Tag
agents
81 entries, including 25 patterns.
A skill's prerequisites section is the payload
ClawHavoc filled an agent skill marketplace with polished documentation that ended in "install this first." The malware was never in the skill's code. It was a sentence the user, or the agent, was expected to follow.
- Pattern
Prompt-Independent Action Authorization
Treat a leaked prompt as reconnaissance, then prove the target service still rejects out-of-scope actions regardless of the words the model uses.
- Pattern
Source-Bound CI Attestation
Treat a passing PR check as an attestation from a designated runner about an exact revision, not as a green string any repository writer can supply.
The green check came from the wrong writer
A coding agent's PR can carry a passing status for a test it never ran when the merge gate trusts the check name but not its issuer.
- Pattern
Quarantine Unreviewed Installs
Let PR validation execute lifecycle hooks only in a worker whose credentials, network and output cannot become release authority without review.
The install step ran the pull request
An agent's code-review transcript may be clean while a dependency install executes repository-controlled code before the first test.
- Pattern
Effect-Bound Tool Route Gate
Authorize the effect at the service, regardless of which agent tool pipeline requested it.
The guardrail only wrapped one kind of tool
A per-tool safety check can be correct on the route it covers and irrelevant on the route that makes the same consequential change.
- Pattern
Resource-Bound Action Budget
Keep conversation policy for sequencing, but enforce cumulative limits in an atomic resource ledger across sessions and retries.
The budget reset with the conversation
Session-aware tool policy can remember a transfer, but a fresh conversation can forget it. Put durable limits at the resource that moves the money.
The hook went quiet; traffic did not
An inline AI policy can be configured and healthy-looking while requests pass uninspected. Measure enforcement coverage, not just denials.
- Pattern
Verdict Coverage Accounting
Join independent request counts to hook verdicts and configuration state so silent inspection gaps are observable and high-impact actions stay gated.
- Pattern
Evidence-Bound Callback Completion
Accept a completion as a scoped claim, then verify independent evidence and current authorization before the next side effect.
- Pattern
Task-Bound Artifact Fetch
Translate an external agent's file reference into a narrowly authorized fetch and a receipt for the bytes actually consumed.
The artifact pointed somewhere else
An agent's file result can make the receiving assistant fetch under its own network identity. Treat artifact references as requests for access, not as files already received.
The callback said done
A workflow completion token can close a task without proving that the approved work happened. Verify the result at the boundary before an agent acts on it.
The screenshot is a prompt, not a witness
Vision-language agents act on what they read in pixels. An attacker who controls a single image controls the instruction stream.
A retry is not a replay
The harness tells the model to try again. The model has no memory of the key it minted. At-least-once becomes at-least-twice, and that repetition is an attacker primitive, not a reliability footnote.
- Pattern
Pre-Dispatch Side-Effect Gate
Separate blocking run admission from a mandatory target-facing decision so a late tripwire cannot masquerade as prevention.
The guardrail finished after the send
A parallel input check can reject a run after its tool has already sent data. Put the security decision ahead of dispatch, not beside it.
The trace sampler erased the denial
A security decision cannot be audited from a trace that was never exported. Keep a narrow action ledger outside the sampled observability path.
- Pattern
Unsampled Action Receipt
Preserve gate decisions and target outcomes even when agent traces are sampled out or filtered.
A tool result is not a system message
The return value of a tool call rides into context carrying execution authority. When the source is not yours, that value is a covert prompt channel.
- Pattern
Purpose-Bound Handoff Packets
Give each specialist only the authenticated fields its task requires, and test the input it actually receives.
- Pattern
Telemetry-as-Evidence Incident Gate
Let an assistant inspect attacker-influenced logs without allowing their prose to close incidents or authorize response actions.
The log line became an incident command
An investigation assistant can read an honest log record containing an adversary's words. Keep telemetry as evidence, not authority.
The specialist inherited the whole case
A handoff can transfer far more than the task. Decide what the receiving agent may see before it receives history.
A blocklist is not a jailbreak gate
String-match filters judge the surface of a prompt. Adversaries operate on the tokens the model actually reads.
- Pattern
Replay-Fenced Agent Side Effects
Give one approved intent one durable target-side identity, regardless of workflow retries, forks or restarts.
- Pattern
Revocable A2A Push Subscribers
Make a task's outbound update subscription expire with its subscriber's entitlement, including queued retries.
The checkpoint did not undo the transfer
Replaying an agent workflow can repeat a real-world action unless the target recognizes the same operation.
The webhook kept listening
An A2A task can keep sending updates to a once-authorized subscriber after that subscriber loses access.
- Pattern
Adjudicated Feedback Promotion
Keep production complaints useful for finding failures without letting them decide what a secure agent should do.
- Pattern
Revocation-Aware Policy Gates
Make policy freshness an explicit precondition for privileged agent actions, and prove revocations take effect at every serving gate.
The revocation that never reached the gate
A centrally approved policy change does not revoke an agent's access until every consequential gate stops using the old revision.
When feedback becomes the test
A complaint can reveal a failure; it should not be able to rewrite the acceptance test that decides whether an agent is safe to release.
A task ID is not an authorization boundary
A2A task handles identify work. They do not decide who may read its artifacts, cancel it, or receive its updates.
Inspected is not executed
A safety check on the raw command or code string does not prove the runtime will execute that same string.
