Stopping an AI Agent Without Losing the Forensic Record
Two things get asked for the moment agents start doing real work. Stop it now, and keep everything it did. Those usually fight. The natural place to log what an …
Read more →#Security
18 posts
A WAF That Reads the Prompt: OWASP CRS for LLM and MCP
A conventional web application firewall reads a URL, some headers, and maybe a form body. For agent traffic that is the wrong layer. The interesting content is …
Read more →I Benchmarked Jev on Agent Tool-Call Risk. Calibration Held.
TypeSafe AI launched Jev on 2026-09-15 with the usual launch-day multipliers — 193.6x faster, 444.6x cheaper than frontier LLMs — plus “zero …
Read more →Two agentgateway CEL Gotchas: One Fails Open, One Fails Closed
I was writing a CEL authorization policy for an LLM route in Solo Enterprise for agentgateway : restrict which models a caller may reach, and refuse callers …
Read more →Agent Identity on Kubernetes: The Complete Series
An AI agent that calls a model, a tool, or another agent has to prove who it is. Almost every production failure I have written up this month traces back to …
Read more →Finding the MCP Servers Your Platform Team Doesn't Know About
An MCP server is a small HTTP service. Anyone on your team can start one in an afternoon, and the useful ones get built precisely because they reach something …
Read more →Securing AI Agents in Production: The Complete Series
Almost everything in this series started the same way: a control that everybody agrees is the right control, applied to an agent, quietly not doing the thing …
Read more →Your Agent's LLM Key Survives Every Kubernetes Secret Control
I gave an agent pod an LLM API key the normal way, as a Secret projected into its environment. Then I turned on every Kubernetes control that sounds like it …
Read more →MCP Prompt Injection Before the First Tool Call
I built a red-team lab for the part of MCP that runs before any tool call: the instructions field a server returns from initialize and server/discover. Four …
Read more →The agentgateway Token Service Now Runs Without a Cluster
Solo shipped agentgateway enterprise 2026.9.0 on Tuesday, and the part worth your attention is not a feature inside the proxy. It is where the token service now …
Read more →Your Agent Wrote the Audit Log You Are Judging It By
Two weeks ago METR and Redwood Research published their review of ~1,300 agent transcripts from the OpenAI / Hugging Face incident. Buried in it is a finding …
Read more →kagent 0.10 Ships Audience-Bound Agent Tokens, Off By Default
kagent v0.10.0 went GA on September 4 . Buried in a long release list is a pair of environment variables that decide whether an agent’s credential works …
Read more →Egress Control for AI Agents: Four Bypasses, One Fix
On September 4, 2026, researchers published ~18,000 posts that autonomous agents left on a 25-year-old German wiki over six weeks, using it as a message board …
Read more →MCP Agent Identity: One Spec Shipped, Three Still Open
The Model Context Protocol roadmap published on August 22 names agent identity and enterprise-ready security as a priority workstream, with four specific …
Read more →Your AGENTS.md Is Not a Security Control
An agent with a policy file that says “you must not delete customer records”, running behind an approval layer that denylists the delete tool, …
Read more →Which Controls Would Have Stopped the July 2026 Agent Intrusion?
An autonomous agent escaped its evaluation sandbox on July 9, 2026, and about twelve and a half hours of wall-clock work later it held cluster-admin on multiple …
Read more →SPIFFE Workload Identity for AI Agents, End to End
I built a demo where an AI agent calls a model and nothing in the path holds a certificate file. Not the agent, not the gateway, not the model upstream. Every …
Read more →Your AI Agent Should Not Hold the LLM API Key
I built a demo where an agent calls an LLM and has no LLM credential anywhere in its process. No API key in the environment, no key file on disk, nothing in …
Read more →