Writing on web security

AI agent sandboxing runs agent generated code and tool calls in a confined environment so a compromised agent cannot reach the host,…

Human in the loop ai agents require explicit approval before sensitive actions, so a person, not an injected document, authorizes money, email,…

Apply least privilege for ai agent tools to shrink blast radius: scoped tokens, read write splits, tool allowlists, and short lived credentials.

The camel prompt injection defense from Google DeepMind stops attacks by design, using a plan as code, a quarantined model, and capability…

The dual llm pattern keeps untrusted text away from the model that calls tools, so injected instructions cannot drive real actions. Here…

Spotlighting prompt injection defense marks untrusted input so an LLM tells data from instructions. See delimiting, datamarking, and encoding with examples.

A complete field guide to AI agent security: every prompt injection, jailbreak, MCP, autonomy, and data attack, grouped by mechanism with a…

A context compliance attack jailbreaks an AI by forging a fake earlier reply where it already agreed. See why it works and…

Cross plugin request forgery lets hidden text in one AI plugin secretly trigger a second, privileged plugin. Learn how it works and…

An mcp line jumping attack hides commands inside MCP tool descriptions that reach the model before you call anything. See how it…