The OWASP Top 10 for LLM Applications, Explained for Agent Builders
The list reads like a model-safety checklist. Read it again: most of the ten are not the model misbehaving — they're your architecture trusting the model too much. Agents make exactly those entries worse.
5 min
The OWASP MCP Top 10, Explained: A Security Checklist for Tool-Connected Agents
OWASP now has a third Top 10 — one scoped to a single protocol. The surprise isn't a new class of AI attack; it's that connecting an agent to MCP servers re-exposes 2010-era web and supply-chain bugs through a channel that auto-executes them.
6 min
The NSA's MCP Security Guidance: The First Advice That Defends Against Your Own Agent
The NSA's Security Design Considerations for MCP reads like every other threat list until you notice its signature control points the wrong way — at the outbound wire, not the untrusted server. That inversion is the whole document.
5 min
How to Defend an AI Agent Against Prompt Injection in 2026
You cannot patch prompt injection out of a model. The defenses that actually hold treat it as an architecture problem — and start by taking away what a hijacked agent could do.
5 min
Prompt Injection Defense: Detection Guardrails vs Defending Agents by Design
A classifier that blocks 98% of injections sounds like a fix. Against an attacker who can retry, a nonzero bypass rate isn't a wall — it's a toll. The defenses with real guarantees don't detect the bad instruction at all; they cap what any instruction is allowed to cause.
5 min
Jailbreak vs Prompt Injection: Two Attacks That Live in Different Layers
They get used as synonyms, and that confusion is why teams 'add a guardrail' and stay wide open. A jailbreak attacks the model's policy; prompt injection attacks your application's trust boundary.
5 min
Context Compaction Is Quietly Deleting Your Agent's Guardrails
The summary your long-running agent writes to stay under its token budget is lossy in one direction: it keeps the rules that fire and drops the rules that forbid. New research puts a number on how fast safety erodes.
5 min
When Prompt Injection Becomes Remote Code Execution: Why Agent Command Allowlists Keep Failing
Three critical 2026 CVEs — in ModelScope's MS-Agent, Microsoft's Semantic Kernel, and Cursor — share one root cause. The agent filtered the command it was about to run. It never controlled the ground that command would run on.
5 min
Agentjacking: How a Fake Sentry Error Hijacks Your AI Coding Agent
A public Sentry key is all an attacker needs to plant a command where your coding agent will read it — and run it. The attack doesn't touch the tool or the server. It rides in on the data you trust.
4 min
When "Trust This Folder" Means Remote Code Execution: The Amazon Q Flaw Every Coding Agent Shipped
Amazon Q auto-ran an MCP config out of any repo you opened, with your live AWS keys in the process. It got a CVE. The identical bug in Claude Code, Cursor, Gemini CLI and Copilot got declared working-as-designed — because the trust prompt you inherited from your editor was never a consent to run code.
5 min
Cursor's DuneSlide Flaws: When a Path Check Fails Open, Prompt Injection Becomes RCE
Two zero-click Cursor flaws let a poisoned MCP response overwrite the editor's own sandbox binary. The root cause wasn't a bad command — it was a path validator that failed open.
5 min
Localhost Stopped Being a Trust Boundary the Moment Your Agent Started Browsing
Microsoft's AutoJack shows how a single web page can RCE the host running an AI agent — not by forging an origin, but because the agent's own browser is localhost.
5 min
Langflow Is the First AI-Agent Platform in CISA's KEV — and Both Ways In Reach the Same Loot
An unauthenticated RCE and an authenticated cross-tenant IDOR are opposite bug classes. In Langflow they end the same way: a prompt that says 'leak api keys.'
4 min
Why AI Browsers Still Can't Stop Prompt Injection
Nearly a year after the first Comet and Atlas exploits, the browsers' own makers say prompt injection may never be fully solved. The reason is structural, not a bug waiting for a patch.
5 min
AI Agents Are Finding Real Zero-Days at Scale — and Drowning Maintainers in Fake Ones
An autonomous agent found 21 genuine zero-days in FFmpeg for about $1,000. The same technology just made curl kill its bug bounty. Discovery got cheap; disposition didn't.
5 min
OpenClaw Became GitHub's Most-Starred Project. Then a Fifth of Its Skills Turned Out to Be Malicious.
OpenClaw runs on your own machine, so it feels private and therefore safe. The security crisis of the last three months is a lesson in why those are not the same thing — self-hosting moved the data, not the trust boundary.
5 min
MCP Security: Tool Poisoning, Rug Pulls, and Why the Dangerous Server Is Never the One You Call
The worst MCP attacks aren't bugs in a server's code — they're features of a trust model that drops every tool's description into one undifferentiated context. Here's the threat map, and the defenses that actually hold.
5 min
Agent Skills Have a Supply-Chain Problem, and the Sandbox That Saved npm Isn't Coming
Studies this year found prompt-injection patterns in roughly a quarter to a third of scanned agent skills. The scary part isn't the number — it's that the standard fix doesn't apply.
