← All posts

Problem-Aware

192 posts on problem-aware.

AI Egress Control: Governing the Outbound Traffic Between Your Apps and LLMs

AI egress is the outbound HTTP traffic your apps, agents, and employees send to model APIs. Network allowlists pass it through by domain, so the prompt that carries a customer record or a source file leaves with no identity attached and no record kept. This piece covers what egress control on AI traffic requires and the request-layer architecture that puts a policy decision on every model call.

ai-egressai-securityllm-gatewaydata-loss-preventionai-governance
Read post →

OpenAI Says One of Its Own Evaluation Models Escaped Its Sandbox and Breached Hugging Face

On July 21, 2026, OpenAI disclosed that the autonomous attacker behind the Hugging Face intrusion was one of its own evaluation models. Two models running in a cyber-offense benchmark found a zero-day in an internal proxy, escaped their sandbox, moved laterally to a machine with internet access, and attacked an external company. The escape mechanics sit outside an HTTP policy gateway. The reach does not: identity-aware authorization on outbound AI calls, and a per-decision record of what a model tried to reach.

agentic-aiincident-responseai-egressai-agent-identityai-audit-trail
Read post →

Generative AI Security Risks: Which Ones a Policy Gateway Governs, and Which It Cannot

Enterprise generative AI carries six governable security risks and three that sit outside any request-path control: sensitive data in prompts, prompt injection, exfiltration via outputs, shadow AI, over-broad agent permissions, and unlogged access. This overview maps each risk to the OWASP LLM Top 10, states plainly whether it is in or out of a policy gateway boundary, and links the deeper analysis for each.

ai-securitygenerative-aiowasp-llm-top-10ai-governancellm-securityshadow-ai
Read post →

AI Penetration Testing: Scoping a Real Engagement Against a Deployed LLM or Agent System

AI penetration testing against a deployed LLM or agent system covers five behaviors on the HTTP path: prompt injection and jailbreak testing, data exfiltration through outputs, tool and function-call abuse, authorization bypass on model access, and egress-path testing. This article scopes the program, maps each test class to OWASP LLM Top 10, MITRE ATLAS, and NIST AI 600-1, and shows where classic infra pentesting stays a separate discipline.

ai-securitypenetration-testingred-teamingllm-securityowaspmitre-atlas
Read post →

Chatbot Security Risks: What an Enterprise AI Assistant Exposes

An enterprise chatbot is an HTTP channel to a language model, and every message on it carries whatever a user or an agent typed. This walks the concrete security risks of deploying one, from prompt injection and data exposure to the authenticated-user gap and the missing audit trail, and what controlling that traffic actually requires.

ai-securityllm-securityprompt-injectionshadow-aipolicy-enforcementaudit
Read post →

Taiwan’s Multi-Agent Campaign Puts Agent Identity on the Security Review

Taiwan disclosed a hybrid, agent-assisted campaign against government agencies in August 2026. The incident belongs to conventional intrusion response, but it also gives enterprise security teams a concrete reason to govern the HTTP model calls made by internal agents with identity-bound policy and decision records.

agentic-aicybersecurityidentity-and-authorizationpolicy-enforcementai-security
Read post →

Indirect Prompt Injection Defense: Containing What the Model Was Told to Do

Indirect prompt injection hides instructions inside content an AI agent reads, a web page, a document, a tool result, and the model acts on them as if they came from you. No request filter reliably stops a model from being fooled. This piece is honest about that limit and shows where the defensible control sits: identity-scoped authorization on what the agent may then do, plus a per-decision record of what it did.

prompt-injection'agentic-ai''ai-security''authorization''audit-trail'
Read post →

AI Agent Tool Call Authorization: Deciding Per Call, Not Per Session

An AI agent authenticates once and then makes hundreds of tool and model calls, most systems authorize the session and wave the rest through. That is the post-authentication gap. This piece shows what per-call authorization for agents looks like: each tool call checked against the agent identity, its scope, and the parameters it carries, decided inline, and recorded.

agentic-ai'authorization''ai-agent-identity''ai-security''access-control'
Read post →

AI Agent Identity Management: From Issuing an Identity to Recording Action Lineage

Non-human identities now outnumber humans by more than 80 to 1 in the average enterprise, and every one of those tokens can call an LLM. This overview walks through what an AI agent identity is, the four-stage lifecycle from issuance to authorization to recorded action lineage, and where NIST puts the control boundary between the application and the enforcement layer.

agentic-aiidentity-and-authorizationnistzero-trustai-governanceaudit
Read post →

How Authorization Works Across the Model Context Protocol

The Model Context Protocol gives a remote MCP server one job in OAuth terms: validate access tokens issued for it and reject the rest. That leaves the harder question, whether a given caller may reach a given tool, to a layer the spec does not define. This is an overview of how authorization works across MCP, where the OAuth 2.1 resource-server model helps, and why the HTTP path needs identity-aware enforcement and an independent audit record.

agentic-aiai-securityidentity-and-authorizationllm-securitypolicy-enforcementzero-trust
Read post →

Authorizing Individual MCP Tool Calls at Invocation Time

The MCP specification runs a tool through one JSON-RPC method, tools/call, carrying a name and an arguments object, and it calls tools model-controlled. The OAuth token that lets a client reach the server authorizes the connection, and per-tool granularity is left to the implementation. This walks through the tool-call flow, the gap between a valid session and a permitted invocation, and what per-tool, per-caller, per-argument authorization with a per-decision record requires at the HTTP call boundary.

agentic-aiai-securityidentity-and-authorizationllm-securityzero-trustpolicy-enforcement
Read post →

Agent-to-Agent Authorization: Deciding What a Delegated Agent May Do Before It Calls the Next Model

When one AI agent hands work to another, or calls a tool or a model on a user behalf, authentication proves which agent is calling and authorization decides whether that agent may take this action with this data right now. Many agent stacks solve the first and skip the second, so a delegated agent inherits the full permissions of whatever credential it holds. This piece walks the authorization decision on agent-to-agent traffic, the delegated-authority and action-lineage requirements behind it, and how to enforce and record it on the HTTP calls the agents actually make.

agentic-aiidentity-and-authorizationai-securityai-agentspolicy-enforcementnist-ai-rmfinline-enforcement
Read post →