← All posts

Problem-Aware

192 posts on problem-aware.

An AI Supply Chain Attack Rarely Touches a Model File Directly

An AI supply chain attack usually compromises something adjacent to the model: a PyPI package with the same name as an internal dependency, a pickle file that executes on load instead of just deserializing weights. Two documented incidents, the PyTorch torchtriton compromise and the Hugging Face pickle backdoors JFrog found, show the pattern. Neither touched a model architecture. Both got code running on a machine that trusted the install path.

ai-securityllm-securitycybersecurityai-governancedevsecops
Read post →

AI Session Hijacking Turns One Stolen Token Into a Full Conversation History

AI session hijacking reuses a familiar attack, a stolen session token or cookie, against a target that holds more than a login: weeks of conversation history, uploaded documents, connected tools, and standing memory. OWASP ranks broken authentication as a top API risk for exactly this reason. Most AI chat and agent backends inherit the same session model as any other web API, and a stolen token grants everything the legitimate session had access to.

ai-securityllm-securityzero-trustidentity-and-authorizationagentic-aicybersecurity
Read post →

AI Output Provenance Means Two Different Records, and Only One Is Yours

AI output provenance gets treated as one problem when it is two. Model-layer watermarking answers whether a system produced a piece of content. It says nothing about which identity inside an enterprise generated a specific output, under which policy, at what time. NIST catalogs the technical approaches to the first question. Almost nobody has built the second record, and it is the one an auditor actually asks for.

ai-securityai-governancellm-securityauditforensic-auditai-compliance
Read post →

AI Agent Tool Permissions: The Authorization Layer Between Reasoning and Action

An AI agent that holds the union of every tool permission its operating role might ever need is over-privileged on every call where the actual task uses only one tool. Tool permissions need a per-task authorization layer: identity of the requesting user, scoped delegation for the task, and a gateway decision per tool call. This piece walks through the four properties a tool-permission policy needs and where the policy decision lands at the AI request boundary.

ai-agentstool-permissionsauthorizationengineeringidentity
Read post →

Agent-to-Agent Authentication: How One Agent Verifies Another at the API Boundary

Multi-agent systems route work between agents that authenticate to one another. The pattern that worked for service-to-service traffic (mTLS plus a shared service account) under-attributes the action. Agent-to-agent authentication needs the workload identity of the calling agent plus the delegation chain back to the natural person, plus per-call records that capture the chain. This piece walks through the three properties an agent-to-agent auth model must support, the token-exchange pattern that satisfies them, and where the policy decision lands.

ai-agentsauthenticationidentityengineeringmulti-agent
Read post →

OWASP LLM02: Insecure Output Handling and the Trust Boundary Most Apps Get Wrong

OWASP LLM02 covers insecure output handling: the application trusts the model output and passes it to a downstream sink (database, browser, shell) without classification or filtering. The result is SSRF, XSS, SQL injection, and command injection where the LLM is the unintended source. This article walks through the LLM02 categories, the trust-boundary error most applications make, and the gateway-layer controls that contain the blast radius.

ai-securityowaspllm-securityoutput-handlingarchitecturetrust-boundary
Read post →

OWASP LLM07: System Prompt Leakage and Why Secrets in System Prompts Are Always Wrong

OWASP LLM07 covers system prompt leakage: the application embeds secrets, internal policy, or sensitive instructions in the system prompt, and an attacker extracts them through prompt manipulation. The category gets misread as a prompt-injection variant. The actual lesson is architectural: anything the application would not publish should not sit in the system prompt at all. This article walks through the LLM07 mechanism, the leakage techniques that work in practice, and the architectural fix.

ai-securityowaspllm-securityprompt-injectionarchitecturesecrets-management
Read post →

OWASP LLM03 Training Data Poisoning: Why the Defense Lives Outside the Gateway

OWASP LLM03 covers training and fine-tuning data poisoning: an attacker contaminates the data the model learned from, and the contamination becomes a property of the model. The defense lives in the data and model supply chain, upstream of any runtime gateway. A policy gateway cannot un-poison a model, but it sits in the right place to detect the downstream behavior a poisoned model produces and to block the actions that behavior would trigger. This article walks through the LLM03 mechanism, where the gateway helps, and where it does not.

ai-securityowaspllm-securitydata-poisoningsupply-chainarchitecture
Read post →

OWASP LLM04 Model Denial of Service: Gateway Controls That Actually Hold Under Load

OWASP LLM04 covers model denial of service: resource-exhaustion attacks that exploit the cost asymmetry between issuing a prompt and serving it. A single user can drive an LLM workload to consume orders of magnitude more compute, tokens, or wall-clock time than a benign request. The defense is rate-limiting and shaping at the boundary where every request is visible. This article walks through the LLM04 attack patterns, the gateway controls that hold under load, and the metrics to instrument.

ai-securityowaspllm-securityrate-limitingai-gatewaycost-management
Read post →

OWASP LLM05 Supply Chain Vulnerabilities: Mapping the Surface a Gateway Can Cover

OWASP LLM05 covers supply chain vulnerabilities across the AI stack: model weights from public hubs, serving frameworks with their own CVE histories, third-party tools the agent calls, dependencies in inference dependencies. The defenses split across the supply chain itself, the runtime, and the network boundary. A policy gateway covers the network-boundary piece. This article maps the LLM05 surface, sorts the controls by which layer enforces each one, and shows what an identity-aware gateway adds.

ai-securityowaspllm-securitysupply-chainai-bomvulnerability-management
Read post →

OWASP LLM06 Sensitive Information Disclosure: The Output-Side Controls a Gateway Enforces

OWASP LLM06 covers sensitive information disclosure: the model emits data the application or the user is not authorized to receive. The disclosure paths split into three: training-data leakage, in-context leakage from RAG and tool outputs, and cross-tenant leakage from shared deployments. The output-side controls live at the gateway, where every response is observable before it reaches the user. This article walks through the LLM06 disclosure paths, the output-side controls that work, and the redaction and policy patterns to enforce.

ai-securityowaspllm-securitydata-leakageoutput-filteringredaction
Read post →

OWASP LLM08 Excessive Agency: Bounding What an Agent Is Allowed to Actually Do

OWASP LLM08 covers excessive agency: the AI agent has the ability to take actions that exceed what the application or the user intended. The category is the agentic equivalent of the post-authentication gap: authentication and authorization happened, but the action the agent took was not the action the authorization actually permitted. The control point is the boundary between the agent loop and the tool surface. This article walks through the LLM08 mechanisms, the agency-bounding controls a gateway enforces, and where the architecture differs from classic API authorization.

ai-securityowaspllm-securityagentic-aiauthorizationtool-permissions
Read post →