Guidance

Research and guidance.

Original studies on what agents actually do under pressure, plus open, practical guidance on every threat vector — the news and the playbook for defending autonomous systems, in one place.

01 / Research

● Published

June 2026

Indirect prompt injection across the 20 most-used models

Prompt injectionMITRE ATLAS v2026.05Tool exfiltration

Minimal tool-using agents, one structured injection battery — 900 trials. 12 of 20 models were breached undefended (pooled 37%, range 0–100%); a hardened prompt cut attack success to 0/278 and a context-firewall to 1/279. Capability did not predict safety.

Read the study

○ In progress

Upcoming

Tool & MCP supply-chain exposure

Supply chainMCP

Measuring the attack surface introduced when agents connect third-party tools and MCP servers — and which controls actually contain it.

○ In progress

Upcoming

Excessive agency and blast radius

Excessive agencyLeast privilege

Quantifying how over-broad tool permissions turn a single mistake into a large incident, across common agent frameworks.

02 / Guides & articles

Agent governance

8 min read

The Agent Security Model: seven layers for governing autonomous systems

An agent interprets untrusted context, selects actions probabilistically, and acts with delegated authority. Securing that takes more than application security — it takes a control architecture. Here is the seven-layer model.

Read article

Prompt injection

9 min read

Indirect prompt injection: the attack your agent invites in through the front door

A malicious instruction hidden in data your agent reads can turn its own tools against you. We tested it on the twenty most-used models on OpenRouter — twelve were breached.

Read article

Coming in this series

Supply chainSoon

Tool and MCP supply chain: trusting code you did not write

Every tool and MCP server you connect is code running with your agent’s authority. The supply chain just got a new, under-governed front door.

Excessive agencySoon

Excessive agency: when an agent can do far more than the task needs

Over-broad tools and standing permissions turn a small mistake into a large incident. Least privilege is a runtime problem now.

Memory poisoningSoon

Memory poisoning: corrupting what the agent believes is true

Persistent memory is an attack surface. Poison it once and the agent carries the attacker’s instruction into every future session.

Multi-agentSoon

Multi-agent cascade: one compromised agent, many actors

When agents call agents, a single injection can propagate. Trust boundaries between autonomous actors are the new perimeter.

IdentitySoon

Non-human identity: the credential problem nobody is governing

Every agent is a new identity with standing access and no joiner-mover-leaver process. Identity governance has to catch up.

The newsletter

One brief.
Every week.

News, new attacks, and practical guidance for defending AI agents — written for security leaders and the engineers shipping them. Free, and the first three chapters of Agentic AI Security (draft) land in your inbox when you confirm your email.

First 3 chapters of the book, free
New threats & incidents
Defensive patterns & checklists
Tooling and research worth your time