← All posts

Problem-Aware

192 posts on problem-aware.

AI Agent Privilege Scoping: Six Patterns That Contain an Agent's Blast Radius

An agent is a program that acts on behalf of a human, and the acting has authorization consequences the traditional privilege model does not cover. The agent's identity, the human's session, the tool's permission, and the enterprise policy all compose into the authorization decision on each call. Privilege scoping is the design pattern set that keeps the composed authorization tight. This piece walks through six patterns that appear in production agent deployments and the audit records each pattern produces.

ai-agentprivilege-scopingagentic-aiai-securityauthorizationblast-radius
Read post →

AI Audit Log Hashing Patterns: The Cryptographic Choices That Make an Audit Trail Tamper-Evident

An AI audit log that a regulator or an auditor will accept has to prove two properties: the records were written at the times they claim, and the records have not been altered after the fact. Hashing is the mechanism that produces the second property. This piece walks through the hashing patterns that fit an inline AI gateway's audit stream: hash-chained append, Merkle-tree batching, external witness anchoring, and the trade-offs each pattern makes against write latency and audit verification cost.

audit-logsai-securitycompliancecryptographytamper-evidentai-gateway
Read post →

AI Agent Lateral Movement: How an LLM Turns a Single Compromised Credential into a Multi-System Incident

An AI agent operating with credentialed access to multiple SaaS systems collapses the traditional lateral-movement kill chain. What used to take a human attacker hours of enumeration and pivoting takes an LLM-orchestrated agent seconds. The Marimo CVE-2026-39987 incident is the first widely reported case. This piece walks through the mechanism, why endpoint detection is blind to it, and the inspection-layer controls that block the pattern at the HTTP AI request boundary.

ai-agent-securitylateral-movementagentic-aiincident-responseai-security
Read post →

AI Agent Tool Scoping: The Blast Radius Control That Agent Frameworks Do Not Enforce

AI agent frameworks let the model choose from the tool set the developer registered. What the frameworks do not enforce is which tool the calling identity is authorized to use in which context. When a prompt injection attack succeeds, the blast radius is the intersection of the tool set the framework registered and the authorization the calling application forwarded. Tool scoping is the control that shrinks the intersection.

ai-agent-securityagentic-aiprompt-injectionblast-radiusagent-toolsauthorization
Read post →

LLM Jailbreak Defense Patterns: The Layered Controls That Survive Real Production Traffic

Model-provider safety training reduces jailbreak success rates but does not eliminate them. Production deployments layer three defenses around the model: input-side classifiers that flag adversarial prompts, output-side classifiers that flag policy-violating responses, and identity-aware policy at the request boundary that limits what a successful jailbreak can accomplish. The layered pattern, the residual failure modes, and the audit record each layer produces.

llm-jailbreakprompt-injectionai-securitydefense-in-depthai-safetyai-policy-enforcement
Read post →

AI Agent Sandbox: The Runtime Isolation Model That Contains Blast Radius When the Prompt Turns Hostile

An AI agent that executes tool calls, writes files, runs shell commands, and reaches network endpoints from inside the same process as the calling application inherits the caller''s ambient authority. A sandbox around the agent runtime confines that authority so a successful prompt injection cannot escalate beyond what the sandbox permits. This covers the sandbox properties, the process versus container versus VM trade-offs, and the audit signal the sandbox produces at each boundary crossing.

ai-agent-securityagentic-aisandboxruntime-isolationblast-radiusdefense-in-depth
Read post →

Agentic AI Permission Control: The Delegated-Authority Layer Most Deployments Skip

Most AI agents run on a static credential with standing access to the full model API and every downstream tool. Permission control means evaluating each agent action against who delegated it, under which policy, at that moment. This walks through the delegated-authority model, where standing credentials fail, and the enforcement layer that binds every agent call to a scoped, audited decision.

agentic-aiai-securityidentity-and-authorizationnist-ai-rmfinline-enforcement
Read post →

MCP Security Best Practices: Authorizing and Auditing Model Context Protocol Traffic

The Model Context Protocol gives an LLM a standard way to call tools, and over HTTP transport those calls are AI traffic you can authorize and audit. This covers the practices that matter at the request boundary: verify identity on every call, scope tools per role, treat tool descriptions as untrusted, fail closed, and log per decision. It also marks the line where local stdio servers fall outside a gateway.

ai-securityagentic-aillm-securitypolicy-enforcementidentity-and-authorization
Read post →

MCP Server Security: Hardening a Model Context Protocol Server You Operate

Running your own MCP server puts you in charge of who can reach its tools and what those tools can do. This guide covers server-side hardening: authenticating callers, authorizing each tool invocation, containing the confused-deputy risk, restricting tool egress, and deciding what belongs on the HTTP transport versus a locked-down local process. It closes with the enforcement layer that governs MCP traffic crossing the network.

ai-securityagentic-aillm-securityidentity-and-authorizationpolicy-enforcement
Read post →

Prompt Injection Protection: The Control Layers That Actually Contain It

No single control stops prompt injection, because the attack rides inside content the model is meant to read. Protection comes from layers that cap what a successful injection can reach: input handling, output filtering, least-privilege authorization on the model and its tools, and egress control. This walks through each layer, why model guardrails alone fall short, and where the enforceable controls have to run.

prompt-injectionllm-securityai-securityinline-enforcementpolicy-enforcement
Read post →

Prompt Injection Techniques: How the Attacks Actually Work

Prompt injection is a family of techniques, not one trick. Direct instructions, payloads hidden in retrieved content, splitting and obfuscation, multi-turn setups, and system-prompt extraction each work differently and need different containment. This walks through the main techniques with concrete examples, then maps them to the request-boundary controls that cap what a successful attack can reach.

prompt-injectionllm-securityai-securityagentic-aipolicy-enforcement
Read post →

JadePuffer, Agentic Ransomware, and What It Changes About AI Egress

On July 1, 2026 Sysdig disclosed JadePuffer, the first documented ransomware operation run end to end by an LLM agent: initial access through a Langflow RCE and a Nacos auth bypass, then autonomous recon, credential theft, lateral movement, and database extortion, with the agent self-correcting a failed subprocess call in 31 seconds with no human in the loop. The one control that sits inside an AI gateway's boundary is the outbound model traffic the agent depends on to think.

agentic-aiai-securitycybersecurityllm-securityinline-enforcement
Read post →