- Pattern
Task-Bound A2A Authorization
Bind every task read, stream and mutation to the authenticated caller's ownership and action rights, not possession of its ID.
A registry spawn is not a catalog read
Accepting an MCP client registration that carries a command is process start, not browsing a tool list.
Non-empty is not authenticated
A non-empty Authorization header is not proof that a verifier ran or that the credential is valid.
Allowlisted is not constrained
Matching the first path token against an allowlist does not prove the process will only run that program's intended verbs.
Denied on the sandbox is not denied on the loopback
A sandbox tools.deny entry is not a gate if the MCP loopback never applies it.
Rejected is not blocked
A finishReason of tool_rejected does not prove the tool never ran.
A browsing agent inherits localhost
An Origin allowlist for 127.0.0.1 does not stop JavaScript that a local agent just rendered.
A valid token is not your audience
A signature and expiry check does not prove the token was issued for this MCP server.
Validated is not pinned
A hostname that passed an SSRF check can still dial a different address on the next lookup.
URL validation is not egress
A deny-list in the fetch helper is not a network policy. The agent host still reaches what the process can reach.
A session ID is not a credential
Conversation continuity tracks state. It does not prove who is calling.
Syntax is not intent
A well-formed tool call can still be the wrong action. Clear syntax is not a policy verdict.
Visible text is not the filter string
What a person reads on screen is not the string that keyword, signature, or model-ingestion controls evaluate. Invisible Unicode can split both.
Approved metadata is not a frozen contract
A tools/list snapshot from install time is not a lasting grant. After ordinary use, the same server can rewrite what the agent trusts.
Unset is not deny
When the webhook secret is absent, an if-secret check never runs. A warning is not a closed gate.
Memory without provenance is delayed authority
A write that can steer later tool calls is a control-plane event. Without provenance and audit, you cannot govern what fires next.
An isolate is not a host boundary
A V8 isolate or a NodeVM box can still leave the host process writable.
There is no single AI kill switch
Incident response needs independent controls over authority, connectivity and execution.
- Pattern
Three-Pillar Agent Containment
Pre-engineer independent response controls over an agent's authority, connectivity and execution.
- Pattern
Cross-Boundary Action Evidence
Correlate policy, dispatch and target events without confusing transport success with business outcome.
The trace ended at the tool call
Detection fails when the agent, gateway and target each describe only their own success.
Logging that lies
A green success log is not proof that a policy gate ran.
- Pattern
External Agent Policy Enforcement
Keep authoritative policy outside the agent's control and require its decision at every consequential service boundary.
The agent edited its own policy
A repository policy file can guide an AI coding agent. It cannot constrain the agent when the same identity can rewrite or bypass it.
A block rate is not a security outcome
Measure whether a guardrail prevented the unwanted action, whether responders saw it, and whether the same control broke legitimate work.
Cancelled is not contained
An A2A cancellation request does not prove that delegated work has stopped or that its credentials can no longer act.
- Pattern
Revocable Delegation Boundary
Bound cross-agent authority and verify that revocation reaches delegated execution.
The sandbox hid the workload
Stronger isolation can change what host sensors observe. Validate workload detection as part of the sandbox design.
- Pattern
Approval Bound to Action
Preserve the exact action a person reviewed, then verify and consume its approval at the execution boundary.
Approval has to survive the handoff
A person approves one action. The dispatcher must prove it is still executing that action after a pause, retry or delegation.
A2A without a receipt
An authenticated agent call still needs a record of the policy that allowed it.
- Pattern
Skill Grant on the Hop
Enforce skill-level policy at the receiving agent, then bind a durable authorization receipt to the call before it runs.
The guardrail that waved traffic through
A green light on the model path is not containment if the tool can run without that path.
- Pattern
Verified Dispatch Path
A control pattern for security architects and platform teams who run agent harnesses with model-layer guardrails. It treats a green dashboard as worthless unless tool dispatch requires a trusted execution record and an explicit policy decision — so forged history and co-opted judges cannot wave traffic through.
Sandbox on is not containment
A sandbox label does not mean the agent is cut off from the estate. If the host can reach the VPN and the cloud APIs, so can the agent.
- Pattern
Verified Agent Containment
A control pattern for security architects and platform teams who run coding agents or MCP-backed tools on shared hosts. It replaces the comfort label “sandbox on” with an explicit, checkable isolation boundary so the agent cannot silently inherit the estate’s network paths and cloud identity.
An outbound token is not inbound auth
A stored upstream credential lets the MCP server act. It does not prove who is calling it. Two Critical advisories show the same residual when that gate is missing.
MCP preview paths are host execution
LiteLLM’s MCP connection-test endpoints spawned the caller’s command on the proxy host. A preview surface with host privileges is a control plane, not a sandbox.
Task utility is not harness safety
High task completion can sit next to high attack success. Safety is a property of the model and harness configuration, not the model alone.
Same-origin is not a tool-ownership boundary
The page origin is a DNS name, not a registrant. Ownership has to live in the browser, and the inspector cannot hold tools.
A hook is not a security boundary
If the host is trusted, a contract can prove that an action stopped. It cannot contain a host that never asks.
Deny has to mean deny
Framework callbacks observe. A governance contract has to stop the action, even if the guard crashes.
Two allowed actions can still be the breach
Per-tool permission is not an architecture. The control is which combinations you will not allow in one session.