond prompt injection puzzles to test tool-using agents.
Read → - June 24, 2026
Defense-in-Depth for Autonomous AI Agents: A Complete Layered Security Architecture
A complete guide to defense-in-depth for autonomous AI agents: guardrails, I/O filtering, least-privilege tools, sandboxing, and anomaly monitoring in one model.
Read → - June 24, 2026
Delegation Chains and the Confused Deputy in Agent Identity: Safe Impersonation, Token Exchange, and Audit Trails
How AI agents pass authority safely down a delegation chain, why the confused deputy bites, and how token exchange (RFC 8693) keeps audit trails intact.
Read → - June 24, 2026
Industry-Specific AI Agent Risk: How the Threat Model Shifts for Finance, Healthcare and Legal
Industry AI agent risk is not generic. See how the threat model shifts for finance agent security, healthcare AI agents and legal AI agent deployments.
Read → - June 24, 2026
Least-Privilege Agent Tools: Capability Scoping, Permission Gating, and Human-in-the-Loop
How to give AI agents only the tools they need: capability scoping, permission gating, dynamic toolset narrowing, and human-in-the-loop checkpoints for irreversible actions.
Read → - June 24, 2026
Malicious MCP Servers: How Rogue Tool Servers Cross Your Agent's Trust Boundary
A malicious MCP server runs with your agent's privileges and dictates its tool behavior. How rogue servers get in, what they can do, and how to verify, pin, and isolate them.
Read → - June 24, 2026
Mapping AI Agent Attacks to MITRE ATLAS: Tactics, Techniques, and the Detection Signals Each Phase Produces
A practical walkthrough of mapping AI agent attacks to MITRE ATLAS tactics and techniques, plus the concrete detection signals each phase leaves behind for your SOC.
Read → - June 24, 2026
MCP Security: Tool Poisoning, Rogue Servers, and Supply-Chain Exploits
How attackers exploit the Model Context Protocol: tool poisoning, malicious and rogue MCP servers, rug pulls and supply-chain attacks against agent tooling — the offensive threat model.
Read → - June 24, 2026
MCP Server Isolation: Containing Untrusted Tool Servers and the CVEs That Prove Why
Why MCP servers are the new untrusted dependency: a tour of the CVE classes — command injection, tool poisoning, path traversal, SSRF — and how to isolate, scope, and sandbox each server so a compromised tool can't own your agent.
Read → - June 24, 2026
Testing Memory Poisoning in a Red-Team Lab: Seeding RAG Corpora and Detecting Tainted Retrieval
Build a memory poisoning test in your red-team lab: seed RAG corpora and vector stores with tainted records, then detect poisoned retrieval before it reaches the model.
Read → - June 24, 2026
Novel Attack Classes for Autonomous Agents: Consensus Hijacking and Context Boundary Confusion
A field guide to novel agent attacks — multi-agent consensus hijacking and context boundary confusion — plus the emerging AI threats security teams should track now.
Read → - June 24, 2026
OAuth 2.1 and OIDC for AI Agents: Client Credentials, Token Rotation, and Tight Scopes
How to authenticate AI agents with OAuth 2.1 and OIDC: when to use the client-credentials flow, how token rotation limits blast radius, and how to design scopes that stay tight.
Read → - June 24, 2026
The OWASP Top 10 for Agentic Applications (ASI01–ASI10): Attack Vectors and Exploitability of Each Risk
An attacker's-eye analysis of the OWASP Top 10 for Agentic Applications (ASI01–ASI10): how each risk is actually exploited, the attack vector behind it, and what makes an agent vulnerable.
Read → - June 24, 2026
Red-Teaming Prompt Injection Against AI Agents: Payloads, Evasion, and TTPs in the Lab
A hands-on lab playbook for red-teaming prompt injection against AI agents: building jailbreak payloads, indirect injection testing, evasion patterns, and attacker TTPs.
Read → - June 24, 2026
Offensive Red-Team Frameworks for AI Agents: Garak, PyRIT, and Promptfoo in the Lab
A hands-on offensive comparison of Garak, PyRIT, and Promptfoo for red-teaming AI agents in the lab: what attack techniques each tool automates, how they differ, and when to reach for which.
Read → - June 24, 2026
Token Theft and Replay Attacks Against AI Agents: How Agent Credentials Leak and How to Contain the Blast Radius
How AI agent credentials leak, why stolen tokens replay past MFA, and how token binding plus short-lived tokens shrink the blast radius of token theft.
Read → - June 24, 2026
Tool-Call Fuzzing and Abuse Testing for AI Agents: Finding Excessive Agency and Confused-Deputy Paths
A red-team guide to tool call fuzzing and function call abuse testing for AI agents: how to surface excessive agency and confused-deputy paths before attackers do.
Read → - June 24, 2026
Tool Description Poisoning in MCP: How Rug Pulls and Hidden Instructions Hijack Your Agent
How MCP tool description poisoning and rug pulls hide malicious instructions in tool metadata, plus pinning and audit defenses that actually catch post-install mutation.
Read → - June 24, 2026
Zero-Trust for AI Agents: the Trust Assumptions Attackers Exploit — and the Enforcement That Stops Them
Why implicit trust between AI agents is an attack path: how adversaries abuse agent-to-agent trust and delegated identity, and how continuous verification, a policy decision point and mTLS shut it down.
Read → - June 23, 2026
The AI Agent Attack Surface: A Practical Threat Model
A practical threat model of autonomous AI agent security: prompt injection, tool abuse, memory poisoning, excessive agency, and multi-agent propagation — mapped to the OWASP Top 10 for Agentic Applications and MITRE ATLAS.
Read → - June 23, 2026
Indirect Prompt Injection in AI Agents: Attack Chains, Payloads, and Injection Techniques
How attackers chain indirect prompt injection to hijack AI agents: injection sources, payload construction, multi-step attack chains, and the techniques that carry hidden instructions into the model.
Read → - June 23, 2026
Memory and Context Poisoning in AI Agents: Attack Patterns and Injection Techniques
How attackers poison an AI agent's long-term memory and retrieved context: injection patterns, persistence techniques, and how false data is planted to hijack every future session.
Read → - June 23, 2026
Multi-Agent and Agent-to-Agent Attacks: How One Compromised Agent Poisons the Swarm
How a single compromised agent spreads malicious instructions through a multi-agent system, which trust assumptions enable lateral movement, and what isolation defenses can contain the blast radius.
Read → - June 23, 2026
Tool and Function-Call Abuse in AI Agents: The Confused-Deputy Problem Explained
How attackers exploit AI agents' privileged tool access through the confused-deputy problem — mechanism, concrete example, and least-privilege defenses that actually work.
Read →