AI security

Connected Apps and MCP Security: Permissions, Data, and Actions

Security analysis of connected apps, external tools, and remote MCP servers as capability, scope, approval, disclosure, and side-effect control surfaces.

Published 2026-03-30

Tool-Using LLM Systems: Privilege Bleed and Integrity-Signal Failures

Two vendor-agnostic control-plane failure patterns—privilege persistence across interaction boundaries and non-enforcing integrity signals—that allow untrusted state to steer tool execution across steps.

Published 2026-02-22

AI Agent Orchestration Loops: Security Risks and Controls

How multi-step orchestration (controller) loops change the threat model in tool-using systems, and where to enforce separation, authorization, validation, and budgets to reduce prompt injection, tool misuse, unsafe writes, and unbounded consumption.

Published 2026-02-22

Gmail and WhatsApp AI Agents: Private-Message Security Risks

How Gmail and WhatsApp content can steer tool-using AI agents, and how least privilege, explicit approval, provenance, memory controls, and audit logs reduce risk.

Published 2026-05-28

How a Forged Message Can Hijack an AI Workflow

A forged message can turn a release review into an unauthorized deployment. Follow the handoff between AI agents to see why message verification and action authorization require separate checks.

Published 2026-09-09

LLM Integration Trust Boundaries: Threat Modeling Before AI Agents

Why LLM security begins at the integration layer: it turns model inputs and outputs into access to data, system actions, and persistent artifacts before an agent loop exists.

Published 2026-02-22

LLM Improper Output Handling: Risks, Controls, and Test Cases

A sink-aware security model for validating, authorizing, encoding, and testing LLM output before it reaches browsers, databases, shells, code runtimes, tools, or privileged workflows.

Published 2026-08-04

LLM Prompt Assembly Security: Policy and Untrusted Data

An engineering guide to preventing authority confusion in prompt assembly by separating authoritative policy from untrusted content with typed provenance.

Published 2026-02-22

LLM Prompt Injection: OWASP Boundary Failures and Controls

An architecture-level mapping of prompt-injection-related LLM application failure modes to OWASP LLM Top 10 and NIST AI risk-management categories.

Published 2026-06-21

LLM Boundary Assurance Failures: Client-Captured Security Report

Client-observed security report on text-only confirmations of privileged state or actions where the public article does not include signed backend audit artifacts. Backend state changes are not independently verified in this public report.

Published 2026-02-22

Request Assembly Threat Model for AI Agents

A reviewer-oriented threat model for request assembly in AI assistants: what enters context, what gets prioritized or dropped, and where policy, tool, memory, retrieval, and audit checkpoints should be reviewed.

Published 2026-02-22

Role-Play Jailbreaks: A Testable False-Premise Mechanism

A research-grounded analysis of how role-play may introduce a false safety premise that changes an LLM's interpretation of a restricted request.

Published 2026-08-27

Social Engineering in AI Systems and Decision Pipelines

Threat model of social engineering against AI decision pipelines; maps prompt injection to enforcement controls outside the model (PDP/PEP, validation, budgets).

Published 2026-02-22

AI Agent Security Audit: 8 Trust-Boundary Checkpoints

A practical audit of eight trust boundaries where untrusted content can influence context assembly, planning, tool routing, write actions, and egress.

Published 2026-06-09

Web Retrieval Prompt Injection Boundary in LLM Systems

A threat model for browsing-enabled and tool-using LLM systems where retrieved web content can steer routing, tool arguments, follow-up calls, or side effects.

Published 2026-03-25

Protect Gmail and WhatsApp Data in AI Agent Workflows

Protect Gmail and WhatsApp data when AI agents access private messages, attachments, tools, connected apps, and backend workflows.

Instruction hierarchy and evidence boundary

Add this component when a workflow must preserve instruction priority, treat external or uploaded content as untrusted data, and bind the answer to one active evidence policy.

Effective Privileges: Provenance and Replay Failure Diagram

Reference diagram showing two common failures: chat-derived context influencing effective privileges, and model output persistence/replay into later context; highlights the server-side AuthZ + authoritative state invariant.

Provenance Boundary Failure — Prompt Assembly Diagram

Reference diagram of a provenance boundary failure in prompt assembly, where untrusted input is misclassified as authoritative policy.

Request assembly / context selection — attack surface (summary)

Summary schematic of the request-assembly boundary highlighting common failure modes: instruction injection, precedence confusion, truncation, provenance loss, and memory poisoning.

Web tool access — prompt injection risk map

Reference schematic of prompt-injection risk in web tool access: routing manipulation and downstream failure modes (content-based instructions, source poisoning, query leakage, unbounded consumption, improper output handling).