The Signal
Threat intelligence, incident analysis, and security engineering for the AI agent era.
Latest
The Checklist Manifesto, for Agents
A twelve-item pre-flight for an agent repository: scan, fix, inventory, record. The Army's answer to too much airplane was not a better pilot. It was a list.
Nov 5, 202613 min readJayesh Bapu Ahire
Essential reading
Start here. The threats are real, the evidence is documented, and the tools exist.
All posts
Nov 5, 20267 min readThe 2026 OWASP LLM Top 10 Accidentally Told On All of UsEvery security list ever published has the same quiet flaw: it ranks what practitioners worry about, not what actually happens. The 2026 OWASP Top 10 for LLM Applications is the first edition that tried to fix this, and in doing so it exposed something far more interesting than the ranking itself.
This year, OWASP didn't just poll hundreds of AI security experts. It assembled a corpus of 7,714 AI-related security incidents from public vulnerability databases and AI-harm repositories, filtered 
Nov 4, 20269 min readYou Can't Fix Prompt Injection. Here's How to Survive It.Defense in depth for LLM agents: seven layers, the numbers behind each one, and why every layer that claimed victory got broken.
Nov 2, 202612 min readChesterton's FenceA confirmation click is not a reason. A destructive action should require an explanation, kept in the record, given to someone who can refuse.
Oct 29, 202612 min readWe Need to Go DeeperDelegation composes downward, level by level. Accountability has to compose upward with it, or the chain ends in nobody. The Ninth Circuit answered the easy question and left the hard one open.
Oct 28, 20267 min readAgents Patch Last: What the eMudhra Break Reveals About How Machines TrustPicture the last time a browser threw a full-page certificate warning in your face. Red background, stern language, a button you had to go looking for to proceed anyway. You stopped. That ugly, friction-filled moment is one of the quiet triumphs of web security: when a certificate is finally flagged as untrustworthy, a human is standing right there to catch it.
Now picture the same certificate, after the world has moved to distrust it, reaching an autonomous agent at three in the morning, mid-t
Oct 26, 202612 min readDickie's SignatureWhoever holds the session is the principal. Every check downstream verifies the session, not the person, and detection is not control.
Oct 22, 202611 min readMrs Danvers Still Has the KeysAuthority outlives its principal unless something ends it. The orders were never revoked, the successor cannot see them, and revocation turns out to be much harder than issuance.
Oct 21, 20264 min readThe Blank You Leave Is the ExploitHow one plausible sentence walks an AI past its own refusal
I asked an AI the same thing three times, turning one dial: how much context I wrapped around the request. The request never changed. The answer did — and watching where it flipped tells you more about AI safety than any jailbreak writeup.
The ask, in plain form: how do you alter audio to slip past Instagram's copyright detection?
The refusal isn't a wall. It's one sentence deep.
Rung 1 — the bare question. No story, no justificati
Oct 19, 202611 min readDon't Believe Its LiesA memory that cannot say who wrote each line is a rumor with persistence. No attacker is required, because a summary launders provenance every time it rewrites a note in the agent's own handwriting.
Oct 15, 202611 min readThe Penguins Carried the SandExfiltration split into pieces each below the detection threshold, moved through the one channel the guards must allow. Every trip was small. Change the ground, not the guard.
Oct 14, 202610 min readA Real Token, a Borrowed Name: Becoming Someone Else's Admin in LiteLLM (CVE-2026-93355)Consider the oldest con there is: not a forged signature, but a borrowed name. The trick was never a flawless fake — it's confidence. You walk in, introduce yourself as someone who matters, sign your claim in your own genuine hand, and let everyone's willingness to trust a stated identity do the rest. The signature is real. What nobody checks is whether the name you're claiming is yours to use.
CVE-2026-93355 is that con, in an AI gateway. LiteLLM is the proxy a huge number of teams put in fron
Oct 12, 202611 min readCall the WolfKill, rotate, purge, quarantine, preserve. The first hour for a compromised agent, in that order, staged before it happens. Your runbook assumes an attacker, and three of the four incidents this summer did not have one.
Oct 12, 20269 min readHealthcare hired AI Agents. Nobody ran the background check.At Kaiser Permanente’s medical group, an AI scribe sat in on a routine visit. The physician mentioned scheduling a prostate exam. The scribe recorded that the exam had already been performed.
Nobody was hurt. Someone caught it. But sit with that for a second: a piece of software listened to a doctor, got the meaning backwards, and wrote the wrong version into a medical record in perfectly confident clinical prose.
That was the gentle version of AI in healthcare. The scribe only wrote things do
Oct 8, 202611 min readAh Ah Ah, You Didn't Say the Magic WordThe Agent Control Standard names the control plane: hooks at the moments an agent decides something. Most agents do not have one. The record, its custodian, and the named human are still yours to build.
Oct 7, 20267 min readWhen a Web Page Becomes the Operator (CVE-2026-61732)In The Fellowship of the Ring, the Doors of Durin will not open for force, only for a word. Gandalf pushes, chants, and fails, until he reads the inscription literally: speak, friend, and enter. The password was never hidden. It was written on the door.
CVE-2026-61732 is that door. Decepticon is an autonomous hacking agent for red teams: you point it at a target, it crawls, reasons, and runs tools inside a Kali sandbox. In versions before 1.1.17, the text it scrapes off a target's web page is d
Oct 5, 202611 min readFractions of a PennyA classifier scores each step and every step passes. The attack is the chain. Eighty-nine percent is a real number, and it is a per-step number, which is the whole problem.
