Code-execution agents — the security review checklist for agents that write and run code
Agents that write and run their own code have an unbounded tool surface. The security review checklist for that capability.
LLM misinformation as a security risk — OWASP LLM09
Misinformation isn't a quality bug when the output drives a decision or an automated action. OWASP LLM09 treats confidently wrong answers as a security category.
Training data poisoning — OWASP LLM03 explained
Training data poisoning plants a backdoor before the model ever ships. It's invisible in the weights and undetectable at the prompt layer -- review has to reach the data.
Agent sandboxing — what isolation actually means for autonomous agents
What isolation must guarantee for autonomous agents, and the failure modes when an architecture diagram's sandbox is fiction.
Reviewing Windsurf (now Devin Desktop) — the CVE that bypassed its own deny-list
A critical path-traversal flaw worked even with auto-execution off and the vulnerable tool explicitly deny-listed. What that means for trusting a platform's own safety controls, and what changed when Cognition folded Windsurf into Devin.
Reviewing Claude Code and the Claude Agent SDK — permissions, sandboxing, and bypass mode
Distinct from a Claude procurement review: this is Claude Code as a coding agent, its layered permission model, six-plus disclosed CVEs, and the containment guidance Anthropic pairs with its own "YOLO mode" warning.
Reviewing Databricks Mosaic AI Agent Framework — the gap Databricks names in its own framework
No disclosed CVE here — the real finding is Databricks' own AI Security Framework v3.0 naming a confused-deputy problem: Unity Catalog governs data at rest, but an agent inherits whatever its tools can reach.
Vector and embedding weaknesses — OWASP LLM08 explained
OWASP LLM08: embedding-space attacks that recover source text from vectors and poison the retrieval space itself.
Reviewing Google's Agent Development Kit — the CI workflow that trusted the wrong identity
A path-traversal CVE, a Black Hat-disclosed unauthenticated dev assistant, and a GitHub Action that let anyone with issue-comment access trigger privileged code execution. Three separate ADK findings, one shared root cause.
Reviewing Amazon Q Developer — the MCP auto-execution CVE
CVE-2026-12957 let a single file in a cloned repository run arbitrary MCP server code and steal AWS credentials, with no prompt and no consent. What a review has to check before enabling IDE-integrated agents.
Reviewing UiPath Agentic Automation — what the AI Trust Layer certifies, and what it doesn't
ISO 42001 and AIUC-1 certification, zero third-party data retention, and centralized real-time policy evaluation are real. What still depends on how an individual agent's access is actually configured.
Reviewing Microsoft Copilot Studio agents — three 2026 CVEs and the DLP gap they share
A patched prompt-injection vulnerability still exfiltrated data — because the exfiltration path ran through a legitimate, trusted action that DLP never questioned. What that teaches a review.
Reviewing Workday Illuminate agents — what the Agent System of Record actually governs
A dedicated governance system for first- and third-party HR and Finance agents is a real step forward. What a review still has to confirm before trusting it.
Reviewing Kiro — the steering-file CVE, and four more disclosures
AWS's agentic IDE keeps specs as the unit of work and reads persistent "steering files" on every interaction. The trust-boundary risk that raised was hypothetical when first flagged — CVE-2026-10591 confirmed it.
Reviewing Replit Agent — the lesson from a rogue production database deletion
An autonomous agent ignored an explicit "code freeze" instruction, deleted a production database, and then tried to cover it up. What was missing, and what a review has to require before an agent gets that kind of access.
Reviewing Devin deployments — shell, browser, and editor access with near-zero review window
Devin plans, codes, tests, and deploys with minimal supervision, holding shell, browser, and editor access simultaneously. What a review has to bound before that autonomy reaches production.
Multi-tenant RAG — the isolation boundary a security review must verify
Shared RAG serving multiple tenants creates a retrieval boundary user-level ACLs cannot cover. Verify it before sign-off.
Reviewing Cursor deployments — Privacy Mode is off by default
Cursor's Background Agents and Workspace Trust controls are real. Privacy Mode, which stops code from being stored or used for training, isn't on by default — not unless someone turns it on.
Reviewing GitHub Copilot's coding agent — the rules-file supply chain
A sandboxed cloud agent that opens its own pull requests still trusts the rule files in your repo — and hidden Unicode in one can silently steer what code it writes. The review questions that catch it.
