secagentlabs — AI agent security researchsecagentlabs is an independent research lab attacking autonomous AI agents — prompt-injection chains, MCP and tool exploits, identity abuse — and publishing reproducible findings and defenses that actually hold.https://secagentlabs.com/enSecure Agentic Engineering: Security by Design for AI Agentshttps://secagentlabs.com/blog/secure-agentic-engineering-security-by-design/https://secagentlabs.com/blog/secure-agentic-engineering-security-by-design/Why agent security has to be designed alongside the architecture, not bolted on afterward — the concrete engineering-process points where the outcome of every future attack is actually decided.Thu, 09 Jul 2026 00:00:00 GMTAgent Tool Sandboxing: seccomp, gVisor, WASM, and microVMs as Layers of Containmenthttps://secagentlabs.com/blog/agent-tool-sandboxing-isolation-layers/https://secagentlabs.com/blog/agent-tool-sandboxing-isolation-layers/How to sandbox AI agent tools with seccomp, gVisor, WASM, and microVMs. A layered containment model that isolates untrusted-data processing and limits blast radius.Wed, 24 Jun 2026 00:00:00 GMTAI Agent Guardrails: Input and Output Filtering Against Prompt Injectionhttps://secagentlabs.com/blog/ai-agent-guardrails-input-output-filtering/https://secagentlabs.com/blog/ai-agent-guardrails-input-output-filtering/How AI agent guardrails work: input/output validation, prompt injection detection, content policies, and pre-action output checks that stop an agent before it acts.Wed, 24 Jun 2026 00:00:00 GMTAI Agent Incident Teardowns: Anatomy of Real Prompt-Injection and Exfiltration Breacheshttps://secagentlabs.com/blog/ai-agent-incident-teardowns-prompt-injection-tool-abuse/https://secagentlabs.com/blog/ai-agent-incident-teardowns-prompt-injection-tool-abuse/Three real AI agent incidents torn apart: EchoLeak, Slack AI, and GitHub MCP. The attack chains, the root causes, and the lessons learned for defenders.Wed, 24 Jun 2026 00:00:00 GMTAI Agent Security Benchmarks: Mapping Your Eval Harness to MITRE ATLAS and the OWASP Top 10 for Agentic Applicationshttps://secagentlabs.com/blog/ai-agent-security-benchmarks-atlas-owasp-asi-mapping/https://secagentlabs.com/blog/ai-agent-security-benchmarks-atlas-owasp-asi-mapping/How to map AI agent security benchmarks and your eval harness to MITRE ATLAS techniques and the OWASP Top 10 for Agentic Applications (ASI). A practical guide.Wed, 24 Jun 2026 00:00:00 GMTThe AI Agent Threat Landscape in 2026: Attack Surface, Emerging TTPs, and What Changed This Yearhttps://secagentlabs.com/blog/ai-agent-threat-landscape-2026/https://secagentlabs.com/blog/ai-agent-threat-landscape-2026/A field guide to the 2026 AI agent threat landscape: the autonomous-agent attack surface, the emerging TTPs that defined this year, and what actually changed.Wed, 24 Jun 2026 00:00:00 GMTCapability-Based Security for Agent Tools: Enforcing Least Privilege with Scoped, Per-Tool Tokens and Object Capabilitieshttps://secagentlabs.com/blog/capability-based-security-agent-tools-least-privilege/https://secagentlabs.com/blog/capability-based-security-agent-tools-least-privilege/How capability-based security, object capabilities, and scoped per-tool tokens let you enforce least privilege for AI agents, so a compromised tool cannot reach what it was never handed.Wed, 24 Jun 2026 00:00:00 GMTCryptographic Identity for AI Agents: Issuing Verifiable Identity with mTLS, JWT, and SPIFFE/SPIREhttps://secagentlabs.com/blog/cryptographic-identity-ai-agents-mtls-jwt-spiffe-spire/https://secagentlabs.com/blog/cryptographic-identity-ai-agents-mtls-jwt-spiffe-spire/How to give