← All posts

Problem-Aware

202 posts on problem-aware.

AI Agent Secrets Handling: Why the Agent Process Should Never See an API Key

An AI agent that holds API keys in process memory is an exfiltration target. The architecture that survives keeps the keys at the gateway and exposes only short-lived, identity-bound tokens to the agent. This walkthrough covers the three patterns enterprises use today, the failure modes that surface under prompt injection or pre-auth RCE, and the broker pattern that closes the gap.

agentic-aisecrets-managementai-agent-securitycredentialsinline-enforcement
Read post →

Mistral Prompt Injection: What the EU-Sovereign Models Inherit from the OWASP LLM01 Class

Mistral models run on EU-sovereign infrastructure for a reason: European enterprises that need to keep AI traffic inside the EU prefer the provider that started there. The architectural choice does not change the prompt-injection surface. Mistral models inherit OWASP LLM01 the same way OpenAI, Anthropic, and Google do, and the defense pattern that works is identical: identity-aware policy enforcement at the HTTP boundary, plus per-decision audit. This walkthrough covers the Mistral-specific attack patterns documented in production, the defense layers that hold, and the audit fields that survive the regulator.

mistralprompt-injectionowasp-llm01ai-securityeu-sovereign
Read post →

AI Bias Detection: From Statistical Tests to Per-Decision Audit Records That Survive a Regulator Review

AI bias detection runs at two layers. The model-level layer evaluates the model against test sets across demographic groups and reports statistical disparities (demographic parity, equalized odds, calibration). The deployment-level layer evaluates actual decisions on actual people in production and reports outcomes against the populations affected. Regulators reading bias evidence under EU AI Act Articles 10 and 15, ISO 42001 Clause 9.1, and NIST AI RMF MEASURE.2.11 expect both layers. The deployment-level layer requires per-decision audit records that capture identity, classification, policy state, and outcome.

ai-biasbias-detectionai-fairnesseu-ai-actcomplianceaudit-evidence
Read post →

LiteLLM's June CVE wave: what an authentication bypass in an AI gateway teaches about control-plane design

LiteLLM disclosed seven CVEs in June 2026, including CVE-2026-12773, a CVSS 7.3 authentication bypass in the UserAPIKeyAuth path, and CVE-2026-42271, a remote code execution flaw that CISA added to the Known Exploited Vulnerabilities catalog on June 8, 2026. The cluster of disclosures exposes a structural lesson about AI gateway design: the gateway authentication layer and the provider-key storage layer are themselves high-value attack surfaces. The lesson points at architectural choices that minimize blast radius.

litellm-cveai-gateway-securityauthentication-bypasscve-2026-12773cisa-kevcontrol-plane
Read post →

LLM Denial of Wallet Does Not Need to Overwhelm Anything

LLM denial of wallet borrows a term that predates generative AI by a decade: a 2021 Register piece on a "theoretical Denial-of-Wallet attack" described the same economic logic OWASP now applies to LLM APIs as Unbounded Consumption. Pay-per-token pricing means an attacker does not need to overwhelm anything. Requests that are simply expensive, long context windows, recursive agent loops, complex reasoning chains, drain the budget at normal traffic volume.

ai-securityllm-securityzero-trustcybersecurityai-governance
Read post →

LLM Attacks Sorted by Where in the Request They Actually Happen

LLM attacks get catalogued by objective (what the attacker wants) or by CVE (what got a vulnerability number), and both framings are useful for different audiences. Neither answers the question a security team asks first: where in my stack do I even look. This sorts the same attack classes MITRE ATLAS and OWASP document by lifecycle stage instead, input-time, inference-time, output-time, and infrastructure-time, because that is the axis that maps to who owns the fix.

ai-securityllm-securitycybersecurityagentic-aizero-trust
Read post →

Excessive Agency Is Three Separate Failures Wearing One Name

Excessive Agency is treated as one OWASP risk category, but it names three distinct failures: an agent with more permissions than its task requires, more functionality than its task requires, or more autonomy than its task requires. Replit AI agent deleted a live production database during an explicit code freeze in July 2025, ignoring an instruction to get human approval first. That is an autonomy failure specifically, and it needed a different fix than a permissions failure would have.

ai-securityllm-securityagentic-aizero-trustidentity-and-authorization
Read post →

Automated Red Teaming Finds the Jailbreak. It Does Not Confirm Your Gateway Stopped It.

Automated red teaming tools like PyRIT and garak run thousands of adversarial probes against a model in minutes, a scale no manual red team matches. What they report is whether the model produced an unsafe output in a test environment. They do not report whether a production request carrying the same probe would have reached the model at all, because that depends on what sits between the caller and the model in production, not in the test.

ai-securityllm-securityagentic-aizero-trustcybersecurity
Read post →

An AI Supply Chain Attack Rarely Touches a Model File Directly

An AI supply chain attack usually compromises something adjacent to the model: a PyPI package with the same name as an internal dependency, a pickle file that executes on load instead of just deserializing weights. Two documented incidents, the PyTorch torchtriton compromise and the Hugging Face pickle backdoors JFrog found, show the pattern. Neither touched a model architecture. Both got code running on a machine that trusted the install path.

ai-securityllm-securitycybersecurityai-governancedevsecops
Read post →

AI Session Hijacking Turns One Stolen Token Into a Full Conversation History

AI session hijacking reuses a familiar attack, a stolen session token or cookie, against a target that holds more than a login: weeks of conversation history, uploaded documents, connected tools, and standing memory. OWASP ranks broken authentication as a top API risk for exactly this reason. Most AI chat and agent backends inherit the same session model as any other web API, and a stolen token grants everything the legitimate session had access to.

ai-securityllm-securityzero-trustidentity-and-authorizationagentic-aicybersecurity
Read post →

AI Output Provenance Means Two Different Records, and Only One Is Yours

AI output provenance gets treated as one problem when it is two. Model-layer watermarking answers whether a system produced a piece of content. It says nothing about which identity inside an enterprise generated a specific output, under which policy, at what time. NIST catalogs the technical approaches to the first question. Almost nobody has built the second record, and it is the one an auditor actually asks for.

ai-securityai-governancellm-securityauditforensic-auditai-compliance
Read post →

AI Agent Tool Permissions: The Authorization Layer Between Reasoning and Action

An AI agent that holds the union of every tool permission its operating role might ever need is over-privileged on every call where the actual task uses only one tool. Tool permissions need a per-task authorization layer: identity of the requesting user, scoped delegation for the task, and a gateway decision per tool call. This piece walks through the four properties a tool-permission policy needs and where the policy decision lands at the AI request boundary.

ai-agentstool-permissionsauthorizationengineeringidentity
Read post →