The UnboundCompute blog
Writing on web security
-
JWT Algorithm Confusion Attacks Explained
JWT algorithm confusion lets an attacker pick how a token is verified. See how the none bug and RS256 to HS256 key…
-
Broken Function Level Authorization (BFLA) Explained
Broken function level authorization lets a normal user call an admin function directly. See how BFLA differs from BOLA, with concrete API…
-
Broken Object Property Level Authorization (BOPLA) Explained
Broken object property level authorization (BOPLA, API3:2023) lets users read hidden fields or write privileged ones. See how it works and how…
-
Agent Delegation Limits as a Defense
Agent delegation limits cap how deep, how wide, and how expensively an agent can spawn sub agents, stopping runaway loops and swarms…
-
Agent in the Middle Attacks Explained
An agent in the middle attack lets an attacker edit messages between two real agents in transit. See how it works and…
-
Agent Swarm Attacks in Multi Agent Systems
An agent swarm attack copies one hostile instruction into every parallel worker at once. See how the fan out amplifies data theft…
-
Recursive Delegation Loop Attacks on AI Agents
A recursive delegation loop makes AI agents delegate in circles until the budget is gone. See how the loop forms and the…
-
Agent to Agent Authentication as a Defense
Agent to agent authentication makes every agent prove its identity before its messages are trusted, so a rogue agent cannot forge the…
-
Agent Collusion in Multi Agent Systems
Agent collusion is when a worker agent and its checker are steered by the same attacker, so the review becomes a rubber…
-
Orchestrator Injection in Multi Agent Systems
Orchestrator injection steers the planner that spawns your worker agents, so every worker inherits a hostile goal. Learn how it works and…