Reviewing ServiceNow AI Agents — the lesson from a hardcoded shared secret
CVE-2025-12420 let any attacker with an email address impersonate a ServiceNow user and run AI agents with their privileges — via a static token shipped identically on every instance. What that teaches a review.
Reviewing Google's Gemini Enterprise Agent Platform — the Vertex AI and Agentspace merger
Vertex AI Agent Builder and Agentspace consolidated into one platform in 2026, with A2A in production and MCP native to BigQuery and Maps. What changed, and what a review needs to check.
Agent-to-agent protocol security — what A2A adds beyond MCP
A2A governs what agents ask each other to do -- capability-card spoofing, delegation without provenance, transitive access risks.
Reviewing IBM watsonx Orchestrate — the Agentic Control Plane's actual reach
One control plane governing agents from any framework, with MCP support and least-privilege token exchange. What a review has to confirm it's actually covering, not just onboarding.
Reviewing SAP Joule agents — BTP integration and the A2A protocol surface
Joule agents run governed through SAP BTP, but pro-code agents built on LangGraph, CrewAI, and others connect in over A2A. What that hybrid model means for review.
Reviewing Salesforce Agentforce — the Trust Layer and what it doesn't cover
The Einstein Trust Layer sits between every prompt and every LLM. It's real security — and it's not the whole review. What still depends on the agent's running-user permissions.
Reviewing Microsoft Foundry Agent Service — hosted agents and hypervisor isolation
Every hosted agent session gets its own VM-isolated sandbox and an auto-provisioned Entra Agent ID. What that buys a review, and what it doesn't.
Reviewing AWS Bedrock AgentCore — Runtime isolation, Identity, and the Agent Registry
microVM-per-session isolation and enterprise identity federation solve real problems. What a review still has to check across Runtime, Identity, Memory, and the new Agent Registry catalog.
Reviewing Microsoft Agent Framework — the AutoGen and Semantic Kernel successor
AutoGen and Semantic Kernel are both in maintenance mode. Microsoft Agent Framework is what replaces them, with native MCP and A2A support — and the review questions that follow from that.
Reviewing OpenAI Agents SDK deployments — the handoff guardrail gap
Handoffs run through a different pipeline than tool calls, and the SDK's own documentation says tool guardrails don't apply to them. What that means for reviewing a multi-agent handoff chain.
Reviewing CrewAI deployments — Crews, Flows, and the security the framework doesn't provide
CrewAI runs an estimated 450 million agents a month with, by its own maintainers' admission, no built-in auth, audit logs, or access controls in the open-source framework. What a review has to supply instead.
Reviewing LangChain and LangGraph agents — the serialization and checkpoint attack surface
Three real 2026 CVEs — a 9.3 serialization RCE, a path traversal, and a checkpoint SQL injection — show where LangChain and LangGraph's trust boundaries actually sit. The review questions that would have caught each one.
LLM output validation — the controls that actually work
Prompt injection and hallucination are symptoms of missing output validation. The controls that close the gap at each gate.
Threat modeling a RAG pipeline — retrieval, context, and generation risks
RAG introduces three attack surfaces standard LLM threat models miss: retrieval boundary, context window, generation gate.
Attack path analysis for AI systems — beyond CVE scoring
CVE scores show a vulnerability exists. Attack path analysis shows if it is reachable and connected to meaningful blast radius.
Security review for fine-tuned models — what changes from base model assessment
Fine-tuned models inherit base-model risk and add training data provenance, alignment drift, and capability overhang concerns.
Why your existing threat modeling tool doesn't model agents
STRIDE and commercial tools model deterministic software. Agents have five properties they can't represent -- each one an attack surface.
Threat modeling an MCP server — the parts AppSec tools miss
MCP servers have four attack surfaces: transport, tool surface, context injection, auth boundary. AppSec tools model one. The full threat model.
LLM red-teaming for a security review
Red-teaming an LLM is not pentesting it. Covers goal hijacking, jailbreaking, indirect injection, and exfiltration chains — with documentation guidance.
Context-window risks in RAG and how to bound them
The context window is where queries and retrieved documents meet the model. Anything inside influences outputs. How to bound what gets in.
Goal hijacking and instruction drift in autonomous agents
Goal hijacking makes an agent pursue unintended objectives. Instruction drift is the slow version. Both evade detection because the agent appears to work.
Guardrails that work vs guardrails that look like they work
Most LLM guardrails are bypassable classifiers. Distinguish patterns that provide genuine risk reduction from those that only provide the appearance of it.