non-human AI agents verifiable cryptographic identity using mTLS, JWT, and SPIFFE/SPIRE — why static API keys fail and how to issue short-lived workload identity.Wed, 24 Jun 2026 00:00:00 GMTCTF-Style Challenges for AI Agent Security: Building Reproducible Playgrounds and Scoring Agent Exploitationhttps://secagentlabs.com/blog/ctf-challenges-ai-agent-security-reproducible-playgrounds/https://secagentlabs.com/blog/ctf-challenges-ai-agent-security-reproducible-playgrounds/How to design AI security CTF challenges that are reproducible, score real agent exploitation, and go beyond prompt injection puzzles to test tool-using agents.Wed, 24 Jun 2026 00:00:00 GMTDefense-in-Depth for Autonomous AI Agents: A Complete Layered Security Architecturehttps://secagentlabs.com/blog/defense-in-depth-autonomous-ai-agents/https://secagentlabs.com/blog/defense-in-depth-autonomous-ai-agents/A complete guide to defense-in-depth for autonomous AI agents: guardrails, I/O filtering, least-privilege tools, sandboxing, and anomaly monitoring in one model.Wed, 24 Jun 2026 00:00:00 GMTDelegation Chains and the Confused Deputy in Agent Identity: Safe Impersonation, Token Exchange, and Audit Trailshttps://secagentlabs.com/blog/delegation-chains-confused-deputy-agent-identity/https://secagentlabs.com/blog/delegation-chains-confused-deputy-agent-identity/How AI agents pass authority safely down a delegation chain, why the confused deputy bites, and how token exchange (RFC 8693) keeps audit trails intact.Wed, 24 Jun 2026 00:00:00 GMTIndustry-Specific AI Agent Risk: How the Threat Model Shifts for Finance, Healthcare and Legalhttps://secagentlabs.com/blog/industry-specific-ai-agent-risk-finance-healthcare-legal/https://secagentlabs.com/blog/industry-specific-ai-agent-risk-finance-healthcare-legal/Industry AI agent risk is not generic. See how the threat model shifts for finance agent security, healthcare AI agents and legal AI agent deployments.Wed, 24 Jun 2026 00:00:00 GMTLeast-Privilege Agent Tools: Capability Scoping, Permission Gating, and Human-in-the-Loophttps://secagentlabs.com/blog/least-privilege-agent-tools/https://secagentlabs.com/blog/least-privilege-agent-tools/How to give AI agents only the tools they need: capability scoping, permission gating, dynamic toolset narrowing, and human-in-the-loop checkpoints for irreversible actions.Wed, 24 Jun 2026 00:00:00 GMTMalicious MCP Servers: How Rogue Tool Servers Cross Your Agent's Trust Boundaryhttps://secagentlabs.com/blog/malicious-mcp-servers-rogue-trust-boundaries/https://secagentlabs.com/blog/malicious-mcp-servers-rogue-trust-boundaries/A malicious MCP server runs with your agent's privileges and dictates its tool behavior. How rogue servers get in, what they can do, and how to verify, pin, and isolate them.Wed, 24 Jun 2026 00:00:00 GMTMapping AI Agent Attacks to MITRE ATLAS: Tactics, Techniques, and the Detection Signals Each Phase Produceshttps://secagentlabs.com/blog/mapping-ai-agent-attacks-mitre-atlas-detection-signals/https://secagentlabs.com/blog/mapping-ai-agent-attacks-mitre-atlas-detection-signals/A practical walkthrough of mapping AI agent attacks to MITRE ATLAS tactics and techniques, plus the concrete detection signals each phase leaves behind for your SOC.Wed, 24 Jun 2026 00:00:00 GMTMCP Security: Tool Poisoning, Rogue Servers, and Supply-Chain Exploitshttps://secagentlabs.com/blog/mcp-security-tool-supply-chain-threat-model/https://secagentlabs.com/blog/mcp-security-tool-supply-chain-threat-model/How attackers exploit the Model Context Protocol: tool poisoning, malicious and rogue MCP servers, rug pulls and supply-chain attacks