Posts tagged "security"
Does a classifier model always make sense? Deciding what an agent may do
Classifier models can route requests and judge agent actions, but they cost money and make mistakes. When rules are better, when a classifier helps, and how autonomy levels fit.
Treat agents like insiders: what misalignment research means for operations
AI insider threat: research on agentic misalignment suggests insider-risk controls for agents, such as separation of duties, limited access and monitoring.
The agent security checklist: twenty questions before production
AI agent security checklist: twenty yes/no questions on identity, permissions, data flow, injection, sandboxing, supply chain and audit, each with a link.
Prompt injection testing: check your agents against hijacking
Prompt injection testing pairs a legitimate task with an injected one and checks both outcomes. Build suites for your own tools and keep containment in place.
Code execution agents or direct tool calls? Trade-offs for builders
Code execution agents can cut token use sharply by filtering data in a sandbox, but need isolation. Compared with direct tool calls on cost, safety and audit.
Reading the OWASP Top 10 for Agentic Applications as a platform team
How a platform team can turn the OWASP agentic top 10 and related LLM Top 10 entries into controls: least privilege, sandboxing, approvals and audit.
Air-gapped agents: a checklist for running without the internet
Air-gapped AI means no downloads at run time. A checklist of what to vendor, pin and verify, and how to update agents through a reviewed import path.
AI agent sandboxing: filesystem and network isolation together
AI agent sandboxing works only when file access and network egress are both limited. Why one boundary is not enough and how allow-lists cut approvals.
Ops series: AI incident response when the actor is an agent
AI incident response keeps the classic phases but needs a kill switch, tool revocation and policy freeze in seconds. A playbook for agent incidents.
Draw the data flow before you write the first prompt
An agent data flow diagram shows where untrusted data enters, where private data lives and where anything leaves. One-page template for trifecta risks.
MCP authorization: OAuth 2.1, audiences and why passthrough is forbidden
MCP authorization builds on OAuth 2.1, protected resource metadata and resource indicators. How the flow works and why token passthrough is forbidden.
Design patterns against prompt injection that do not rely on the model
Prompt injection design patterns like plan-then-execute, dual LLM and capability tracking limit what an attack can change by structure, not by detection.
Tool poisoning: when the tool description is the attack
MCP tool poisoning hides instructions in tool descriptions that the model reads and users rarely see. How the attack works and how pinning and review limit it.
Third-party skills are supply chain: an agent skill security checklist
Agent skill security starts with treating third-party skills as dependencies. A checklist for provenance, pinning, full review and least privilege.
Ops series: secrets for agents never belong in the context window
Secrets management for AI agents in practice: keep credentials on the tool side, give the model only handles, and never pass user tokens through to downstream APIs.
Indirect prompt injection: when the data gives the orders
Indirect prompt injection hides instructions in tickets, pages and tool results. Why filters fail and how to limit the blast radius by design.
Ops series: identity for agents, or who is acting on whose behalf
AI agent identity: each agent needs its own identity plus a record of whom it acts for. Delegation vs impersonation, audience-bound tokens, no shared API keys.
The lethal trifecta: private data, untrusted content and a way out
The lethal trifecta in AI agents: private data, untrusted content and external communication together. How to break the triangle per agent, not trust the model.
Dark software factory: only for MVPs and PoCs
Letting agents build software with minimal human touch can be a fast way to a prototype. open-agentix offers it as an opt-in mode with a fixed notice, and keeps approval gates for production.
A model may ask, the policy decides: deterministic gates and tamper-evident audit
In open-agentix a model can request a tool call but never authorises it. A deterministic policy gate decides before each call, and a hash-chained audit trail records what it decided.
Least privilege for agents: decomposition instead of one all-powerful agent
One agent with read and write access to everything is a large blast radius. open-agentix splits a process into small agents that each hold only the tools one step needs.