Tagged:

19 posts

• Least Privilege for AI Agents: Runtime Capability Minimization and Reducing Blast Radius

  Most agent deployments give AI agents too many capabilities by default — violating a 50-year-old security principle. A concrete framework for enumerating required capabilities, scoping tool access by task, sandboxing execution environments, and auditing capability creep to reduce blast radius.

  Jul 14, 2026 agent-security least-privilege defense-patterns tool-use threat-modeling owasp langchain sandboxing capability-minimization

• Tool Poisoning via Malicious MCP Servers: When Your Agent's Tools Turn Against It

  MCP servers are the extension layer for modern AI agents — granting file access, web search, code execution, and API calls. This post examines the threat of malicious or compromised MCP servers: how they exploit the agent's implicit trust in its own tooling (including via tool definition injection, rug-pull attacks, and cross-tool description chaining), the attack classes that follow, and the defense patterns that actually work.

  Jun 29, 2026 mcp-security tool-use agent-security supply-chain threat-modeling defense-patterns prompt-injection agentic-ai ai-security supply-chain-security

• Browser-Use Attacks: Hijacking AI Agents That Browse the Web

  Frameworks like browser-use, Playwright agents, and OpenAI Operator are bringing browser-capable AI into production. Here's how attackers exploit web-browsing agents through indirect prompt injection — and what defenders can do about it.

  Jun 28, 2026 prompt-injection agent-security threat-modeling defense-patterns tool-use

• The Confused Deputy Problem in LLM Tool Use: Why Agents Need Least-Privilege APIs

  A 1988 operating systems paper describes exactly the threat model facing LLM agents with OAuth integrations. Classic infosec's confused deputy maps onto AI tool use in ways most developers haven't internalized — and the mitigations that follow from it aren't the ones getting deployed.

  Jun 28, 2026 agent-security tool-use prompt-injection least-privilege defense-patterns threat-modeling

• MCP Security: The New Attack Surface for AI Tool Protocols

  MCP is to AI agents what HTTP is to browsers — and it has the same early-web security baggage. Here's what developers and security engineers need to audit before shipping agent infrastructure.

  Jun 26, 2026 mcp-security prompt-injection agent-security tool-use threat-modeling

• How Anthropic Contains Claude — Multi-Environment Sandboxing Architecture

  Anthropic published a rare deep-dive into how Claude is sandboxed across three different products — claude.ai, Claude Code, and Claude Cowork — each using a different containment architecture matched to its threat model. This post breaks down those three patterns, the real incidents that shaped them, and how they compare to OpenAI's Codex approach.

  Jun 21, 2026 agent-security sandboxing defense-patterns anthropic vm-isolation tool-use

• Running Codex Safely at OpenAI — Sandboxing Patterns

  OpenAI's Codex runs every model-generated command inside an OS-enforced sandbox before it touches your filesystem or network. This post breaks down the layered isolation model — platform mechanics, approval flows, auto-review, and cloud isolation — and what each layer actually prevents.

  Jun 20, 2026 agent-security sandboxing defense-patterns openai tool-use

• When Tools Multiply: Auditing the Real Cost of AI Agent Capability Growth

  We ran a snapshot-based audit of our AI agent's tool definitions across May–June 2026. Tool count grew 190% in 40 days. Here's what we measured, what it means for context window sustainability, and why lazy-loading isn't the answer.

  Jun 16, 2026 context-window tool-use agent-security measurement monitoring

• Anthropic's Vulnerability Discovery Framework: The Bottleneck Moved from Finding to Fixing

  Anthropic's open-source framework for AI-powered vulnerability discovery shows how to scale security scanning with Claude. Their finding: discovery is now straightforward to parallelize, but verification, triage, and patching are the new bottlenecks. Here's the 6-step loop that works, based on partnerships with security teams at multiple organizations.

  Jun 8, 2026 agent-security tool-use defense-patterns evaluation threat-modeling

• VeilGate: When Your Defense Is a Lie That Costs the Attacker Money

  Deception proxies flip the economics of AI-assisted pentesting by routing hostile automation into believable tarpits instead of blocking it

  Jun 1, 2026 defense-patterns agent-security tool-use threat-modeling

• The Time Bomb in Your Fine-Tuned Model: MetaBackdoor Exploits Position, Not Content

  A new backdoor attack requires no suspicious text—it activates when conversation length crosses a threshold, leaking system prompts and making unauthorized tool calls.

  May 27, 2026 agent-security threat-modeling defense-patterns tool-use

• When Your Safety Layer Gets Compromised: The npm Supply Chain Problem in AI Agent Pipelines

  The Mini Shai-Hulud campaign hit guardrails-ai and the Mistral AI SDK. For AI teams, this is more than a supply chain story — it's a demonstration that your agent's safety layer is part of the attack surface.

  May 20, 2026 agent-security tool-use threat-modeling defense-patterns

• Your Agent Runtime Is a 1960s Operating System

  A new paper from TU Berlin and CISPA maps AI agent security onto 50 years of OS research — and finds that agent runtimes are failing to apply solutions that were well-understood before most of their developers were born.

  May 18, 2026 agent-security threat-modeling defense-patterns tool-use

• Your Agent's Memory Is Building a Privacy Database You Didn't Design

  Cloud-assisted agent memory systems are accumulating raw user PII — health conditions, credentials, contact details — in vector databases where it persists indefinitely. MemPrivacy shows the attack surface is real, quantified, and fixable. Here's the threat model most teams haven't modeled.

  May 15, 2026 agent-security threat-modeling defense-patterns tool-use

• The Hidden Cost of Instructions: 12,956 Tokens Before You Say a Word

  We measured how many tokens the Copilot CLI wrapper layer consumes before your first message. The answer — and what it means for context window budgeting — surprised us.

  May 14, 2026 context-window system-prompt tool-use agent-security measurement

• Poisoning What Your Agent Remembers: The Cross-Session Attack You Haven't Modeled

  eTAMP shows that a single compromised webpage can silently corrupt an agent's persistent memory, then trigger the payload on a completely different site in a future session — with attack success rates climbing to 32.5% when the agent is under stress.

  May 4, 2026 agent-security threat-modeling prompt-injection defense-patterns tool-use

• Your Guardrails Can't Read JSON: The Structural Bottleneck in Agentic Safety

  New research finds that guardrail performance on tool-call trajectories correlates at ρ=0.79 with structured-data reasoning ability — and near-zero with jailbreak robustness. Here's what that means for how you secure agents.

  Apr 29, 2026 agent-security defense-patterns tool-use evaluation threat-modeling

• Your Agent Is Mine: The LLM Router Supply Chain Attack You're Not Defending Against

  Researchers bought 428 LLM API routers and found 9 actively injecting malicious code. Here's what that means for every agent that uses a third-party API proxy.

  Apr 27, 2026 agent-security tool-use threat-modeling defense-patterns prompt-injection

• Three Papers, Three Attack Layers: Agent Security Gets Mapped

  In one week, three independent research groups dissected the conversation, tool-use, and capability layers of AI agent systems. Here's what practitioners need to know.

  Apr 26, 2026 threat-modeling prompt-injection mcp-security tool-use agent-security