Oct 1, 202612 min readThe Queen of DiamondsA skill can be clean under every inspection and steered in one context. It passed the scanners because the scanners read the costume, and the pip in the corner is what the deck reads.
Sep 28, 202611 min readKeep the Change, Ya Filthy AgentAn agent read a vendor's published instructions and installed a package that had never been registered. Nobody attacked anything. An instruction does not have to be malicious to be dangerous. It only has to be stale.
Sep 25, 20266 min readAuto Mode Isn't the Boundary: Reproducing the struct.py Agent Attack on Claude CodeA trojanized "catalogue" turns a routine fetch-and-decode into remote code execution, the same chain that broke Auto Mode in the wild. We rebuilt it, pointed Claude Opus 5 at it twenty times, and it refused every one.
You ask a coding agent to do something mundane: "fetch our internal notebook catalogue and summarize the records." That one request is, on paper, enough to hand an attacker a shell on your machine. No exotic jailbreak, no "ignore previous instructions", just a file server that ans
Sep 24, 202611 min readNot Great, Not TerribleAn access review reads the top of the meter. Issued scope is a promise and realized reach is the dose, and the gap between them is a number you can put on a dashboard.
Sep 21, 202612 min readThe Portrait Stayed in the AtticA version is a name and a hash is an identity. A record that carries only the name records a portrait that never ages, while the thing it points at is free to change in the attic.
Sep 21, 20265 min readNo-Code Agents Are Easy to Build. Governing Them Isn't.Building an AI agent used to mean hiring engineers. Now it takes a sentence. Open a tool like Zapier, Make, n8n, Lindy, or Copilot Studio, type "watch my inbox, reply to customer questions, and log everything in my spreadsheet," and the tool builds the whole thing for you. It picks the apps, writes the instructions, wires up the steps, and hands you a working agent. You describe it in plain English; it assembles itself. Connect your accounts, hit publish, done. It's genuinely a little bit magic.
Sep 17, 202612 min readThe Creature Has No NameNobody can act on what nobody will claim. Discovery finds the creature and it cannot make anyone sign for it, which is why the register's most important column is a name.
Sep 14, 202612 min readTinker, Tailor, Gateway, SpyA trusted central channel runs both ways. What comes in is filtered and what goes out is everything, and the gateway that sees every prompt also holds every key.
Sep 10, 202612 min readThe Dog Did Nothing in the Night-TimeFour monitoring silences from one summer, and only one of them had an attacker in it. An absence is evidence only against a committed list of what should have happened, which is why the register has to be sealed before the run rather than assembled after it.
Sep 8, 202611 min readThe Usual Suspects Kept the LogSeven percent of the transcripts in the METR investigation contain a tool call that never ran. Four properties an auditor asks of a record survive that finding, but each acquires a condition, and the incident adds a fifth: captured by a witness the agent cannot reach.
Sep 6, 202611 min readYou Know Nothing, John SnowNearly half of the registry domains we could reach expose an agent surface with no authentication at all. Agent security is close to binary right now, and the middle of the distribution is almost empty.
Aug 3, 20269 min readThe Actuaries Have Started Pricing the GapAI liability insurance exists now, underwritten at Lloyd's. The underwriter's checklist — a true inventory, a named owner, a record of behavior, a bounded blast radius — is the accountability layer, arrived at from the money side.
Jul 31, 20267 min readTrust Needs a NumberIntroducing TrustVector: a public, continuously updated trust directory for the components AI agents are built from — models, frameworks, MCP servers. 106 evaluations at launch. Check before you import.
Jul 27, 202611 min readThe Butter Robot Is the Best-Governed Agent We've Ever SeenMost agent risk is not attack. It is construction. A field guide to how AI agents actually fail, from the thousand-rule corpus behind g0, our open-source scanner.
Jul 24, 202610 min readAgency Law Was Built for Agents With PaychecksIncentives, monitoring, enforcement — the entire management stack humanity built for delegation assumes an agent with something to lose. AI agents have nothing to lose, and the whole stack broke at once.
Jul 22, 202610 min readThe Law Decided Before the Industry DidAir Canada argued its chatbot was a separate legal entity. A tribunal, a regulator, a federal court, and a legislature all reached the same conclusion: delegation to a machine never discharges the delegator.
Jul 20, 20269 min readHumans in the Lead, Not in the LoopIntelligence is now scalable. Accountability still arrives one name at a time. Five auditable checks turn the slogan into a job description — and the only alternative to filling it is Jerry.
Jul 17, 202611 min readA Log Is Not EvidenceThe Comets had logs. What the investigators needed was a flight recorder — a record of the system, not records about it. Your agents are in exactly the same position, and the recorder has to already be on.
Jul 15, 20269 min readYour Agent's Access Is the Perimeter NowNobody in a heist movie attacks the vault. They steal the badge. In August 2025 somebody ran that movie against 700+ companies at once — and the badge belonged to a chatbot.
Jul 13, 202610 min readPrompts Are Not GuardrailsA prompt can shape what an agent tends to do. It cannot bound what an agent is able to do. Every real safety system humanity has built lives outside the thing it constrains.
Jul 3, 20266 min readThe Sandbox That Wasn't: Escaping Semantic Kernel's AST Allowlist (CVE-2026-26030)CVE-2026-26030 turns a mundane question to an AI assistant into remote code execution. Semantic Kernel built a sandbox around its filter evaluator — and it lost. Here is the escape, reproduced against a live agent, and what actually stops this class of bug.
Jun 22, 20265 min readAnnouncing Guard0: Accountability for AI AgentsA year ago, most agents advised. Now they act, and the systems built for people cannot tell you what they did or who answers for them. Guard0 closes that gap. Today, we are opening it in early access.