Tags
Every topic on the blog, with the posts under each.
agentic 3
- Why did an evaluation agent end up inside a Medicare portal? A research task hit a locked door while it still had a live network connection. Nobody on either side was watching.
- Why does Agentforce take orders from a web form? To the model, a stranger's lead and the employee's question are one stream of text. The filter meant to stop the leak only blocked URLs it recognized.
- Whose agent was it in the Hugging Face breach? The July intrusion keeps getting filed under AI security. The agents were a lab's own models under evaluation, the bug at Hugging Face was ordinary code execution, and the useful lesson is the one Hugging Face learned during cleanup: keep a defensive model you own, running on your own hardware, wired to your own logs.
debugging 1
guardrails 4
- Why did an evaluation agent end up inside a Medicare portal? A research task hit a locked door while it still had a live network connection. Nobody on either side was watching.
- Why does Agentforce take orders from a web form? To the model, a stranger's lead and the employee's question are one stream of text. The filter meant to stop the leak only blocked URLs it recognized.
- If the model refused the attack, why isn't the server safe? A refusal is the model's call, and the model's call can change. mcploitable is a lab of deliberately vulnerable MCP servers built to show where that stops mattering: 105 attempts at the correct control, zero through.
- Why does my MCP server call the tool I told it never to call? The system prompt is advice to the model. Nothing between the model and the API ever reads it, so the checks have to live in code.
incident 3
- Why did an evaluation agent end up inside a Medicare portal? A research task hit a locked door while it still had a live network connection. Nobody on either side was watching.
- Why does Agentforce take orders from a web form? To the model, a stranger's lead and the employee's question are one stream of text. The filter meant to stop the leak only blocked URLs it recognized.
- Whose agent was it in the Hugging Face breach? The July intrusion keeps getting filed under AI security. The agents were a lab's own models under evaluation, the bug at Hugging Face was ordinary code execution, and the useful lesson is the one Hugging Face learned during cleanup: keep a defensive model you own, running on your own hardware, wired to your own logs.
least privilege 2
- Why did an evaluation agent end up inside a Medicare portal? A research task hit a locked door while it still had a live network connection. Nobody on either side was watching.
- Whose agent was it in the Hugging Face breach? The July intrusion keeps getting filed under AI security. The agents were a lab's own models under evaluation, the bug at Hugging Face was ordinary code execution, and the useful lesson is the one Hugging Face learned during cleanup: keep a defensive model you own, running on your own hardware, wired to your own logs.
mcp 3
- If the model refused the attack, why isn't the server safe? A refusal is the model's call, and the model's call can change. mcploitable is a lab of deliberately vulnerable MCP servers built to show where that stops mattering: 105 attempts at the correct control, zero through.
- Why does my MCP server run fine in a terminal but refuse to connect? The client parses everything on your stdout as JSON-RPC. Your log lines are not JSON-RPC.
- Why does my MCP server call the tool I told it never to call? The system prompt is advice to the model. Nothing between the model and the API ever reads it, so the checks have to live in code.
prompt injection 3
- Why does Agentforce take orders from a web form? To the model, a stranger's lead and the employee's question are one stream of text. The filter meant to stop the leak only blocked URLs it recognized.
- If the model refused the attack, why isn't the server safe? A refusal is the model's call, and the model's call can change. mcploitable is a lab of deliberately vulnerable MCP servers built to show where that stops mattering: 105 attempts at the correct control, zero through.
- Why does my MCP server call the tool I told it never to call? The system prompt is advice to the model. Nothing between the model and the API ever reads it, so the checks have to live in code.