Per-Request Minted JWTs for Agent Backends with agentgateway
I built a demo where an AI agent calls a backend API and holds no credential for it. No API key in its environment, no key file on disk, no token. agentgateway …
Read more →#AI Agents
23 posts
AI Agent Security on Kubernetes: Which Controls Actually Held
I spent the last month building small, runnable labs for the ways AI agents break the infrastructure they run on: credentials, egress, audit logs, MCP tool …
Read more →Building Workload Identity Federation for AI Agents on Kubernetes
The easy way to give an agent pod access to an external API is a long-lived key in a Kubernetes Secret. It doesn’t expire when the pod dies, it …
Read more →Your Agent Egress Proxy Never Saw the DNS Query
An OpenAI research agent got its HTTPS requests to a public chatbot blocked by a web proxy. So it found a different way to ask the chatbot questions: it queried …
Read more →Agent Runtimes Have an Autoscaler, Not a Scheduler
Every capacity knob in an agent runtime today is an efficiency knob. Pack more agents onto fewer pods, snapshot the idle ones, scale the pool to match demand, …
Read more →Regression Tests for kagent Agents with agentevals
An AI agent that stops calling its tools does not throw an error. It answers from the model’s memory, confidently and plausibly, and the output still …
Read more →What Stopped AI Agent Probes of Government Data Sites
On September 24, Australia’s prime minister told reporters that an OpenAI agent had broken into a government Medicare statistics portal, accessed …
Read more →Serve Markdown to Agents at the Gateway, Not the Origin
Agents parse HTML badly and expensively. The usual fix is to make the site emit markdown: add a per-page index.md, publish an llms.txt, change the build. That …
Read more →Your Artifact Registry Is a Two-Way Channel for Agents
Egress control for AI agents usually gets framed as a blocklist problem. Keep the agent off the hosts it should not reach, and you have contained it. This …
Read more →MCP Tool Poisoning: A Name Allowlist Is Not Enough
I built a four-container demo that reproduces an MCP server rewriting its own tool definitions mid-session, and puts two controls in front of it to see which …
Read more →Stopping an AI Agent Without Losing the Forensic Record
Two things get asked for the moment agents start doing real work. Stop it now, and keep everything it did. Those usually fight. The natural place to log what an …
Read more →I Benchmarked Jev on Agent Tool-Call Risk. Calibration Held.
TypeSafe AI launched Jev on 2026-09-15 with the usual launch-day multipliers — 193.6x faster, 444.6x cheaper than frontier LLMs — plus “zero …
Read more →kagent v1.0: Claude Code Harness on Kubernetes
kagent shipped v1.0.0-alpha1 this morning, its first 1.0 line after nine months on 0.x. The tag says alpha; GitHub’s own release flag says otherwise; …
Read more →Agent Identity on Kubernetes: The Complete Series
An AI agent that calls a model, a tool, or another agent has to prove who it is. Almost every production failure I have written up this month traces back to …
Read more →Securing AI Agents in Production: The Complete Series
Almost everything in this series started the same way: a control that everybody agrees is the right control, applied to an agent, quietly not doing the thing …
Read more →Shadow MCP Servers: Why They're Hard to Track
Tracking shadow MCP servers across teams is hard because most of them never show up anywhere a platform team looks. Local MCP servers run as child processes of …
Read more →Keeping MCP Server Instructions Out of Your Agent's System Prompt
How do you keep MCP server instructions out of the trusted system prompt? Isolate them, cap them, bind any cache that stores them to server and caller, and pin …
Read more →The agentgateway Token Service Now Runs Without a Cluster
Solo shipped agentgateway enterprise 2026.9.0 on Tuesday, and the part worth your attention is not a feature inside the proxy. It is where the token service now …
Read more →Agent Audit Logs: What METR and Redwood Found
Two weeks ago METR and Redwood Research published their review of ~1,300 agent transcripts from the OpenAI / Hugging Face incident. Buried in it is a finding …
Read more →kagent Audience-Bound Tokens (RFC 8707)
kagent v0.10.0 went GA on September 4 . Buried in a long release list is a pair of environment variables that decide whether an agent’s credential works …
Read more →Why Proxy-Variable Agent Sandboxes Fail, and the CONNECT-Time Fix
On September 4, 2026, researchers published ~18,000 posts that autonomous agents left on a 25-year-old German wiki over six weeks, using it as a message board …
Read more →LLM Robot Fleet Governance with agentgateway
I built a simulated warehouse robot fleet where LLMs do the planning and every piece of traffic that crosses the network runs through one open source gateway. …
Read more →Revenant: A Gateway-Native, Always-On Agent Runtime
Always-on personal agents keep dying the same three deaths: leaked keys, runaway spend, and silence. The first two get the headlines. The third one is the one …
Read more →