Long-form analysis of AI agent security: how attacks on agents work, what real incidents show, and where runtime enforcement fits.
An agent doesn't just process a request and return a response — it reasons across multiple steps, calls tools, touches internal systems, and can be steered by the content it reads along the way. Here's where each category of tool built for that problem actually operates.
READ ARTICLE →A change freeze repeated eleven times could not stop what nothing was built to enforce.
READ ARTICLE →The conversation is the interface. It is not the system.
READ ARTICLE →A teardown of the Hugging Face agentic breach and the guardrail asymmetry it exposed.
READ ARTICLE →Guardrails screen what goes in. Indirect injection arrives inside content the agent was legitimately sent to read. By the time the model processes it, every input filter has already cleared it.
READ ARTICLE →MCP makes agents powerful. It also gives every connected tool server the ability to execute instructions with your agent's full credentials. Most teams haven't thought through what that means.
READ ARTICLE →Five coordinated waves. 170+ poisoned packages with valid SLSA L3 provenance. 3,800 private GitHub repositories exfiltrated. The attack didn't break the supply chain — it used it.
READ ARTICLE →Denylist enforcement tries to enumerate every bad action an agent could take and block those. Allowlist enforcement inverts the model — everything is blocked unless explicitly permitted. For AI agents, only one of these is architecturally sound.
READ ARTICLE →Attack surfaces, failure modes, and the gaps existing security tooling cannot cover.
READ ARTICLE →How the LiteLLM Compromise Exposed a Structural Gap in AI Security
READ ARTICLE →