How to Give an Agent a Query Language Instead of a Code Interpreter
A four-step pattern for letting a document agent write validated aggregation pipelines instead of arbitrary code, so results come back shaped and tenancy stays enforced.
Loading…
Topic
Security
181 posts about Security. Every summary links to the original.
- 181 posts
- 30 companies
- 8 explainers
See the idea
Security explainers
Anatomy of a Branded Call: The Trust Chain from Dial to Display
The Branded Calling trust chain, layer by layer: how identity, STIR/SHAKEN attestation, Rich Call Data, and carrier delivery combine so a verified brand name reaches the recipient's screen.
Backdoor Defense Is a Trade-off, Not a Scanner
A model that passes benchmarks can still defect only on a trigger. This explainer maps the trade-off between deeper backdoor verification and the friction, latency, and cost it adds.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
Closing the Binary Blind Spot: Domain-Knowledge Injection for LLM Malware Triage in npm Packages
Supply chain attacks on the npm registry are growing, and packages that bundle a binary payload are rare but disproportionately hard for LLMs to triage. The authors built a scanner that combines static analysis with LLM reasoning and introduced capability profiles, which encode malicious techniques as weighted conditions injected into the prompt before the model decides. They tested nine models across seven providers on five adversarial payload types, including credential stealers and reverse shells, at varying obfuscation levels. Without profiles, the budget-tier models failed to reach a malicious verdict on 50 percent of tests, with failures following distinct model-specific patterns rather than random error. With profiles enabled, the failure rate dropped to 4 percent, and 91 percent of prior failures recovered to a detection.
Reducing the noise: How Atlassian built an OCSF security lakehouse on Databricks
Atlassian faced a security data pipeline ingesting 44 billion events daily from 20 years of growth and acquisitions, each with proprietary logging formats. To unify this fragmented telemetry, the team standardized on the Open Cybersecurity Schema Framework (OCSF) and built a security lakehouse on Databricks. They embedded the entire OCSF schema into Go structs (TypeGo), guaranteeing compile-time correctness and reducing AI hallucinations during automated transformation. Table optimization with partitioning and Z-ORDER cut query times by 95%, and Graviton clusters with Photon reduced cost and runtime by two-thirds. The result was a self-service platform where SOC analysts can onboard new data sources in days, and detection teams moved from one-to-one alerts to signal-based clustering using standardized OCSF values.
MCP standardized tools. Now we need the infrastructure around them.
MCP standardized how AI models connect to tools, with clients like Claude Code and Cursor adopting it and SDK downloads approaching half a billion monthly. However, production use reveals that the protocol solves only the interface problem, not the operational concerns around authentication, rate limiting, idempotency, and observability. Teams repeatedly build duplicate infrastructure for deployment, secret handling, health checks, and access control because the protocol does not address these. Context efficiency also remains a challenge: a benchmark showed reducing context from 220,393 to 27,352 tokens (87.6%) while maintaining test pass rates, highlighting the need for deliberate context selection. The author argues that MCP’s success forces the question of building a production-grade infrastructure layer, similar to how HTTP led to CDNs and API gateways.
Staying Evergreen: How we automated secure access and repo hygiene in a shared org
Managing outside collaborator access and stale repositories in a shared GitHub organization becomes harder to keep up with as projects grow. Evergreen is a GitHub App built with native GitHub features—scheduled actions, webhooks, issues, and custom properties—that automates two workflows: quarterly outside collaborator access reviews and stale repository detection and archival. Its design principles are fail secure, revoking access if no one responds, and never destroy anything, keeping archived repos recoverable and every change tracked in issues. The app is a Go webhook server that stores state as JSON files in a controller repo, using git history as the audit trail, and interacts via checklist issues in each repository. Rollout included dry-run mode, overcommunication, Splunk observability, and proactive rate-limit pacing; the pattern is adaptable using native GitHub features.
A fully programmable secure web gateway
Traditional secure web gateways enforce security through a binary allow, block, or log model, which limits customization for complex environments. Cloudflare is integrating its Cloudflare Gateway and Data Loss Prevention with Cloudflare Workers, allowing customers to run arbitrary code inline at the moment a security decision is made. The new Forward action, available in public beta, routes matched HTTP traffic to a Worker that acts as inline middleware, enabling request and response modification or asynchronous tasks like sending Slack messages. Custom Functions, arriving before the end of the year, call a Worker during policy evaluation and return values used as selectors, enabling data-conditional rules and DLP validation against external APIs. Because Gateway and Workers run on the same machines in Cloudflare’s global network, dispatching traffic to a Worker is a local function call with no hairpinning or added latency.
What is agentic identity? Securing AI agents in 2026
AI agents are shifting from passive copilots to autonomous actors that book tickets, update calendars, and send messages without step-by-step human intervention. This shift introduces operational risks because traditional security controls designed for deterministic software cannot handle non-deterministic agent behavior, leading to over-permissioned agents, rogue behavior, and lack of real-time monitoring. Agentic identity is proposed as a governance layer built on three pillars: authentication (cryptographic keys), authorization (contextual permissions), and context (delegated link to end user). The framework includes short-lived session tokens, user context binding via token exchange, hard operational bounds on tool calls, human-in-the-loop gateways for high-risk actions, verified communication endpoints, and centralized logging with kill switches. By implementing these controls, organizations can deploy autonomous agents safely while maintaining visibility, containment, and auditability across all agent actions.
