Series
Posts that are meant to be read in order. Each series lists its parts oldest first.
Guardrails belong in the server 2 parts
A model can be talked out of a rule, so the checks live in server code. The argument, then the lab built to test it.
- Part 1 Why does my MCP server call the tool I told it never to call? The system prompt is advice to the model. Nothing between the model and the API ever reads it, so the checks have to live in code.
- Part 2 If the model refused the attack, why isn't the server safe? A refusal is the model's call, and the model's call can change. mcploitable is a lab of deliberately vulnerable MCP servers built to show where that stops mattering: 105 attempts at the correct control, zero through.
Incident writeups 3 parts
Incidents where an AI agent was involved, and the ordinary controls that would have limited each one.
- Part 1 Whose agent was it in the Hugging Face breach? The July intrusion keeps getting filed under AI security. The agents were a lab's own models under evaluation, the bug at Hugging Face was ordinary code execution, and the useful lesson is the one Hugging Face learned during cleanup: keep a defensive model you own, running on your own hardware, wired to your own logs.
- Part 2 Why does Agentforce take orders from a web form? To the model, a stranger's lead and the employee's question are one stream of text. The filter meant to stop the leak only blocked URLs it recognized.
- Part 3 Why did an evaluation agent end up inside a Medicare portal? A research task hit a locked door while it still had a live network connection. Nobody on either side was watching.