Darinor

"Ask the User to Approve" Is Not a Security Control www.darinor.com/blog/human-i... #AgenticAI #AgentArchitecture #HumanINTHELOOP #DetectionEngineering

CSP Nonces and the Same-Origin Policy Solve Different Problems www.darinor.com/blog/csp-non... #Appsec #WEBSecurity #CSP

How to Build an Agent Audit Trail Before You Need It www.darinor.com/blog/how-to-... #AgenticAI #IncidentResponse #DetectionEngineering #AgentArchitecture

Approval is a request for the agent to be trusted. Containment is what stays true when it isn't. One lives in the model's behavior; the other lives in the environment. And only one of them survives a bad day.

The Same-Origin Policy Is Only as Strong as Your Browser Agent www.darinor.com/blog/agentic... #AISecurity #AgenticAI #PromptInjection #Appsec

“The agent with access to find every weakness is the agent with access to exploit every weakness. Offensive capability and insider threat are the same thing wearing different labels.”

“The difference between seeing an agent and controlling it is the difference between an inventory entry and a security architecture.”

“Sixteen thousand servers appeared in months. Authorization is optional. STDIO transport has no authentication. The protocol's own specification treats security as someone else's problem.”

“The fundamental shift is from testing what the model says to testing what the agent does. Output text is a risk. Executed actions are a threat.”

“The web security model was built around the idea that a human sits between tabs and decides what crosses. Agentic browsers remove that human from the loop, and the isolation model has not caught up.”

“Agents execute high-impact actions without clear attribution chains. The credential says human. The action was autonomous. The audit trail stops at a shared service account.”

“The difference between seeing an agent and controlling it is the difference between an inventory entry and a security architecture.”

Gartner, on the CTEM gap: Seventy-one percent of organizations could benefit from CTEM, and 60 percent are actively pursuing it, but the gap between intent and execution remains the core challenge. #CTEM #Security #RiskManagement

Your Agent Is Impersonating You www.darinor.com/blog/delegat... #AgenticAI #AISecurity #WorkloadIdentity #MCP

This one keeps coming back to me: "GhostApproval is a reminder that agent security is not only about what the model decides. It is about what the tool shows the user, what the environment allows the tool to touch, and where the trust boundary really sits." #AICoding #AIAgents #Security

A defensive agent with the power to contain a breach is a defensive agent with the power to cause one. Authority without verification is another attack surface. e.q. a containment ‘kill‑switch’ can isolate or erase systems. Mitigate with least privilege, attestations and audits. #AISecurity

"Twenty-six percent of tool calls violated policy when safety was a prompt rather than a gate. That number is the argument for infrastructure-layer governance." #MCP #AIAgents #Governance

Workload identity verifies an agent is genuine. Agentic identity verifies it's authorized to act e.q. roles, policies, or permissions granting the requested access. Together they enforce trust and least privilege. #CloudSecurity #Identity #Agentic

Stealing an AI coding assistant's API key is not credential theft in the traditional sense. It is theft of a trusted actor that already has permission to act on behalf of the developer. #npm #SupplyChain #AIAgents

Every pillar of identity management: authentication, access control, authorization, auditing, administration, and availability, must be rebuilt for entities that act in seconds, not days, and whose permissions must expire when the task does. #AIAgents #IdentitySecurity

The agent does not need to know which button to click. It needs to know what outcome to produce and which tools are available to produce it. APIs, integrations, or human handoffs, so it can plan, adapt and execute #Automation #AIAgents

A defensive agent with the power to contain a breach is a defensive agent with the power to cause one. Authority without verification is another attack surface. e.q. a containment ‘kill‑switch’ can isolate or erase systems. Mitigate with least privilege, attestations and audits. #AISecurity

Workload identity verifies an agent is genuine. Agentic identity verifies it's authorized to act e.q. roles, policies, or permissions granting the requested access. Together they enforce trust and least privilege. #CloudSecurity #Identity #Agentic

"Twenty-six percent of tool calls violated policy when safety was a prompt rather than a gate. That number is the argument for infrastructure-layer governance." #MCP #AIAgents #Governance

How to Vet an MCP Server Before You Install It www.darinor.com/blog/how-to-... #AgenticAI #AISecurity #MCP

The agent cannot access data the engineer could not access. But can it make decisions the engineer would not have made? Access is a ceiling. Judgment is the actual risk surface. #aiagents #governance #security

A protocol without authentication is not a protocol with a vulnerability. It is a protocol with no security design. MCP shipped 150M SDK downloads before the security model caught up. The fix is design, not patching. #mcp #aiagents #supplychain

