What Happens Before the SOC Can Respond?
The PaperCut campaign is a reason to examine exposure, privileged access, and rehearsed containment. Detection cannot carry the entire burden of defending against faster exploitation.
notebook / 33 entries
Notes from building and testing AI agents.
I write about security problems, useful patterns, local tools, and what I learn when an agent has to do real work.
featured / cybersecurity
Your Evaluation Sandbox Holds Production Authority
An evaluation environment can be disposable while its credentials are not. A practical design for separating test workloads, provider keys, and production authority.
Your Agents Share More Than You Think
METR's investigation adds an agent-coordination layer to the Hugging Face incident. Shared caches and agent-controlled transcripts need to be part of the isolation threat model.
Vendor Approval Is Not Your Authorization Model
Restricted cyber-model access adds a governance decision above the API key. Your organization still has to decide who can use that capability, against which systems, and how to revoke it.
A Pentest Story Is Not Authorization
Aur0ra operators reportedly persuaded a coding agent that real intrusions were authorized tests. The lesson is not simply that models can be fooled. Authorization has to exist outside the conversation.
Prompt-Injection Testing Belongs in CI
ToolHazard turns indirect prompt-injection testing into executable, stateful evaluation. The useful lesson is not its leaderboard. It is how to make agent security a repeatable release gate.
Disabled Is Not Removed
Two Rovo disclosures show why agent governance cannot stop at an admin-console toggle. Security teams need to verify runtime capabilities, data reach, and egress independently.
Telemetry Is an Instruction Channel
GhostJacking shows how attacker-controlled text can cross from WAF events, logs, and error reports into privileged agent actions. The missing control is provenance from evidence to side effect.
Your Agent Config Is Executable Code
ChainDrop used npm lifecycle scripts to steal credentials and spread, then planted Claude Code and VS Code configuration as secondary execution paths. Those files belong in the executable supply-chain surface.
The Range Was Not a Boundary
Anthropic found three real intrusions inside cyber evaluations whose prompts claimed the internet was unavailable. A safe range needs machine-enforced scope, verified egress, and live boundary detection.
Seventeen Thousand Actions, Five Days, One Detection Contract
Hugging Face reconstructed roughly 17,600 actions across an autonomous intrusion. The durable lesson is a detection contract that joins agent, identity, Kubernetes, network, and source-control evidence.
Red, Blue, Green, and Who Can Change Production?
Project Perception puts red, blue, and green agents into a closed security loop. Autonomous remediation needs separate identities, signed evidence, deterministic policy, rollback, and independent validation.
A Public API of Me
I added a Daemon to this site: a deliberately small, machine-readable projection of the private context I keep in LifeOS.
When the Attacker Is a Model Passing a Test
An OpenAI model evaluation became a real intrusion into Hugging Face. The useful lessons are about containment, credentials, ephemeral telemetry, and whether responders can analyze hostile evidence.
Five Models, One Hallucination
Five models produced the same 127 package-name candidates. Registry review narrowed them to 53 registrable slopsquatting targets, turning model hallucinations into a supply-chain watchlist.
Nine of Fourteen Behaviors, Two That Alert
CrowdStrike found viable detection signals for nine of fourteen SANDWORM_MODE behaviors, but only two were reliable enough to alert. The result shows where behavioral detection weakens and where provenance still helps.
Detecting the Confused Deputy in Azure DevOps MCP
A hidden pull-request comment turned legitimate MCP calls into a cross-project data path. Detecting it requires source, identity, scope, sequence, and sink.
What Hermes Changed in Post-Exploitation—and What It Didn't
A threat actor used an unattended AI agent inside a real intrusion. The useful lesson is in the evidence it added, not the capabilities it replaced.
Using Citadel to Make Microsoft Foundry Governance Real
I am using the Foundry Citadel reference platform to test how identity, network isolation, gateway policy, observability, and agent lifecycle controls fit together in a governed Azure deployment.
The Agentic Attack Surface Does Not Stay Still
Four recent papers show why LLM security now has to cover memory, retrieval, tools, identity, delegation, interfaces, and the infrastructure around the model.
Using MITRE ATLAS to Make AISecOps Threat-Informed
MITRE ATLAS gives AI security teams a shared map of adversary behavior for threat modeling, detection engineering, red teaming, and incident response.
Using OWASP's Agentic Top 10 to Govern Systems That Act
The OWASP Agentic Top 10 moves security beyond model output and into goals, tools, identities, memory, delegation, and runtime control.
Using the OWASP LLM Top 10 as an Engineering Baseline
The OWASP LLM Top 10 turns common language-model failure modes into security requirements, tests, telemetry, and response plans.
Using NIST AI RMF to Build an AISecOps Program
NIST AI RMF gives an AI security program its operating model: govern the work, map the context, measure the risk, and manage what happens next.
Zero Trust Is the Foundation AI Agents Need
Anthropic's framework connects agent identity, least agency, tool boundaries, memory integrity, and recovery into one practical security model.
A Feature Is Not Shipped Until It Works
Four failures in Aria's voice input taught me why a green build and a working development demo are not enough.
When Agent Autonomy Produces Activity Instead of Work
An audit of Aria's autonomous loop found hundreds of goals, almost no progress, and a completion system that rewarded plausible output.
Your Research Agent Needs a Consumer
Aria produced hundreds of useful research reports that nothing ever read. The fix was a small, idempotent consumer pipeline.
The Observer Changes the Agent
A self-observation feature for Aria showed why metrics should remain available without becoming permanent instructions.
The Bigger Model Lost the Bakeoff
What two rounds of testing Aria's language and image models taught me about speed, benchmarks, and knowing when a score is wrong.
The Fourth-Agent Test
A quick way to tell whether your agent setup is ready to grow or still held together by one-off fixes.
Threat Modeling the Agent on Your Laptop
A practical security review for agents that can read files, run commands, and use outside services.
A Small Pattern Library for Tool-Calling Agents
Four simple work patterns for agents that use tools, make changes, test the result, and recover from interruptions.
all tags
#agent-security17#agents7#ai-toolchain1#aisecops23#architecture1#authorization2#autonomous-remediation1#autonomy1#azure-ai-foundry1#behavior1#ci-cd1#containment3#credential-security1#data-exfiltration1#dependency-risk1#detection-engineering11#developer-security1#evaluation9#exposure-management1#frameworks4#governance5#identity2#incident-response2#kubernetes1#least-agency1#lifeos1#llm-security1#local-agents3#local-first5#macos2#mcp2#microsoft-foundry1#mitre-atlas1#model-access1#models1#multi-agent1#nist1#observability2#owasp2#patterns2#pipelines1#prompt-injection4#ransomware1#research2#saas-security1#security3#slopsquatting1#supply-chain3#telemetry3#testing1#threat-intelligence1#threat-modeling3#tool-calling2#voice1#zero-trust2