← All posts

Problem-Aware

192 posts on problem-aware.

LLM Security Vulnerabilities: Five Classes of Real CVE in the 2026 AI Stack

OWASP's Top 10 catalogs LLM risks in the abstract. The CVEs filed against the LLM stack in 2026 are concrete, and they cluster into five classes: control-plane authentication bypass, multi-tenant isolation failure, pre-auth RCE in orchestration tooling, unsafe model file deserialization, and configuration-to-command execution by protocol design. This walks each class with its 2026 exemplars, the shared root cause, and which classes an enforcement layer can compensate for.

llm-securityai-securitycybersecurityarchitecturedevsecopsagentic-ai
Read post →

LLM Supply Chain Security: Nine Components, and the Only One You Can Enforce at Runtime

An LLM system has nine supply-chain components: base weights, fine-tunes and adapters, tokenizers, training and RAG corpora, inference servers, orchestration frameworks, tool and MCP servers, prompt templates, and the provider API itself. Eight of them are verified before deployment, through provenance, signing, and pinning. One is verified at runtime, on every call. This walks each component, the attack that hits it, and where the enterprise's enforceable control actually sits.

llm-securityai-securityarchitectureai-governanceagentic-aidevsecops
Read post →

MCP Security Risks: Seven Failure Modes, Ranked by What They Cost You

Model Context Protocol risk decomposes into seven failure modes: configuration-to-command execution, tool poisoning, confused-deputy token passthrough, capability inheritance on agent compromise, credential aggregation in the server, unauthenticated HTTP endpoints, and registry supply chain. Each has a different mechanism, a different owner, and a different relationship to the HTTP boundary. This ranks them by blast radius and states which ones an enforcement layer can answer.

agentic-aiai-securityllm-securityzero-trustidentity-and-authorizationarchitecture
Read post →

MCP Server Supply Chain Security: The Install Path Nobody Reviews

An MCP server is installed with a line of configuration, runs with the privileges of the host process, updates on its own schedule, and ships a tool description that the model reads as instructions. That install path receives less scrutiny than an npm dependency, and the 2026 CVE record shows what it cost. This walks the five gates a third-party MCP server should pass, a ten-question review rubric, and the runtime controls that hold when the review was wrong.

agentic-aiai-securityllm-securitydevsecopsarchitecturecybersecurity
Read post →

MITRE ATLAS and Prompt Injection: Mapping AML.T0051 to Control Points You Can Actually Enforce

MITRE ATLAS catalogs prompt injection as AML.T0051, with Direct at .000 and Indirect at .001, and places jailbreak, data leakage, and plugin compromise downstream of it. That structure is more useful than a risk list, because it names the sequence an attacker follows. This maps each technique in the chain to the control point that answers it, gives the detection fields worth writing to a SIEM, and states which ATLAS entries an HTTP enforcement layer never reaches.

prompt-injectionllm-securityai-securityinline-enforcementforensic-auditarchitecture
Read post →

Multi-Agent System Security: The Authorization Problem Nobody Solved Before Shipping

A2A version 1.0 shipped in April 2026 with signed Agent Cards and an explicit design rule: A2A payloads carry no user or client identity. MCP forbids token passthrough and mandates RFC 8707 resource indicators. Both protocols push identity to the HTTP layer and leave delegation chains without a protocol-native way to carry an originating principal across hops. This piece walks through the multi-agent threat model, the six failure modes that only appear when agents talk to each other, and the enforcement point that reconstructs who authorized what.

agentic-aiai-securityidentity-and-authorizationllm-securityarchitecturezero-trust
Read post →

Prompt Injection Benchmarks: AgentDojo, BIPIA, CyberSecEval

Seven prompt injection benchmarks are in active use and their headline attack success rates run from 24% to 84.30%: AgentDojo (629 security cases, ETH Zurich, NeurIPS 2024), BIPIA (Microsoft, KDD 2025), InjecAgent (1,054 cases, ACL Findings 2024), Open-Prompt-Injection (USENIX Security 24), CyberSecEval 2 (Meta, 26-41% on every model), Agent Security Bench (ICLR 2025, 84.30% peak), and MCPTox (45 real MCP servers). Every one of those is a static score. When researchers from OpenAI, Anthropic, and Google DeepMind ran adaptive attacks against twelve published defenses, all twelve fell, most above 90%. This piece gives the comparison table, what each benchmark measures, and the design conclusion the numbers force.

prompt-injectionllm-securityai-securityagentic-aiarchitecture
Read post →

69% of Enterprises Let AI Agents Share Credentials: The Attribution Problem That Starts Before the Breach

VentureBeat Q2 2026 agentic security research found that 69% of enterprises let AI agents share credentials, and 54% had already had an agent-related security incident or near-incident. With several agents on one key, the forensic trail goes cold at the credential level. This is an attribution problem an identity-aware gateway fixes before anything goes wrong, and this article walks through what per-agent identity and per-decision logging change about incident response.

agentic-aiai-securityidentity-and-authorizationforensic-auditai-governancellm-security
Read post →

Shadow AI Detection Tools: The Signals That Actually Surface Unsanctioned AI Use

Shadow AI detection draws on five signal families: network and DNS logs, CASB and OAuth consent grants, endpoint and browser telemetry, identity and SSO logs, and the AI gateway itself. This guide describes what each signal catches, where each goes blind, and why detection surfaces the problem while inline enforcement at the request boundary is what closes it.

shadow-aiai-securitydata-loss-preventioncybersecurityinline-enforcement
Read post →

The Einstein Trust Layer Audit Gap: What Its Log Covers and What Routes Around It

Salesforce''s Einstein Trust Layer writes a detailed audit record for AI interactions that flow through its LLM Gateway, prompt, masked prompt, completion, toxicity score, grounding source, user, and timestamp. That record is scoped to Salesforce-mediated traffic. This piece explains what the Trust Layer captures, why AI traffic that routes around Salesforce never appears in it, and what enterprise-wide per-decision audit requires.

forensic-auditai-securityai-governanceshadow-aicompliance
Read post →

Check Point's AI Security Report 2026: The AI Infrastructure You Cannot See Is Already Being Probed

Check Point Research published its AI Security Report 2026 on July 15, 2026. Most coverage focused on autonomous exploitation and deepfakes. The under-read section is the AI-infrastructure attack surface: exposed model servers, agent control panels, and inference endpoints that attackers probe while most organizations have no inventory of them. This is the visibility gap an identity-aware policy gateway closes on the request path.

ai-securitythreat-reportai-infrastructureinline-enforcementai-visibility
Read post →

The AI Agent Security Guide: Where the Controls Actually Live

AI agents plan, call tools, and make requests to models without a human in the loop for each step. Securing them spans host isolation, tool scoping, identity, and the model-call channel. This guide maps the full control surface, marks which layers sit outside an HTTP policy gateway, and shows where identity-aware authorization and per-decision logging on agent-to-LLM traffic do the work.

ai-agent-securityagentic-aiai-agent-identityai-audit-trailai-egress
Read post →