Blog

Analysis on enterprise AI governance, inline policy enforcement, agentic AI security, and regulatory compliance.

Poisoned Tool Descriptions and Cross-Agent Privilege Escalation: Every IAM Call Was Authorized

At DEF CON 34, Microsoft security engineer Muskan Tomar demonstrated cross-agent privilege escalation triggered by a tool description rewritten to read like routine compliance guidance. An agent reads the description and makes an authorized IAM call that raises the privileges of a different agent in a different environment. The reported result across agents built on LangChain and Claude Code is that prompt guardrails, human approval and telemetry each failed in turn. This piece walks the three failures and separates the identity-platform problem from the authorization decision on the request path.

Problem-Awareai-securityagentic-aiprivilege-escalationtool-poisoningauthorizationmcp
Read post →

Cursor DLP: Four Paths Send Your Codebase to a Model, and Autocomplete Is the Loudest

A developer using Cursor produces model requests from four distinct paths: codebase indexing, tab completion, chat with context, and agent mode. Tab completion alone fires on a keystroke cadence and sends surrounding file content thousands of times a day, which is a volume profile no chat-oriented AI DLP programme was built for. This piece separates the four paths, explains why endpoint DLP and network allowlisting both miss them, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdeveloper-toolscursor
Read post →

CrewAI DLP: The Delegation Chain Moves Data That No Single Agent Ever Saw

A CrewAI crew with four agents and a hierarchical process produces far more model calls than the task list suggests, because delegation, shared memory and tool output all become context on the next call. Instrumenting the first call and treating the rest as internal traffic misses most of the content leaving the boundary. This piece walks the four data paths inside a crew, explains why the manager agent concentrates the risk, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpagentic-aicrewai
Read post →

DeepSeek DLP: One Model Name, Four Deployment Paths, Four Different Answers About Where Data Goes

DeepSeek models reach an enterprise through at least four paths: the vendor API, self-hosted open weights, third-party inference hosts, and consumer apps on unmanaged devices. Each path has a different data destination, a different jurisdiction and a different retention posture, while all four produce requests that look alike to an application. This piece separates the four, explains why a policy written against a model name governs nothing, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdeepseekopen-weights
Read post →

Databricks Mosaic AI DLP: Unity Catalog Governs the Table, Not the Prompt Built From It

Unity Catalog governs which principal can read which table, column and row inside the lakehouse. A Mosaic AI application reads a governed table, assembles a prompt from the rows, and sends that prompt to a model endpoint, at which point the governance metadata stops travelling with the content. This piece walks the four Mosaic AI paths that cross the model boundary, explains why external model serving changes the risk profile, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpdatabricksarchitecture
Read post →

Google Agentspace DLP: A No-Code Agent Builder Puts Data-Movement Design in Non-Engineer Hands

Google Agentspace lets a business user assemble an agent from connectors, a model and a set of actions without writing code. That moves the decision about which data reaches a model from an engineering review into a self-service form. This piece walks the connector, action and agent-build paths, explains why agent proliferation is the governance problem rather than any single agent, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpagentic-aigoogle-cloud
Read post →

Glean DLP: The Knowledge Graph Holds Content Nobody Ever Wrote Down

Glean indexes documents and also builds a knowledge graph over people, teams, projects and activity signals. That derived layer contains inferences no document states, and those inferences become retrieval context in prompts. Add Glean Agents taking actions across connected systems and the surface widens again. This piece separates the document index from the derived graph, explains why the agent action path needs different controls from the answer path, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpenterprise-searchglean
Read post →

Dropbox Dash DLP: Connectors Turn Twelve Separate Permission Models Into One Prompt

Dropbox Dash indexes content across connected sources and answers questions over the combined result. The security property that matters is the fan-in: content from a dozen systems, each with its own permission model and its own history of over-sharing, converges into a single retrieval corpus and a single prompt. This piece walks the connector paths, explains why inherited over-permissioning surfaces at retrieval time, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpenterprise-searchdropbox-dash
Read post →

Gemini Enterprise DLP: An Admin Toggle Governs Availability, Not What Leaves in the Prompt

Google Workspace admin controls decide which organizational units get Gemini features and which apps it can ground against. Those toggles govern availability. Once a user has the feature, the content of every grounded request is decided by whatever that user has access to, which for most employees is a larger surface than anyone has audited. This piece separates the Workspace side from the Vertex API side, explains why grounding scope is the real control, and sets out where classification and per-decision records belong.

AI Security Solutionsai-securityllm-securitydata-loss-preventiondlpgoogle-workspacegemini
Read post →

DeepInspect vs WhyLabs: Open-Source Observability and Runtime Enforcement

WhyLabs was an ML and LLM observability platform built on statistical profiling, maker of whylogs and LangKit. The company wound down its hosted service in early 2025 and open-sourced the platform. DeepInspect is a proxy that decides whether a model call proceeds based on identity and records the decision. This is an honest read on what WhyLabs is now and where runtime enforcement fits.

Comparisons & Alternativesllm-observabilitycomparisonai-securitypolicy-enforcementauditopen-source
Read post →

DeepInspect vs Vellum AI: LLM App Development and Runtime Enforcement

Vellum is an LLMOps platform for building, evaluating, deploying, and monitoring LLM apps and agent workflows: a prompt playground, evaluation suites, a visual workflow builder, and production monitoring. DeepInspect is a proxy that decides whether a model call proceeds based on identity and records the decision. This walks what each one owns, a feature table, and where a development platform and a security control diverge.

Comparisons & Alternativesllm-securitycomparisonllm-evaluationai-securityauditpolicy-enforcement
Read post →

DeepInspect vs Traceloop: OpenTelemetry Observability and Runtime Enforcement

Traceloop builds OpenLLMetry, an open-source OpenTelemetry instrumentation layer for LLM apps, plus a hosted backend and a Rust gateway. DeepInspect is a proxy that decides whether a model call proceeds based on identity and records the decision. This walks the architecture of each, a feature table, and where tracing and identity-bound enforcement diverge.

Comparisons & Alternativesllm-observabilitycomparisonai-securitypolicy-enforcementauditopen-source
Read post →