// AI SECURITY · ATTACK PATHS · ENGINEERING DECISIONS
Evidence-led field notes on AI agents, LLM and MCP security, trust boundaries, and practical AppSec controls. No recycled headlines. Each note ends in a decision.
// TESTABLE CLAIMS, PRIMARY SOURCES, AND PRACTICAL AI-SECURITY CONTROLS
PraisonAI patched thirteen advisories in August. In October the same component classes broke again. Four checks that measure whether a fix will hold.
Eight vLLM advisories in forty eight hours share one root cause: the cache key was deciding tenant isolation. Four checks that test it properly.
AnyIO accepted extra_groups=[] and kept the parent’s supplementary groups. Silent inaction is worse than absence, because the caller believes the work is done.
An agent memory layer accepted any JWT with its signature unchecked. The remedy is an unreachable endpoint, and unreachable is a circumstance, not a control.
A vm2 read-only proxy forwarded method calls, so sandboxed code subscribed to a host event and received live credentials. Containment is a channel problem.
MCP tool traffic mirrors C2 beaconing closely enough that Suricata and RITA score it 0.0. Detection cannot carry a load when both kinds measure alike.
Five papers in three days and a 9.9 in the wild describe one gap: an agent’s authority is resolved from a source nobody named. The four places it comes from.
A config rename turned authentication off and the dashboard came up open. The rename is not the bug: a security control that fails open is.
Loading a model runs code, and three advisories published this week show the controls you configure are only honoured where the code chooses to read them.
An AI platform guarded one sign-in path and left a second unguarded. Revocation is only as sharp as every path that can mint a session.