Safe by Default: Building Agents That Can't Wreck Your Data
Read/write enforcement, principal scoping, approval gates, sandboxes and budgets: five safety properties, every one enforced in code, not in a prompt.
Agent Harness03
Subject · 14 posts
security
LLM Security in Practice: A Checklist and the Mindset Behind It
The whole series as a checklist, plus the one habit that generates it: assume the model is compromised, and design so that assumption is survivable.
LLM and Agent Security06
Exfiltration Through the Model's Mouth: Output Is an Attack Surface
The model's output came from your trusted system, so it feels safe. It is not: untrusted input shaped it, and one rendered image can carry your data to the attacker.
LLM and Agent Security05
Sensitive Data: Masking PII and Keeping Secrets Out of the Model
The safest data is the data the model never sees. Masking PII, keeping secrets out of context, and stopping leaks into logs, training, and other users.
LLM and Agent Security04
The Agent's Blast Radius: Giving a Confused Deputy Hands
A chatbot that is wrong is embarrassing. An agent that is wrong took an action. The security of a tool-calling agent is the security of what you connected it to.
LLM and Agent Security03
Prompt Injection: Direct, Indirect, and Why Filtering Fails
The signature attack on language models. How instructions hide in the text a model reads, why you cannot filter your way out, and what containment looks like.
LLM and Agent Security02
Why AI Security Is a New Problem: The Model Has No Data Channel
Every security bug in the last series was data mistaken for code. A language model makes that its whole way of working: to it, all text is instructions.
LLM and Agent Security01
Network Security: Who Are You Actually Talking To?
On a network the confusion is not data and code but identity. What HTTPS really guarantees, what it does not, and why a padlock is about the pipe, not the site.
Security From the Ground Up07
Binary Exploitation: When Data Overwrites Code's Own Bookkeeping
The oldest confusion of data and code, at the lowest level. How writing past a buffer can hijack a program, and the four defences that made it hard.
Security From the Ground Up06
Broken Access Control: Logged In Is Not the Same as Allowed
The most common serious web bug is also the most boring: the server checks who you are, then forgets to check whether you may touch this particular thing.
Security From the Ground Up05
Cross-Site Request Forgery: Making the Victim's Browser Do It
The attacker never steals the session. They get the victim's own browser to send an authenticated request, using cookies the browser attaches for them.
Security From the Ground Up04
Cross-Site Scripting: Running Your Code in Someone Else's Browser
The same bug as SQL injection, moved to the browser. How attacker text becomes attacker script in your users' sessions, the three flavours, and the layered fix.
Security From the Ground Up03
SQL Injection: When Your Query Is Written by the Attacker
The clearest case of data becoming code. How a login form ends up running the attacker's SQL, why escaping is the wrong fix, and the one that actually ends it.
Security From the Ground Up02
What Security Actually Is: Trust Boundaries and the Two Master Bugs
Security is not a product you add. It is a property of where you decide to trust, and almost every vulnerability is one of two confusions crossing that line.
Security From the Ground Up01