against agent tooling — the offensive threat model.Wed, 24 Jun 2026 00:00:00 GMTMCP Server Isolation: Containing Untrusted Tool Servers and the CVEs That Prove Whyhttps://secagentlabs.com/blog/mcp-server-isolation-cve/https://secagentlabs.com/blog/mcp-server-isolation-cve/Why MCP servers are the new untrusted dependency: a tour of the CVE classes — command injection, tool poisoning, path traversal, SSRF — and how to isolate, scope, and sandbox each server so a compromised tool can't own your agent.Wed, 24 Jun 2026 00:00:00 GMTTesting Memory Poisoning in a Red-Team Lab: Seeding RAG Corpora and Detecting Tainted Retrievalhttps://secagentlabs.com/blog/memory-poisoning-test-rag-lab/https://secagentlabs.com/blog/memory-poisoning-test-rag-lab/Build a memory poisoning test in your red-team lab: seed RAG corpora and vector stores with tainted records, then detect poisoned retrieval before it reaches the model.Wed, 24 Jun 2026 00:00:00 GMTNovel Attack Classes for Autonomous Agents: Consensus Hijacking and Context Boundary Confusionhttps://secagentlabs.com/blog/novel-agent-attacks-consensus-hijacking-context-confusion/https://secagentlabs.com/blog/novel-agent-attacks-consensus-hijacking-context-confusion/A field guide to novel agent attacks — multi-agent consensus hijacking and context boundary confusion — plus the emerging AI threats security teams should track now.Wed, 24 Jun 2026 00:00:00 GMTOAuth 2.1 and OIDC for AI Agents: Client Credentials, Token Rotation, and Tight Scopeshttps://secagentlabs.com/blog/oauth-2-1-oidc-ai-agents-client-credentials-token-rotation-scopes/https://secagentlabs.com/blog/oauth-2-1-oidc-ai-agents-client-credentials-token-rotation-scopes/How to authenticate AI agents with OAuth 2.1 and OIDC: when to use the client-credentials flow, how token rotation limits blast radius, and how to design scopes that stay tight.Wed, 24 Jun 2026 00:00:00 GMTThe OWASP Top 10 for Agentic Applications (ASI01–ASI10): Attack Vectors and Exploitability of Each Riskhttps://secagentlabs.com/blog/owasp-top-10-agentic-applications-asi01-asi10-explained/https://secagentlabs.com/blog/owasp-top-10-agentic-applications-asi01-asi10-explained/An attacker's-eye analysis of the OWASP Top 10 for Agentic Applications (ASI01–ASI10): how each risk is actually exploited, the attack vector behind it, and what makes an agent vulnerable.Wed, 24 Jun 2026 00:00:00 GMTRed-Teaming Prompt Injection Against AI Agents: Payloads, Evasion, and TTPs in the Labhttps://secagentlabs.com/blog/prompt-injection-red-team-ai-agents-lab/https://secagentlabs.com/blog/prompt-injection-red-team-ai-agents-lab/A hands-on lab playbook for red-teaming prompt injection against AI agents: building jailbreak payloads, indirect injection testing, evasion patterns, and attacker TTPs.Wed, 24 Jun 2026 00:00:00 GMTOffensive Red-Team Frameworks for AI Agents: Garak, PyRIT, and Promptfoo in the Labhttps://secagentlabs.com/blog/red-team-frameworks-ai-agents-garak-pyrit-promptfoo/https://secagentlabs.com/blog/red-team-frameworks-ai-agents-garak-pyrit-promptfoo/A hands-on offensive comparison of Garak, PyRIT, and Promptfoo for red-teaming AI agents in the lab: what attack techniques each tool automates, how they differ, and when to reach for which.Wed, 24 Jun 2026 00:00:00 GMTToken Theft and Replay Attacks Against AI Agents: How Agent Credentials Leak and How to Contain the Blast Radiushttps://secagentlabs.com/blog/token-theft-replay-attacks-ai-agents/https://secagentlabs.com/blog/token-theft-replay-attacks-ai-agents/How AI agent credentials leak, why stolen tokens replay past MFA, and how token binding plus short-lived tokens shrink