Technical research, field notes, and practical guidance for securing autonomous systems.
An engineering deep-dive into capability-transformer — a deterministic, transformer-native authorization gateway for LLM agents. Why we stopped trying to detect malicious prompts, what we built instead, and how it scores 100% on the action-harming attacks in AgentDojo while never blocking a legitimate task. TL;DR — We treat tool authorization for AI agents as an object-capability […]
If you’ve been using ChatGPT to summarize web pages, you might want to think twice. A recently discovered security vulnerability reveals that the popular AI chatbot cannot distinguish between legitimate content and malicious instructions hidden within web pages, essentially turning any webpage into a potential attack vector. The Trust Problem That Shouldn’t Exist Security researcher […]
When Microsoft open-sourced the Agent Governance Toolkit (AGT) in April 2026, it filled a gap the industry had been circling for two years. As enterprise AI moved from chat to action — agents calling tools, mutating data, talking to other agents — security teams kept asking the same question: who governs what these agents actually […]
The real danger of malicious content in AI systems is not that it changes the phrasing of an answer. The real danger is that agents can turn document content into actions. An ordinary-looking file can be translated into: That is the shift security teams need to internalize. In classic software, documents were usually inputs to […]
AI agents are being asked to do something traditional software never had to do at scale: read untrusted human content and then act on it. That sounds harmless until you realize what “content” now includes. Emails. PDFs. Web pages. Resumes. Reports. Support tickets. Shared docs. CRM notes. Knowledge base articles. Anything an agent can retrieve, […]
On or around May 4, 2026, an X user reportedly exploited a prompt-injection vulnerability involving Grok and Bankrbot, an automated crypto/trading bot operating on Base. The attacker used Morse code to hide a token-transfer instruction. Grok reportedly decoded the message and surfaced it publicly with a Bankrbot tag. Bankrbot then treated the decoded text as […]
