AI Security
An agent's agency is the attack surface.
Agents hold credentials, read untrusted text, send mail, and move funds. Every one of those is a door. This is how I lock them, learned the hard way on my own systems.
Threat model
I assume four things about any agent I run.
- Input is hostile
Every email, web page, invoice, and tool result the agent reads may contain instructions written to hijack it.
- Credentials leak
Any token the agent can read, it can be talked into sending somewhere. Tokens in a workspace are part of the surface.
- Actions are money
Sending, booking, paying, and deleting are irreversible. A wrong action costs more than a wrong answer.
- The model wants to help
The failure mode is not malice. It is an eager model doing exactly what the attacker's text asked, politely.
Controls I ship
Fence untrusted text.
Third-party content enters the model wrapped and labeled as data, never as instruction. The server, not the model, authors anything regulated or customer-facing.
Server-issued ids and capped state.
The model never invents an order id, a customer id, or an amount it can act on. The server issues them, and every tool caps the state it is allowed to produce. Writes are staged, then committed, one session at a time.
Guard before, audit after.
A guard hook runs before every tool call with a deny list and a confirm-before-send rule. An audit hook writes a chained record after it. The rules live in the harness, where a prompt cannot talk them away.
Least privilege, and a kill switch a person can reach.
Each agent gets the narrowest token that does its job, scoped to one account, one service, one action. A human can pause any agent instantly and take the thread.
Fail closed where money is real.
If a sanctions list is empty or a dependency is down, the screener refuses. A control that waves traffic through when it cannot see is not a control.
Never log the secret. Never log the session.
Structured logs carry digests, not identifiers. A session id in a log line is a key someone else can use.
Lessons, paid for
I run security audits of my own platforms, and I publish the lessons rather than the findings. The controls above, with code: Guard before, audit after.
- Workspace tokens
A long-lived admin token sat in a tracked config file and in git remotes. Rotated, purged, and now a rule: the agent's workspace is inside the perimeter.
- Fail-open screening
A sanctions screener that accepted an empty list as "all clear." Reclassified from quirk to bug, and fail-closed became the standard.
- Fabricated scores
Public endpoints that minted a grade for any address with zero observations. Removed, and the no-fabrication rule became an architecture test.
- Public data
An events endpoint reachable without authentication. Closed the same day it was found, with a check in CI so it stays closed.