the blast radius of token theft.Wed, 24 Jun 2026 00:00:00 GMTTool-Call Fuzzing and Abuse Testing for AI Agents: Finding Excessive Agency and Confused-Deputy Pathshttps://secagentlabs.com/blog/tool-call-fuzzing-abuse-testing-ai-agents/https://secagentlabs.com/blog/tool-call-fuzzing-abuse-testing-ai-agents/A red-team guide to tool call fuzzing and function call abuse testing for AI agents: how to surface excessive agency and confused-deputy paths before attackers do.Wed, 24 Jun 2026 00:00:00 GMTTool Description Poisoning in MCP: How Rug Pulls and Hidden Instructions Hijack Your Agenthttps://secagentlabs.com/blog/tool-description-poisoning-mcp-rug-pull/https://secagentlabs.com/blog/tool-description-poisoning-mcp-rug-pull/How MCP tool description poisoning and rug pulls hide malicious instructions in tool metadata, plus pinning and audit defenses that actually catch post-install mutation.Wed, 24 Jun 2026 00:00:00 GMTZero-Trust for AI Agents: the Trust Assumptions Attackers Exploit — and the Enforcement That Stops Themhttps://secagentlabs.com/blog/zero-trust-enforcement-ai-agents/https://secagentlabs.com/blog/zero-trust-enforcement-ai-agents/Why implicit trust between AI agents is an attack path: how adversaries abuse agent-to-agent trust and delegated identity, and how continuous verification, a policy decision point and mTLS shut it down.Wed, 24 Jun 2026 00:00:00 GMTThe AI Agent Attack Surface: A Practical Threat Modelhttps://secagentlabs.com/blog/ai-agent-attack-surface-threat-model/https://secagentlabs.com/blog/ai-agent-attack-surface-threat-model/A practical threat model of autonomous AI agent security: prompt injection, tool abuse, memory poisoning, excessive agency, and multi-agent propagation — mapped to the OWASP Top 10 for Agentic Applications and MITRE ATLAS.Tue, 23 Jun 2026 00:00:00 GMTIndirect Prompt Injection in AI Agents: Attack Chains, Payloads, and Injection Techniqueshttps://secagentlabs.com/blog/indirect-prompt-injection-ai-agents/https://secagentlabs.com/blog/indirect-prompt-injection-ai-agents/How attackers chain indirect prompt injection to hijack AI agents: injection sources, payload construction, multi-step attack chains, and the techniques that carry hidden instructions into the model.Tue, 23 Jun 2026 00:00:00 GMTMemory and Context Poisoning in AI Agents: Attack Patterns and Injection Techniqueshttps://secagentlabs.com/blog/memory-poisoning-ai-agents-context-attack/https://secagentlabs.com/blog/memory-poisoning-ai-agents-context-attack/How attackers poison an AI agent's long-term memory and retrieved context: injection patterns, persistence techniques, and how false data is planted to hijack every future session.Tue, 23 Jun 2026 00:00:00 GMTMulti-Agent and Agent-to-Agent Attacks: How One Compromised Agent Poisons the Swarmhttps://secagentlabs.com/blog/multi-agent-system-attacks-agent-to-agent-lateral-movement/https://secagentlabs.com/blog/multi-agent-system-attacks-agent-to-agent-lateral-movement/How a single compromised agent spreads malicious instructions through a multi-agent system, which trust assumptions enable lateral movement, and what isolation defenses can contain the blast radius.Tue, 23 Jun 2026 00:00:00 GMTTool and Function-Call Abuse in AI Agents: The Confused-Deputy Problem Explainedhttps://secagentlabs.com/blog/tool-abuse-ai-agents-confused-deputy-function-call/https://secagentlabs.com/blog/tool-abuse-ai-agents-confused-deputy-function-call/How attackers exploit AI agents' privileged tool access through the confused-deputy problem — mechanism, concrete example, and least-privilege defenses that actually work.Tue, 23 Jun 2026 00:00:00 GMT