← All posts

Problem-Aware

202 posts on problem-aware.

AI Agent Privilege Scoping: Six Patterns That Contain an Agent's Blast Radius

An agent is a program that acts on behalf of a human, and the acting has authorization consequences the traditional privilege model does not cover. The agent's identity, the human's session, the tool's permission, and the enterprise policy all compose into the authorization decision on each call. Privilege scoping is the design pattern set that keeps the composed authorization tight. This piece walks through six patterns that appear in production agent deployments and the audit records each pattern produces.

ai-agentprivilege-scopingagentic-aiai-securityauthorizationblast-radius
Read post →

AI Audit Log Hashing Patterns: The Cryptographic Choices That Make an Audit Trail Tamper-Evident

An AI audit log that a regulator or an auditor will accept has to prove two properties: the records were written at the times they claim, and the records have not been altered after the fact. Hashing is the mechanism that produces the second property. This piece walks through the hashing patterns that fit an inline AI gateway's audit stream: hash-chained append, Merkle-tree batching, external witness anchoring, and the trade-offs each pattern makes against write latency and audit verification cost.

audit-logsai-securitycompliancecryptographytamper-evidentai-gateway
Read post →

AI Agent Lateral Movement: How an LLM Turns a Single Compromised Credential into a Multi-System Incident

An AI agent operating with credentialed access to multiple SaaS systems collapses the traditional lateral-movement kill chain. What used to take a human attacker hours of enumeration and pivoting takes an LLM-orchestrated agent seconds. The Marimo CVE-2026-39987 incident is the first widely reported case. This piece walks through the mechanism, why endpoint detection is blind to it, and the inspection-layer controls that block the pattern at the HTTP AI request boundary.

ai-agent-securitylateral-movementagentic-aiincident-responseai-security
Read post →

AI Agent Tool Scoping: The Blast Radius Control That Agent Frameworks Do Not Enforce

AI agent frameworks let the model choose from the tool set the developer registered. What the frameworks do not enforce is which tool the calling identity is authorized to use in which context. When a prompt injection attack succeeds, the blast radius is the intersection of the tool set the framework registered and the authorization the calling application forwarded. Tool scoping is the control that shrinks the intersection.

ai-agent-securityagentic-aiprompt-injectionblast-radiusagent-toolsauthorization
Read post →

MCP Security Best Practices: Authorizing and Auditing Model Context Protocol Traffic

The Model Context Protocol gives an LLM a standard way to call tools, and over HTTP transport those calls are AI traffic you can authorize and audit. This covers the practices that matter at the request boundary: verify identity on every call, scope tools per role, treat tool descriptions as untrusted, fail closed, and log per decision. It also marks the line where local stdio servers fall outside a gateway.

ai-securityagentic-aillm-securitypolicy-enforcementidentity-and-authorization
Read post →

MCP Server Security: Hardening a Model Context Protocol Server You Operate

Running your own MCP server puts you in charge of who can reach its tools and what those tools can do. This guide covers server-side hardening: authenticating callers, authorizing each tool invocation, containing the confused-deputy risk, restricting tool egress, and deciding what belongs on the HTTP transport versus a locked-down local process. It closes with the enforcement layer that governs MCP traffic crossing the network.

ai-securityagentic-aillm-securityidentity-and-authorizationpolicy-enforcement
Read post →

Prompt Injection Protection: The Control Layers That Actually Contain It

No single control stops prompt injection, because the attack rides inside content the model is meant to read. Protection comes from layers that cap what a successful injection can reach: input handling, output filtering, least-privilege authorization on the model and its tools, and egress control. This walks through each layer, why model guardrails alone fall short, and where the enforceable controls have to run.

prompt-injectionllm-securityai-securityinline-enforcementpolicy-enforcement
Read post →

Prompt Injection Techniques: How the Attacks Actually Work

Prompt injection is a family of techniques, not one trick. Direct instructions, payloads hidden in retrieved content, splitting and obfuscation, multi-turn setups, and system-prompt extraction each work differently and need different containment. This walks through the main techniques with concrete examples, then maps them to the request-boundary controls that cap what a successful attack can reach.

prompt-injectionllm-securityai-securityagentic-aipolicy-enforcement
Read post →

JadePuffer, Agentic Ransomware, and What It Changes About AI Egress

On July 1, 2026 Sysdig disclosed JadePuffer, the first documented ransomware operation run end to end by an LLM agent: initial access through a Langflow RCE and a Nacos auth bypass, then autonomous recon, credential theft, lateral movement, and database extortion, with the agent self-correcting a failed subprocess call in 31 seconds with no human in the loop. The one control that sits inside an AI gateway's boundary is the outbound model traffic the agent depends on to think.

agentic-aiai-securitycybersecurityllm-securityinline-enforcement
Read post →

A Lone Attacker Crossed an AWS Estate in 72 Hours With AI as the Force Multiplier

On July 8, 2026 Sygnia disclosed an intrusion in which a single, non-elite threat actor used AI as a force multiplier to breach a global enterprise's AWS environment and spread across applications, CI/CD pipelines, repositories, databases, and runtime services in roughly 72 hours. No zero-day. No novel malware. Familiar techniques executed at machine speed across more surfaces than the defenders could contain. I want to focus on the tempo argument and what it does to any control that operates after the traffic has already landed.

ai-securitycybersecurityinline-enforcementagentic-aicloud-securityllm-security
Read post →

Agentic AI Audit Trail: Reconstructing a Multi-Step Agent Run From the Record

An agent run is not one request. It is a chain: a plan, a sequence of tool calls, retrieved context, and model calls whose inputs were produced by earlier steps in the same chain. An audit trail that records only the final model call cannot reconstruct any of it. This walks the fields an agentic audit trail has to carry, the correlation identifier that makes a chain reconstructible, and why the record has to be written outside the agent that produced it.

agentic-aiforensic-auditauditai-complianceidentity-and-authorizationai-security
Read post →

Agentic AI Runtime Security: The Controls That Only Exist While the Agent Is Running

An agent's threat model is decided at runtime, because its next action is chosen from content it retrieved a moment ago. Design-time review cannot see that. This walks the four runtime control points in an agent loop (plan, tool call, context assembly, model call), what each one can enforce, and why the model call is the only point where an external enforcement layer can render a deterministic decision on every step.

agentic-aiai-securityinline-enforcementpolicy-enforcementllm-securityzero-trust
Read post →