Security of the agentic stack
Trust boundaries, egress, secrets and adversarial pressure across the whole agentic and GenAI landscape.
The problem
Agent security is being discussed almost entirely at the model layer — jailbreaks, refusals, alignment — while the failures that actually land are ordinary. An identity scoped wider than its task. A tool that trusts its caller. Content that becomes instruction. Secrets reachable from a process that had no business holding them. These are decade-old failure modes, now driven by something that enumerates faster than any red team, never gets bored, and has no malicious intent to detect.
Where it breaks
Over-scoped non-human identity
An agent inherits whatever its identity can touch. If the credential reaches ten systems, so does the agent, whether or not its task involves nine of them.
Tools that trust their caller
A tool built for one internal service is now reachable by an agent that can be steered by text it retrieved. The tool's threat model was written before that was possible.
Content as instruction
Injection is not a prompt-writing problem. It is what happens when the control path and the data path are the same path.
Egress nobody is watching
Prompts and retrieved content leave the boundary as an ordinary API call. Data-loss tooling built for email and file shares does not see it.
Secrets in reach
A process that can read a config, an environment or a cache can spend anything in it. Short lifetimes and hard rotation are the only controls that survive harvesting.
Testing the model, not the path
Red-teaming the model tells you what it will say. The exposure is what the system will do — which is a property of tools, identity and egress, not of the model.
What this actually consists of
Non-human identity inventory and least-agency scoping — one identity, one task, bounded lifetime
Trust-boundary mapping across the agent, its tools, its retrieval path and its egress
Adversarial testing of the whole path rather than the model in isolation
Detection tuned for lateral movement and privilege escalation, which is where an agent incident actually shows
Rehearsed revocation: killing an identity mid-run, tested before the day it is needed
The test
Would anything you run today flag a service account that suddenly started moving between clusters? If the honest answer is no, that is the gap — and it is the gap that turned a sandbox escape into a breach.
Standards and regimes named on this page are checked against their primary sources on an ongoing basis. Instruments move — several cited here changed inside the last year — so verify against the source before you rely on one. If you find something stale, tell me and I will correct it.
Where does this sit in your estate?
The useful version of this conversation is specific — one workflow, one deadline, one thing you are not sure you could evidence. That is usually twenty minutes.