#security
Every post tagged "security".
27 posts · showing 21–27
-
Sandboxing Code Execution: What a `run_code` Tool Actually Needs
One tool replaces dozens — and hands a model that reads untrusted text a general-purpose mechanism for doing anything the process can do. Four boundaries, four isolation levels, and the one people leave open.
-
Run, Session, or Global? Scoping Agent Memory Correctly
Too-small a scope produces a visible annoyance; too-large produces a silent wrong answer. One question assigns any fact correctly, and one rule keeps multi-tenant reads from becoming an incident.
-
MCP: What a Standard Tool Protocol Changes, and What It Doesn't
Portable integrations and runtime discovery are real wins. Tool design, selection accuracy, permissions, and untrusted content are exactly as hard as before — and easy connection quietly makes two of them worse.
-
Indirect Prompt Injection: When the Tool Result Is the Attack
The attack doesn't come from your user — it comes from the page, ticket, or document your agent fetched. Three conditions have to hold for it to work, and breaking any one is an architectural choice, not a prompt.
-
What Breaks First When You Give an Agent a Browser
Six failures, in the order they arrive: the page isn't what you think it is, selectors rot, state assumptions break silently, and the session carries more authority than the task needs.
-
The Read-Only Agent That Wasn't: Auditing What Your Tools Can Actually Reach
A tool named `check_service_health` woke someone at 3am. Read-only is a claim about effects at the far end of every call, and there's a short audit that either proves it or shows you what you actually deployed.
-
The Confused Deputy in Your Agent: When the Tool Trusts the Model Too Much
Your refund tool checks whether the agent is allowed to issue refunds. Nothing checks whether the customer asking for one is entitled to it — and that gap opens without any jailbreak at all.