MCP security vs traditional API security — what changes
MCP looks like a REST API but the client is a non-deterministic model. The attack surface includes tool descriptions and trust sits at the model.
System prompt leakage and why it matters for security
System prompts encode trust assumptions, scoping rules, and sometimes credentials. When they leak, the system's entire trust model is exposed.
Securing an internal MCP server exposed to agents
Internal MCP servers exposing tools, databases, or APIs to agents have different security requirements than public ones. The review checklist.
Evaluating a RAG pipeline for security, not just relevance
RAG evaluation frameworks measure relevance. Security evaluation asks: what boundaries are crossed, what can be extracted, and what enforces the scope?
Agentic AI Privilege Escalation — 5 Attack Paths
Agentic privilege escalation needs no kernel exploit — just a model convinced to invoke unintended tools. Maps escalation paths and blocking controls.
LLM Excessive Agency — Scope Permissions Down (OWASP)
Excessive agency: an LLM has more capability than its task requires, and a manipulated model can exercise the excess. Least-privilege is the fix.
Design-time vs runtime AI security — where review belongs
Runtime tools watch production anomalies. Design-time review decides if the system should ship. Conflating them creates gaps.
Prompt-context injection through MCP tools
MCP tools return data injected into model context. When that data contains instructions, the tool becomes an injection vector. Controls that prevent it.
Vector Database Security — RAG Pipeline Checklist
Vector databases inherit standard data-store security requirements plus RAG-specific ones. The full security checklist for production pipelines.
Model denial of service and cost-exhaustion attacks
LLM DoS doesn't require crashing the service — just making it expensive. Cost-exhaustion attacks are under-defended in most assessed AI systems.
Security review for multi-agent systems
When agents orchestrate agents, single-agent trust assumptions multiply. Covers inter-agent trust, capability delegation, and blast-radius containment.
LLM supply-chain risk — models, weights, and dependencies
LLM supply chains span models, datasets, inference providers, and plugins. Map the attack surface and review questions for each layer.
Transport security for MCP servers
MCP runs over HTTP/SSE or stdio — each with distinct security requirements. Covers TLS, mutual auth, and transport review questions.
Indirect prompt injection through retrieved documents
Indirect injection via retrieved documents is harder to detect than direct — the attacker is in the knowledge base, not the conversation.
Agent memory as an attack surface
Agents with persistent memory carry forward context that can be poisoned. A past interaction plants instructions that execute in future sessions.
Sensitive information disclosure in LLM applications
LLMs leak data through three channels: training memorisation, system prompt leakage, and retrieval boundary failures. Each needs distinct controls.
The MCP authentication boundary, reviewed
MCP authenticates the agent client, not the end user. Without explicit per-user auth layering, user-level authorisation cannot be enforced.
Access control for RAG — keeping retrieval inside the line
RAG access control must operate at retrieval time, not query time — or users extract documents they would never be permitted to read directly.
Tool-use permissions for agentic AI — least privilege for agents
Most agentic AI tool manifests are over-provisioned. Audit the manifest for each deployment scope and remove capabilities the task does not require.
Insecure output handling — the LLM risk teams underrate
Teams harden LLM inputs and ignore outputs. Insecure output handling turns prompt injection into code execution, data exfiltration, or stored attacks.
Tool poisoning in MCP servers
MCP tool poisoning uses malicious tool descriptions to manipulate models into unintended invocations or data disclosure. Descriptions are untrusted.
Data poisoning in RAG knowledge bases
RAG knowledge base poisoning inserts malicious content not to corrupt the index, but to influence model outputs when poisoned documents are retrieved.
Mapping the agentic AI attack surface
Five layers of the agentic AI attack surface — prompt channel, tool surface, memory, orchestration boundary, output channel — mapped with controls.
Prompt injection, explained for security reviewers
What prompt injection actually is, how its variants work, how it differs from SQL injection, and which controls reduce the risk in practice.
MCP security — the four attack surfaces of a Model Context Protocol server
MCP servers expose tools, resources, and prompts — each an attack surface. Defines the four surfaces and review questions for each.
RAG security — the three boundaries that matter
RAG adds three security boundaries between user and model: data, retrieval, and context. Each has distinct failure modes a standard LLM review misses.
Agentic AI security — the surfaces deterministic software does not have
Agentic AI security covers four surfaces deterministic software lacks: hijackable reasoning, tool manifests, persistent memory, drifting goals.