EU AI Act Article 12: What Tamper-Evident Logging Means for AI Agents
EU AI Act Article 12 requires automatic, tamper-evident logs with traceability for high-risk AI. What that means for AI agents and how to produce one.
// research & write-ups
blog
How to Secure Claude Code and Cursor: A Practical Guide
A practical guide to securing AI coding agents: least privilege, gating tool calls, auditing MCP servers, and a runtime boundary around agent actions.
MCP Tool Poisoning, Explained: How a Tool Description Becomes an Attack
MCP tool poisoning hides instructions in a tool's description so an AI agent obeys the attacker while appearing to do your task. How it works and how to defend.
What Can an AI Coding Agent Actually Do on Your Machine?
AI coding agents run with your full privileges — shell, files, keys, MCP servers. What they can actually do, where it goes wrong, and how to gate it.
API Security: The OWASP API Security Top 10
A breakdown of the OWASP API Security Top 10: BOLA, broken authentication, excessive data exposure and more. How APIs are attacked and how to secure them.
SSRF: Server-Side Request Forgery Explained
What SSRF is, how attackers make your server reach the internal network and cloud metadata, what it leads to (up to RCE) and how to defend. A practical breakdown.
Cross-Site Scripting (XSS): Types, Attacks & Defense
What XSS is, how reflected, stored and DOM-based differ, how attackers steal sessions and data, and how to defend your site. A practical breakdown of cross-site scripting.
IDOR & Broken Access Control: How Attackers Reach Other Users’ Data
What IDOR (Insecure Direct Object Reference) is, how attackers reach other users' data by swapping an id, what it leads to and how to defend. A practical breakdown.
Agentic AI Threat Modeling, Explained
What agentic AI threat modeling is and how to map trust boundaries, tools and actions for autonomous agents before you build — using OWASP Agentic and the MAESTRO approach.
LLM Jailbreaks: How Attackers Bypass Guardrails
What an LLM jailbreak is, the main techniques (role-play, encoding, multi-turn), and how to defend the model. Why guardrails are a barrier, not a wall.