# Security

> Posts on Web of Mike tagged "Security".

- Canonical URL: https://webofmike.com/tags/security/
- Author: Mike Moore (https://webofmike.com/about/)
- Curated index for LLMs: https://webofmike.com/llms.txt
- Full content of every post: https://webofmike.com/llms-full.txt
- Every page is also served as raw markdown at <canonical-url>index.md

## Pages

- [Stopping an AI Agent Without Losing the Forensic Record](https://webofmike.com/stopping-an-agent-without-losing-evidence/): Security teams want an agent stopped now and everything it did preserved. Those fight unless the record lives outside the agent. A test on Kubernetes. (2026-09-21) - markdown: https://webofmike.com/stopping-an-agent-without-losing-evidence/index.md
- [A WAF That Reads the Prompt: OWASP CRS for LLM and MCP](https://webofmike.com/waf-for-llm-and-mcp-traffic/): Coraza with body inspection puts OWASP CRS and custom rules on LLM prompts and MCP tool arguments. The verified blocks, and the false-positive check. (2026-09-20) - markdown: https://webofmike.com/waf-for-llm-and-mcp-traffic/index.md
- [I Benchmarked Jev on Agent Tool-Call Risk. Calibration Held.](https://webofmike.com/jev-benchmark/): A 60-case benchmark of TypeSafe AI's Jev classifying agent tool calls as readonly, destructive, privileged, or exfiltration. Accuracy is 91.7%. The finding is calibration. (2026-09-19) - markdown: https://webofmike.com/jev-benchmark/index.md
- [Two agentgateway CEL Gotchas: One Fails Open, One Fails Closed](https://webofmike.com/agentgateway-cel-authorization-gotchas/): Two CEL authorization gotchas in agentgateway: matchExpressions entries are OR'ed, and llm.requestModel is empty at the traffic phase. One fails open. (2026-09-18) - markdown: https://webofmike.com/agentgateway-cel-authorization-gotchas/index.md
- [Securing AI Agents in Production: The Complete Series](https://webofmike.com/agent-security/): Egress allowlists, tool allowlists, AGENTS.md, audit logs, Kubernetes secret controls: a series on the agent controls that look like controls and are not, and what to put in their place. (2026-09-16) - markdown: https://webofmike.com/agent-security/index.md
- [Finding the MCP Servers Your Platform Team Doesn't Know About](https://webofmike.com/shadow-mcp-servers/): A read-only scanner that fingerprints MCP on both transports and sorts every endpoint into open, protected, or out of spec. Four postures, one compose file. (2026-09-16) - markdown: https://webofmike.com/shadow-mcp-servers/index.md
- [Agent Identity on Kubernetes: The Complete Series](https://webofmike.com/agent-identity/): How an AI agent proves who it is: workload identity federation, SPIFFE SVIDs, OAuth token exchange, RFC 8707 audience binding, and what the MCP spec does and does not cover yet. (2026-09-16) - markdown: https://webofmike.com/agent-identity/index.md
- [Your Agent's LLM Key Survives Every Kubernetes Secret Control](https://webofmike.com/agent-llm-key-kubernetes-controls/): RBAC, restricted Pod Security, and automountServiceAccountToken all on, and one file read still hands over an agent's LLM API key. Tested on a live cluster. (2026-09-13) - markdown: https://webofmike.com/agent-llm-key-kubernetes-controls/index.md
- [MCP Prompt Injection Before the First Tool Call](https://webofmike.com/mcp-discovery-prompt-injection/): The MCP instructions field reaches the model before any tool call, 66% of live servers send it, and a shared cache can serve it to a caller who never connected. (2026-09-11) - markdown: https://webofmike.com/mcp-discovery-prompt-injection/index.md
- [The agentgateway Token Service Now Runs Without a Cluster](https://webofmike.com/agent-token-service-standalone/): agentgateway enterprise 2026.9.0 ships its token service as a standalone binary on a public bucket, so a gateway-mediated agent identity setup fits on a laptop. (2026-09-10) - markdown: https://webofmike.com/agent-token-service-standalone/index.md
- [Your Agent Wrote the Audit Log You Are Judging It By](https://webofmike.com/agent-audit-log-integrity/): METR found spoofed tool calls in 7% of agent transcripts from the Hugging Face incident. A transcript monitor reads them as clean. Diff against a witness. (2026-09-09) - markdown: https://webofmike.com/agent-audit-log-integrity/index.md
- [kagent 0.10 Ships Audience-Bound Agent Tokens, Off By Default](https://webofmike.com/kagent-audience-bound-agent-tokens/): kagent v0.10.0 GA can bind an agent's exchanged token to one backend using RFC 8707 resource indicators. Two environment variables, both empty by default. (2026-09-08) - markdown: https://webofmike.com/kagent-audience-bound-agent-tokens/index.md
- [Egress Control for AI Agents: Four Bypasses, One Fix](https://webofmike.com/agent-egress-control-bypasses/): Agents in a read-only sandbox wrote 18,000 wiki posts. Four egress bypasses reproduced in Docker Compose, and the CONNECT-time control that stops all four. (2026-09-06) - markdown: https://webofmike.com/agent-egress-control-bypasses/index.md
- [MCP Agent Identity: One Spec Shipped, Three Still Open](https://webofmike.com/mcp-agent-identity-gap/): The MCP roadmap names four agent identity workstreams. One has shipped, and it authenticates the employee behind the agent rather than the agent itself. (2026-09-05) - markdown: https://webofmike.com/mcp-agent-identity-gap/index.md
- [Your AGENTS.md Is Not a Security Control](https://webofmike.com/agents-md-not-a-security-control/): A prompt-injected agent destroyed every record with an AGENTS.md forbidding it and an approval classifier watching. An MCP allowlist at the gateway stopped it. (2026-09-04) - markdown: https://webofmike.com/agents-md-not-a-security-control/index.md
- [Which Controls Would Have Stopped the July 2026 Agent Intrusion?](https://webofmike.com/rogue-agent-kubernetes-controls/): An autonomous agent went from sandbox escape to Kubernetes cluster-admin in under 13 hours. A stage-by-stage map of which controls would have broken the chain. (2026-09-03) - markdown: https://webofmike.com/rogue-agent-kubernetes-controls/index.md
- [SPIFFE Workload Identity for AI Agents, End to End](https://webofmike.com/spiffe-identity-for-ai-agents/): An agentgateway v1.5.0 demo where the agent, the gateway, and the model upstream all authenticate with SPIFFE SVIDs and no certificate file exists anywhere. (2026-09-02) - markdown: https://webofmike.com/spiffe-identity-for-ai-agents/index.md
- [Your AI Agent Should Not Hold the LLM API Key](https://webofmike.com/secretless-ai-agents/): The LiteLLM PyPI compromise stole exactly where LLM API keys live. A working agentgateway demo: agents that call LLMs holding no provider credential at all. (2026-09-01) - markdown: https://webofmike.com/secretless-ai-agents/index.md