Advisory hints that models can ignore are not guardrails. They are suggestions to a non-deterministic system that will occasionally ignore them. Safety as a prompt fails at scale. Safety as a gate is the only version that holds. #aiagents #security #llm

The npm self-replicating worm, in one line: "The attacker did not break npm. They broke the process that npm trusts. The fix is not stronger locks on the registry door, it is harder locks on the publishing pipeline itself." #npm #supplychain

MCP over SSE, on why the transport challenge is real: "MCP is a protocol that assumes infrastructure maturity. Most teams do not have that maturity yet. They have REST APIs behind load balancers with 60-second timeouts. Infrastructure architect, enterprise AI platform" #mcp #protocol

The model can be doing exactly what the user asked and still produce a compromise because the user was not shown the real destination. The UI is part of the security boundary. If the agent shows one thing and does another, the approval was never real. #aiagents #security #ux

RPA does not automate processes. It automates screen interactions. When the screen changes, the automation stops. Agentic automation is the opposite: it knows the outcome, not the button. #automation #aiagents #rpa

The platform war over AI agents will not be won by the framework with the best model. It will be won by the runtime that can contain the agent. Capability is table stakes. Containment is the differentiator. #aiagents #infosec #buildinpublic

Static API keys are the SSH keys of the agent era, long‑lived, widely copied, seldom rotated, and impossible to scope, creating lateral‑movement risks across hosts and clouds. Workload identity fixes this with short‑lived cryptographic proof of what a workload is. #workloadidentity #aisecurity

"Memory poisoning does not look like an attack. It looks like the system working as designed, except the design now includes attacker-authored ground truth." Persistent memory without integrity verification is a loaded weapon pointed at every downstream decision. #aiagents #security #memory

Threat Modeling for AI Agent Systems www.darinor.com/blog/threat-... #ThreatModeling #Appsec #AgenticAI

Access control decides who may act; it doesn't determine what a non-deterministic agent will do next. Authorization ≠ governance. The decision layer needs its own runtime policies, guardrails, audit logs and active monitoring (e.q behavior checks, feedback loops). #aiagents #governance

Agentic attacks mimic normal workflows. Prompt injection, memory poisoning, tool abuse. Defending agents requires policy-as-infrastructure: centralized policies, access & provenance checks beyond signatures. #aiagents #security

The part that never makes the demo: "Visual Inception achieves a goal-hit rate of four in five tested multimodal agents — a sleeper trigger invisible to any text-based security scanner." #agent #memory #poisoning

Filed under: the part nobody quotes. "The risky design is not a Sentry bug. It is the combination of public-write ingestion, MCP-read transport, and agent-execution authority. Three trusted components become a single remote-code path." #agentjacking #fake #sentry

Agentjacking: Fake Errors Can Make Your Coding Agent Run Attacker Code www.darinor.com/blog/agentja... #AgenticAI #AISecurity #MCP #SupplyChain

This is the line I think about most: "Agentic identity is not just about access control. It is the convergence of accountability, sovereignty, and delegation — preserving human intent, not just human credentials." #agentic #identity #perimeter

How AI Agents Exfiltrate Data — Five Paths Your DLP Was Never Built For www.darinor.com/blog/ai-agen... #AgenticAI #AISecurity #DATALOSSPrevention #DLP

Read this twice: "The 64-point gap between testing and production is not a technology gap. It is a governance gap. The technology works in bounded domains with proper controls. The challenge is establishing those controls fast enough to prevent the 40%..." #agentic #enterprise #deployment

Your front-row seat to AI x cyber defense. 70 voices: threat intel, LLM security, appsec, AI governance — no spam, no bots. Real people building the intersection. Join the pack: https://bsky.app/starter-pack/darinor.com/3ms6xkwmnlh2l

How to Red Team an AI Agent (Before It Gets Red Teamed for You) www.darinor.com/blog/how-to-... #AgenticAI #Security #REDTeaming #Guides

AI Agent Memory Poisoning: How to Audit and Harden Your Agent www.darinor.com/blog/ai-agen... #AISafety #AgentMemory #MemoryPoisoning

Workload Identity Federation for AI Agents: Kill the Static Key www.darinor.com/blog/workloa... #WorkloadIdentity #AgenticAI #OIDC #Security

The detail most takes skip: "Prompt-based safety is a request. OS-enforced policy is a constraint. They are not interchangeable." #agent #governance #layer

Open Knowledge Format (OKF): Google's Answer to the AI Agent Context Problem www.darinor.com/blog/open-kn... #AgenticAI #OPENKnowledgeFormat #KnowledgeManagement #AISecurity