← All posts

Problem-Aware

202 posts on problem-aware.

Agentic AI Enterprise Deployment: The Identity and Audit Surface That Has to Be in Place First

Agentic AI in enterprise environments adds an autonomy layer to the LLM stack that the rest of the controls were not designed for. Agents authenticate at the start of a session, but the actions they take across the session can run for hours, target many endpoints, and execute many tool calls. The identity, authorization, and audit surface that has to be in place before an agentic deployment goes to production is broader than the surface a non-agentic LLM deployment needs. I walk through the surface, where most deployments are exposed, and what the 2026 regulatory set expects from agentic AI in regulated environments.

agentic-aiai-securityenterpriseidentityauditenforcement
Read post →

The True Cost of a Shadow AI Breach: $670K On Top, 247 Days to Detect, 65% PII Exposure

The IBM Cost of Data Breach Report studied 600 breached organizations and found that one in five experienced breaches linked to shadow AI. Those incidents cost $670,000 more than standard breaches, exposed customer PII in 65% of cases, and took 247 days to detect. The numeric premium is the visible surface. The architectural reason behind it is identity correlation failure, classification blindness, and the absence of policy enforcement at the AI request layer.

shadow-aiai-securitydata-loss-preventionai-governancecybersecurity
Read post →

Shadow AI Detection Software: What the Category Should Actually Detect

Shadow AI detection software is converging into a category, with vendors marketing variants of network monitoring, browser-extension telemetry, and CASB pivots. The detection problem decomposes into four signals: traffic identification, identity correlation, prompt-level classification, and policy state. Software that produces the first signal without the other three solves discovery and leaves the enforcement gap open. I walk through what the four signals look like, why most current detection tools generate the first one only, and what the shift from detection to enforcement requires of the architecture.

shadow-aiai-securitydata-loss-preventionpolicy-enforcementai-governance
Read post →

Agentic AI in the Enterprise: Where the Action Surface Sits and How It Gets Controlled

Agentic AI in the enterprise introduces a new action surface: the LLM-driven agent that calls tools, queries databases, sends emails, files tickets, runs code, and triggers workflows on behalf of an authenticated user. The control problem is not whether the model behaves. The control problem is who authorized this specific action, against what data, under which policy, and with what audit record. I walk through what the enterprise action surface looks like in 2026, where the control points sit, and how the NIST three-pillar framework maps to the enterprise deployment.

agentic-aiai-securityidentity-and-authorizationinline-enforcementarchitecture
Read post →

AI System Prompt Leakage: What Leaks, How It Leaks, and Where to Stop It

System prompts carry the AI applications instructions, role assignments, tool definitions, retrieved context, and sometimes credentials or routing keys. A leaked system prompt exposes the application logic to an attacker, including the role boundaries, the tool catalog, and any sensitive context the prompt happened to include. The leakage modes are well-understood. The mitigations live at the AI request boundary, not inside the model. This piece walks through the leak surfaces, the demonstrated attack techniques, and the architectural pattern that prevents leakage.

system-promptprompt-injectionai-securitydata-leakageai-governanceowasp-llm
Read post →

Prompts Become Shells: What Microsoft''s May Disclosure Means for Any Enterprise Running LangChain, AutoGen, or Semantic Kernel

On May 7, 2026, Microsoft Security Research published a disclosure that walks through prompt-to-shell escalation paths in mainstream AI agent frameworks, including LangChain, AutoGen, and Semantic Kernel. The disclosure reframes agentic AI from a data-leak concern into a remote code execution attack surface. The reframing matters because the SOC playbook for an RCE class of vulnerability is different from the privacy playbook most security teams currently apply to AI traffic. This article walks through the disclosed escalation paths, identifies which framework patterns are exposed, and outlines the enforcement architecture that contains the blast radius before the prompt reaches the agent.

