Agents
Work in Progress
This section is a draft:
It will probably drastically change in the upcoming days.
Articles
Theory
| Article |
Description |
| Agent2Agent (A2A) Protocol |
An open protocol enabling communication and interoperability between opaque agentic applications |
| How we made Trail of Bits AI-native (so far) |
Trail of Bits overcame 95% internal resistance to build a six-part AI operating system: standardized toolchain, policy handbook, maturity matrix, hackathon sprints, reusable skills/agents, and sandboxed autonomy |
| How Cloudflare enforces engineering standards using AI |
Cloudflare built the Codex, a governed RFC-based body of engineering standards consumed by AI agents to enforce consistency across code reviews (230,000 violations flagged, 16,000 merges blocked), spec reviews, and incident report reviews throughout the development lifecycle |
Defense
Frameworks & Threat Modeling
| Article |
Description |
| Threat modeling agentic AI: a scenario-driven approach |
A practical workflow for threat modeling agentic AI systems: use a five-zone navigation lens to trace attack paths, formalize them as attack trees, and map to OWASP's threat taxonomy and playbooks |
| Zero Trust for AI Agents |
Anthropic eBook applying Zero Trust principles to enterprise autonomous AI agents, covering threat taxonomy (prompt injection, tool/MCP hijacking, memory poisoning, supply chain risks), tiered controls (Foundation/Enterprise/Advanced) for identity, least-privilege, observability, and AI-accelerated defensive operations. |
| CISO's guide to agentic AI |
Anthropic's Deputy CISO shares a four-question framework for assessing agentic AI risk, and walks through controls that keep agent deployments bounded and auditable. |
Identity & Delegated Authority
| Article |
Description |
| Three Ways to Give an AI Agent an Identity |
This post compares three AI agent identity models: acting as the user (simple but single-player), service account tokens (common in production but insecure), and SPIFFE-based workload identity (best but costly to implement) |
| Solving the Identity Crisis for AI Agents |
Uber extended its Zero Trust architecture to assign SPIRE-backed cryptographic identities to AI agents, issuing short-lived, single-hop JWTs via a Security Token Service. Full actor chains (user to agent to tool) propagate across multi-agent MCP calls, enabling end-to-end auditability with sub-40ms P99 token exchange latency. |
| Delegated authority, running locally: Give an agent on your machine an identity you can trust |
A reference architecture for giving a locally-running AI agent a trustworthy, auditable identity, without long-lived credentials on disk, including a structural defense against prompt injection built into the protocol layer. |
| The Agent Access Model |
Cloudflare's Agent Access Model (AAM) proposes a zero-trust architecture for AI agents using short-lived task-scoped credentials, harness/network-layer enforcement, a stateful Trust Ratchet that irreversibly narrows capabilities upon protected data access, and an activity log for least-privilege grant review |
Containment & Guardrails
| Article |
Description |
| Safeguarding VS Code against prompt injections |
When a chat conversation is poisoned by indirect prompt injection, it can result in the exposure of GitHub tokens, confidential files, or even the execution of arbitrary code without the user's explicit consent |
| How we contain Claude across products |
Anthropic details agent containment across claude.ai (ephemeral gVisor containers), Claude Code (OS-level sandboxes with approval fatigue mitigations), and Claude Cowork (local VMs) |
| Marco Lancini My Claude Code Setup (2026 Edition) |
A walkthrough of my Claude Code setup across a multi-project monorepo: global settings, safety guardrails, a context/plan/code workflow, subagents and plugins, and the StarCraft-themed customisations that make the terminal feel like mine |
| Before the first prompt: Code execution paths in trusted coding-agent projects |
Trusted coding-agent projects can execute repository-controlled code before the first user prompt via MCP server configs or PATH hijacking in .claude/settings.json. Developers should treat project trust like running an arbitrary setup script |
Defending with AI
| Article |
Description |
 Protecting Our Systems with Intelligence |
How Block builds AI protectors that shift left, manage context, and continuously evolve to keep systems aligned with their world model |
| Build your own vulnerability harness |
Cloudflare details a model-agnostic, multi-stage vulnerability discovery harness and triage system covering 128+ repos. It uses separate models for discovery vs. validation, adversarial agents, SQLite-backed persistence, cross-repo dependency tracing, and automated patching with mandatory human sign-off. |
| Comparing Open-Source AI Code Security Harnesses |
A guide to open-source AI tools for finding code vulnerabilities, comparing exploit generation, skill-boosted auditing, and SAST+LLM hybrid approaches. |
| Marco Lancini Automating Security Operations with AI: Triaging Renovate PR |
A Claude Code Routine that triages every Renovate PR by risk, flags dead deps, and catches deprecated framework configs before I touch the diff |
| How Figma Stays Ahead of Vulnerabilities With Agents |
For the past year, agents at Figma have guarded code as it's written, reviewed every pull request, and audited a decade-old monorepo, all on one policy |
| How We Secure Figma's Internal Systems With Agents |
Figma's security team built an agentic system on AWS Bedrock, Kendra, and Tines that triages SIEM alerts, queries a Snowflake security data lake, and opens remediation PRs. It uses RAG-based case memory, behavioral steering memory, and self-built procedural schema memory, achieving a 71% reduction in alert time-to-resolution |
Attacks
| Article |
Description |
| The sorry state of skill distribution |
Trail of Bits bypassed malicious skill scanners from ClawHub, Cisco, and skills.sh using simple techniques: newline padding, .pyc bytecode poisoning, .docx indirection, and prompt injection. Existing scanners are structurally broken; organizations should use curated, trusted skill sources instead |
Development
| Name |
Description |
| Building agents |
|
| Cloudflare |
|
| Claude |
|
| Other |
|
Security
| Name |
Description |
| visa-vulnerability-agentic-harness |
Visa's open-source agentic SAST pipeline using frontier AI models for autonomous vulnerability discovery, with multi-agent voting, threat modeling, and SARIF output |
| deepsec |
- A security harness for finding vulnerabilities in your codebase powered by coding agents
- Introducing deepsec
|
| security-audit-skill |
A coding-agent skill for multi-phase security audits with independently verified, machine-readable findings |
| ADR |
ADR (Agentic Detection and Response) captures AI agent telemetry (prompts, tool calls, MCP activity, reasoning traces) to detect credential exposure, prompt injection, and data exfiltration. Deployed at Uber |