← All posts

Problem-Aware

192 posts on problem-aware.

AI Agent Egress Control: The Destination Allowlist That Survives Prompt Injection

AI agent egress control bounds the destinations an agent can reach on its outbound calls. A correct implementation binds the destination policy to the agent identity, evaluates the decision at the HTTP layer outside the agent process, and records the per-decision result for audit. This walkthrough covers the three classes of egress an agent makes, the destination-allowlist patterns that hold under prompt injection, and the audit-record fields a regulator expects.

agentic-aiegress-controlai-agent-securityallowlistinline-enforcement
Read post →

AI Agent Secrets Handling: Why the Agent Process Should Never See an API Key

An AI agent that holds API keys in process memory is an exfiltration target. The architecture that survives keeps the keys at the gateway and exposes only short-lived, identity-bound tokens to the agent. This walkthrough covers the three patterns enterprises use today, the failure modes that surface under prompt injection or pre-auth RCE, and the broker pattern that closes the gap.

agentic-aisecrets-managementai-agent-securitycredentialsinline-enforcement
Read post →

Mistral Prompt Injection: What the EU-Sovereign Models Inherit from the OWASP LLM01 Class

Mistral models run on EU-sovereign infrastructure for a reason: European enterprises that need to keep AI traffic inside the EU prefer the provider that started there. The architectural choice does not change the prompt-injection surface. Mistral models inherit OWASP LLM01 the same way OpenAI, Anthropic, and Google do, and the defense pattern that works is identical: identity-aware policy enforcement at the HTTP boundary, plus per-decision audit. This walkthrough covers the Mistral-specific attack patterns documented in production, the defense layers that hold, and the audit fields that survive the regulator.

mistralprompt-injectionowasp-llm01ai-securityeu-sovereign
Read post →

AI Bias Detection: From Statistical Tests to Per-Decision Audit Records That Survive a Regulator Review

AI bias detection runs at two layers. The model-level layer evaluates the model against test sets across demographic groups and reports statistical disparities (demographic parity, equalized odds, calibration). The deployment-level layer evaluates actual decisions on actual people in production and reports outcomes against the populations affected. Regulators reading bias evidence under EU AI Act Articles 10 and 15, ISO 42001 Clause 9.1, and NIST AI RMF MEASURE.2.11 expect both layers. The deployment-level layer requires per-decision audit records that capture identity, classification, policy state, and outcome.

ai-biasbias-detectionai-fairnesseu-ai-actcomplianceaudit-evidence
Read post →

LiteLLM's June CVE wave: what an authentication bypass in an AI gateway teaches about control-plane design

LiteLLM disclosed seven CVEs in June 2026, including CVE-2026-12773, a CVSS 7.3 authentication bypass in the UserAPIKeyAuth path, and CVE-2026-42271, a remote code execution flaw that CISA added to the Known Exploited Vulnerabilities catalog on June 8, 2026. The cluster of disclosures exposes a structural lesson about AI gateway design: the gateway authentication layer and the provider-key storage layer are themselves high-value attack surfaces. The lesson points at architectural choices that minimize blast radius.

litellm-cveai-gateway-securityauthentication-bypasscve-2026-12773cisa-kevcontrol-plane
Read post →

LLM Denial of Wallet Does Not Need to Overwhelm Anything

LLM denial of wallet borrows a term that predates generative AI by a decade: a 2021 Register piece on a "theoretical Denial-of-Wallet attack" described the same economic logic OWASP now applies to LLM APIs as Unbounded Consumption. Pay-per-token pricing means an attacker does not need to overwhelm anything. Requests that are simply expensive, long context windows, recursive agent loops, complex reasoning chains, drain the budget at normal traffic volume.

ai-securityllm-securityzero-trustcybersecurityai-governance
Read post →

LLM Attacks Sorted by Where in the Request They Actually Happen

LLM attacks get catalogued by objective (what the attacker wants) or by CVE (what got a vulnerability number), and both framings are useful for different audiences. Neither answers the question a security team asks first: where in my stack do I even look. This sorts the same attack classes MITRE ATLAS and OWASP document by lifecycle stage instead, input-time, inference-time, output-time, and infrastructure-time, because that is the axis that maps to who owns the fix.

ai-securityllm-securitycybersecurityagentic-aizero-trust
Read post →

Insecure Output Handling Treats a Model Reply Like It Cannot Bite

Insecure output handling treats a model response as safe text once it has been generated, when the model is repeating whatever an attacker fed it upstream. In 2023, researcher Johann Rehberger showed that a ChatGPT plugin rendering a markdown image from model output would fetch an attacker-controlled URL automatically, leaking conversation data the moment the image loaded. The application trusted the output. Nothing downstream checked it again.

ai-securityllm-securitycybersecurityzero-trust
Read post →

Excessive Agency Is Three Separate Failures Wearing One Name

Excessive Agency is treated as one OWASP risk category, but it names three distinct failures: an agent with more permissions than its task requires, more functionality than its task requires, or more autonomy than its task requires. Replit AI agent deleted a live production database during an explicit code freeze in July 2025, ignoring an instruction to get human approval first. That is an autonomy failure specifically, and it needed a different fix than a permissions failure would have.

ai-securityllm-securityagentic-aizero-trustidentity-and-authorization
Read post →

Embedding Leakage: A 2023 Paper Recovered 92% of Text From Its Own Vectors

Embedding leakage treats a vector representation of text as if it were anonymized, when research has shown the opposite. A 2023 paper out of Cornell demonstrated a method called vec2text that recovers 92% of 32-token inputs exactly from their embeddings alone, and recovered patient names from a clinical notes dataset. Any system that stores embeddings, including most RAG pipelines, is storing something closer to the original text than most teams assume.

ai-securityllm-securitycybersecurityai-governancezero-trust
Read post →

Cross-Tenant AI Leakage Does Not Require a Bug in Your Application

Cross-tenant AI leakage lets one customer of a multi-tenant AI product recover fragments of another customer prompt, without either customer misconfiguring anything. A 2025 NDSS paper demonstrated the mechanism directly: an attacker tenant sharing inference infrastructure with a victim tenant can reconstruct the victim prompt token by token by timing cache-hit responses. The application code can be correct. The leak happens one layer below it.

ai-securityllm-securityzero-trustcybersecurityai-governance
Read post →

Automated Red Teaming Finds the Jailbreak. It Does Not Confirm Your Gateway Stopped It.

Automated red teaming tools like PyRIT and garak run thousands of adversarial probes against a model in minutes, a scale no manual red team matches. What they report is whether the model produced an unsafe output in a test environment. They do not report whether a production request carrying the same probe would have reached the model at all, because that depends on what sits between the caller and the model in production, not in the test.

ai-securityllm-securityagentic-aizero-trustcybersecurity
Read post →