Blog
Research, write-ups, and notes on AI agent security and red teaming.
-
Speaking at Cybersecurity Meetup: Absence of Attacks Does Not Guarantee Security
I’ll be speaking at the upcoming Cybersecurity Meetup on why the absence of visible attacks is not proof of security. We’ll look at how teams can uncover hidden weaknesses before they become incidents. Read the event announcement and registration details →
-
BSides Prague & Budapest: AI Agent Security
We spoke at BSides Prague and BSides Budapest about AI agent security: where agentic systems fail, how attackers can turn prompts into impact, and what teams can do to build safer AI products. The full presentation, Prompt, Pwn, Profit: A Deep Dive into AI Agent Vulnerabilities, is available to download...
-
Your Agent Is Mine: the LLM Router as a Supply-Chain Attack Surface
What if the model is not the thing that got hacked? Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain If your agent talks to OpenAI, Anthropic, or Google through a third-party API router, that router sits in the middle with full plaintext access to the...
-
UNC Paths as a Covert Exfiltration Channel in AI Coding Agents
What if a prompt-injected agent could use safe, read-only tools to silently exfiltrate your secrets? Data exfiltration from AI coding agents is a well-documented attack class. Johann Rehberger (embracethered) has published extensively on this topic: Claude Code: Data Exfiltration with DNS (CVE-2025-55284) — using DNS as a covert channel in...
-
When the WAF Blocks Everything: SQL Injection with Only Math
Recently I came across an interesting bug bounty target where I found some nice, classic SQL injection, but none of the WAF bypasses known to me worked. So I asked Claude Code what it could do to exploit it. It turned out to be quite capable of solving this issue....
-
Caught in the Hook... or just API key exfiltration:
In my previous post, I explained the concept of the folder trust gap in AI agents. And today someone released a new article which describes such vulnerabilities in Claude Code. Nothing new except an interesting attack vector with environment variables. Caught in the Hook: RCE and API Token Exfiltration Through...
-
The Trust Gap: Your AI Agent Is Running Code Before It Asks Permission
What is the threat model of an AI agent that operates in your terminal? One of the first things that happens when you type claude/codex/copilot/gemini in your terminal is that you are asked to trust this folder before any action is taken. This is a security measure to prevent malicious...