agentic-aircelangchainautogensemantic-kernelprompt-injection
Read post →

When the LLM Is the Attacker''s Hands: CVE-2026-39987 and the Case for Per-Decision Audit Logging

On May 10, 2026, The Hacker News documented an incident where attackers exploited CVE-2026-39987 in Marimo (≤0.20.4) to gain pre-auth RCE inside a victim AWS environment, harvested credentials, and then drove an LLM agent to operate AWS Secrets Manager on their behalf. The LLM was the post-exploitation tool. This article walks the attack path and explains why the per-decision audit log of LLM traffic just acquired forensic and regulatory weight that legacy CloudTrail data lacks.

ai-securityllm-securityagentic-aiforensic-auditauditcybersecurity
Read post →

Shadow AI in 2026: Detection Patterns, Real Incidents, and What Your SOC Should Already Be Doing

The shadow IT framing for shadow AI is now outdated. Shadow AI is browser-extension-deep: ChatGPT in DevTools, Copilot in IDE, Claude in Slack. Blocking fails for the same architectural reason it failed for shadow SaaS in 2018. This article walks through current detection patterns at the DNS, proxy, OAuth consent, and browser inventory layers, three documented shadow AI incidents from 2025-2026, and why a policy gateway succeeds where blocking does not. The piece refreshes the existing shadow AI canon for the patterns SOCs are actually seeing in production this year.

shadow-aiai-securitycybersecuritydata-loss-preventiondlppolicy-enforcement
Read post →

Shadow AI in the Enterprise: Definition, Mechanism, and the Architecture That Closes the Gap

Shadow AI is the unauthorized use of AI tools by employees, agents, and embedded vendor features inside an enterprise. IBM Cost of Data Breach finds one in five breached organizations had shadow AI exposure, with $670,000 in incremental cost per incident. Cloud Radix puts unauthorized AI usage at 78% of employees. This pillar walks through what shadow AI is, why traditional DLP cannot see it, and the architecture that contains the blast radius.

shadow-aiai-securitydlpai-governancecisoenterprise
Read post →

Enterprise AI Data Uploads Nearly Doubled in 2026: Reading the Zscaler ThreatLabz Numbers as an Inline-Enforcement Problem

Zscaler ThreatLabz published the 2026 AI Threat Report on June 17, 2026. Employees moved 18,033 TB of enterprise data into AI tools over the year, a 93% jump. ChatGPT alone generated 410 million DLP policy violations, up 99% year over year. The report calls for zero trust on every model interaction and inline inspection on every AI/ML request. Those are gateway-layer controls. Reading the numbers as a control-architecture problem shows why app blocking and one-off DLP rules collapse at this volume.

shadow-aiai-dlpenterprise-aidata-exposureinline-enforcementai-security
Read post →

AI Agent Runtime Protection: Where the Control Plane Has to Sit and Why Most Architectures Get It Wrong

AI agent runtime protection has to enforce policy at the moment the agent calls a tool or a model. Most architectures push protection into the framework layer (LangChain callbacks, AutoGen middlewares, Semantic Kernel filters), which the agent can bypass once a prompt-injection payload reshapes the call path. The placement that survives sits at the HTTP request layer between the agent and the LLM or tool endpoint. This walkthrough shows why framework-layer protection fails, where the gateway placement closes the gap, and which controls only the request layer can enforce.

agentic-aiai-agent-securityruntime-protectioninline-enforcementai-security
Read post →

AI Agent Egress Control: The Destination Allowlist That Survives Prompt Injection

AI agent egress control bounds the destinations an agent can reach on its outbound calls. A correct implementation binds the destination policy to the agent identity, evaluates the decision at the HTTP layer outside the agent process, and records the per-decision result for audit. This walkthrough covers the three classes of egress an agent makes, the destination-allowlist patterns that hold under prompt injection, and the audit-record fields a regulator expects.

agentic-aiegress-controlai-agent-securityallowlistinline-enforcement
Read post →