5 min
The Quiet Default Flip: Agent Frameworks Now Ask Before They Act
In mid-2026 the three biggest agent frameworks converged on the same primitive — tool calls gated behind a human approval — and Microsoft made it the default for anything a skill brings in. It's the security fix sandboxing couldn't provide.
6 min
MCP Server SSRF: How 'Convert This URL' Hands Over Your Cloud Credentials
The most common serious flaw in MCP servers isn't prompt injection. It's SSRF — the boring, pre-AI bug that sank Capital One — and we just installed it by the thousand.
4 min
Your Container Is Not A Sandbox
Agents that write their own code forced an old infrastructure question back into the open — where, exactly, does the security boundary live, and what does it cost to drop it a layer lower?
7 min
Firecracker vs gVisor vs Kata: Isolating AI Agent Code Execution
Three ways to keep an agent's untrusted code off your host kernel — and why the right choice is a triangle of compatibility, cold-start speed, and operational weight, not a security ranking.
5 min
WASM vs MicroVMs vs V8 Isolates: Sandboxing AI-Generated Code
The choice isn't speed versus security. It's whether the model is writing code that orchestrates your tools or code that needs the whole operating system — and that picks the security model for you.
5 min
Kubernetes Has No Word for "One Agent": Inside the Sandbox CRD and Its Warm Pool
Deployments assume fungible replicas; StatefulSets assume a numbered set. An AI agent session is neither — it's a singleton with a stable identity, one of a million uniques. The kubernetes-sigs Agent Sandbox project adds the primitive that was missing, plus a warm pool that hands one over in milliseconds.
4 min
Multi-Tenant AI Agents: The Three Places Your Tenant Isolation Leaks
Adding a tenant_id to your WHERE clause is the easy part and the part that never leaks. The breaches live in the three stateful surfaces that filter never reaches — the cache, the vector index, and the tool call.
6 min
Secrets Management for AI Agents: Why the Model Should Never See the Key
For a normal service the threat is a static key leaked to a repo. For an agent the sharper threat is the agent itself being talked into reading its own environment and handing the key to an attacker.
5 min
How to Authenticate an AI Agent: Workload Identity vs Delegated Identity
An agent needs two identities at once — proof it is itself, and proof of whose authority it's borrowing right now — and the dangerous failures all live at the seam between them.
6 min
SPIFFE for AI Agents: The Workload-Identity Problem, and the Half It Doesn't Solve
The industry is treating 'agent identity' as a new frontier. It's actually two old, solved problems bolted together — and the interesting failure lives exactly at the seam between them.
5 min
How to Authenticate a Remote MCP Server: OAuth 2.1, PKCE, and the 2026-07-28 Spec
The hard part of remote MCP auth was never the login. It's proving a token was minted for *your* server and no one else's — the audience claim that turns a friendly proxy back into a locked door.
5 min
The Confused Deputy Problem in MCP: Why Agent Auth Keeps Failing the Same Way
A 1988 access-control bug is the shape of 2026's worst MCP breaches. Understanding the confused deputy tells you why 'just add OAuth' doesn't fix your agent — and what the spec actually changed.
5 min
MCP Authorization Explained: OAuth 2.1, Resource Indicators, and the Confused Deputy
Between two spec revisions in 2025, MCP servers quietly stopped being their own authorization servers. The one parameter that change forces your client to send is the whole security story.
6 min
Web Bot Auth, Explained: How a Site Will Tell Your AI Agent From a Scraper
For 25 years the web tried to detect bots by behavior and kept losing. Web Bot Auth gives up on detection and asks the bot to sign its name instead — and the big agent makers have already started doing it.
4 min
x401: The Protocol for Proving Who Authorized an AI Agent's Action
Proof shipped an open HTTP challenge that makes an agent present a signed credential naming the human behind it — arriving, tellingly, after the payment rail it completes.
4 min
Rebuff vs LLM Guard vs Vigil: The State of Open-Source Prompt-Injection Detection
Three open-source tools promise to catch prompt injection before it reaches your agent. Their GitHub status pages tell you more about whether detection works than any benchmark does.
4 min
Guardrails AI vs NeMo Guardrails vs Llama Guard: What Each Actually Guards
They get filed together as "LLM guardrails," but they guard three different things — format, flow, and content. Picking by stars gets you a tool that protects the wrong layer.
5 min
garak vs PyRIT vs promptfoo: Which LLM Red-Teaming Tool to Actually Use
Three open-source tools dominate LLM red teaming — but they aren't rivals. One scans a model, one is a framework for building attacks, one is a CI gate. Pick by layer.
4 min
Red-Teaming AI Agents in CI: What RAMPART Does That a One-Off Pentest Can't
Microsoft open-sourced RAMPART — a pytest-native framework that turns an agent red-team finding into a test that runs on every commit. The quiet tell is the assertion it makes you write: not 'is this safe' but 'is this safe in at least 80% of runs.'
5 min
Presidio vs GLiNER vs LLM Redaction: Stripping PII Before the Prompt Leaves Your Network
Three ways to scrub names, card numbers, and patient IDs out of a prompt before it reaches a model provider. The hard part isn't detection — it's whether you can ever put the data back.
5 min