Announcing DPoP Support for Google OAuth: Securing Refresh Tokens
Google announced DPoP (RFC 9449) support for its OAuth platform, specifically binding refresh tokens to a client-generated asymmetric keypair to neutralize token theft and replay attacks from Infostealer malware and AiTM threats. Access tokens remain standard bearer tokens to avoid the per-request asymmetric cryptographic verification overhead on high-QPS APIs like Gmail and Drive, delivering a pragmatic tradeoff between security and performance. The implementation follows RFC 9700 best practices for sender-constrained refresh tokens and is recommended for Backend-for-Frontend (BFF) and Token-Mediating Backend architectures. DPoP operates at the HTTP header level, making it resilient in multi-hop environments such as Model Context Protocol (MCP) agent chains, though multi-agent delegation requires Google Cloud Secure Token Service (STS) to preserve key isolation. Complementary protections against cookie theft are offered by Device Bound Session Credentials (DBSC), which cryptographically binds browser session cookies to device hardware for a defense-in-depth strategy.
Configure Red Hat OpenShift Dev Spaces for enterprise security
Red Hat OpenShift Dev Spaces can be hardened for enterprise use by centralizing SCM authentication with OAuth, deploying a private OpenVSX extension registry, and enabling IntelliJ IDEA in restricted networks. The SCM integration uses a dedicated OAuth application and the scm-oauth-config Secret in the operator namespace, while disabling the default CA bundle mount reduces etcd overhead but requires an explicit corporate CA ConfigMap with keys ca.crt and githost to prevent TLS failures. A private OpenVSX registry with PostgreSQL-only architecture replaces external extensions, and automated governance rejects prereleases, timestamp builds, oversized patches, and previews through version-aware dependency resolution and idempotent publication tracking. For JetBrains support in air-gapped clusters, administrators mirror IDE tarballs to an internal repository and set editorsDownloadUrls; developers connect via JetBrains Gateway using either dashboard- or gateway-initiated workflows, both relying on an existing oc login session. This configuration gives platform teams oversight of authentication, extensions, and IDE tooling.
How Cloud-Based Agent Sandboxing Works in Air
AI agents require sandboxing to restrict file, network, and system access, preventing unintended modifications and data leakage. The post categorizes five agent execution modes into local (workspace, git worktree) and remote (SSH, Docker, Cloud), with remote modes providing stronger isolation by default. In JetBrains Air, each cloud agent task runs in its own VM with the agent inside a Docker container, and all network connections are routed through a proxy that allows only trusted domains by default. Secrets are stored encrypted and exposed as environment variables, and the agent operates within the developer’s repository permissions. Cloud-based execution reduces local setup requirements and gives organizations control over network access policies, with cloud agents currently available to organizational users via Air in IDEs and Air Teams.
How to Encrypt LangGraph Checkpoints With MongoDB CSFLE
LangGraph checkpoints persist agent state, including user messages and tool results, as plaintext BSON in MongoDB by default, leaving sensitive data accessible to anyone who can read the database. MongoDB Client-Side Field Level Encryption (CSFLE) encrypts data on the client before transmission, ensuring the database engine never sees plaintext values and protecting against privileged database users or data breaches. This post demonstrates implementing a custom CipherProtocol for LangGraph’s EncryptedSerializer that uses explicit CSFLE with randomized encryption, configured with AWS KMS and a data encryption key stored in a key vault collection for envelope encryption. The encrypted payload replaces the default Base64 encoding, while only thread IDs, checkpoint IDs, and namespaces remain unencrypted to support runtime lookups without exposing sensitive content. This approach aligns with enterprise security and compliance requirements for customer-facing AI agents, preserving resumable sessions and human-in-the-loop workflows while preventing database administrators or attackers from reading the state.
Making password login safer on Notion
Notion is requiring a second step of verification for password login to protect against credential reuse from other site breaches, and this change will roll out in stages over the next few months. When users set or change a password, they will be guided to set up two-step verification via an authenticator app or phone number and should save the backup codes provided. Users who already have two-step verification on their password need no action, and those without a password can continue using passkeys, email codes, or SSO. For password-only users without two-step verification, Notion will provide notice and time to set up a second step before turning off password-only login; if they choose not to, another method like an email code can still grant access. Additionally, where Notion can verify that another working method exists, it plans to turn off password login for those unused passwords.
Your Privacy Ecosystem Is Crucial In The Age Of GDPR - Inside
GDPR is a major regulatory change affecting all companies with EU customers globally, standardizing data handling and requiring legal justification for processing and user data rights. A privacy ecosystem includes all vendors and integrations sharing customer data, and the weakest link determines overall security, as a breach anywhere damages trust. Companies must invest in security programs with penetration testing, continuous monitoring, vulnerability disclosure, staff training, and a healthy paranoia about risks to protect against external attacks and data breaches. They should track and reduce unnecessary data access, choose vendors with contractual assurances and mature security, audit third-party providers regularly, and establish developer guidelines for integrations. Active communication and transparency about data storage, retention, and deletion are crucial for customer trust, and properly trained sales and support teams can turn GDPR compliance into a marketing differentiator.
September 2026 Fraud Update: Phishing Trends, Third-party Safety and Latest Releases
Twilio’s Q3 2026 fraud update covers phishing trends, third-party safety, and new releases. Over 80% of phishing originating from SendGrid was due to account takeovers, with attacks centered on delivery service spoofing, invoice fraud, and targeted Japanese campaigns impersonating brands like Amazon and Mercari. Attackers used fabricated forwarded threads, typosquatted domains like tvvilio[.]org, familiar names, AI-generated email templates, and associated phone calls, sometimes spoofing Twilio’s help line. To secure third-party integrations, Twilio recommends scoping access strictly, practicing credential hygiene, and reviewing audit integrations regularly, and now recommends OAuth 2.0 Client Credentials over auth tokens or API keys for scoped short-lived tokens. New releases include IP ACL with Dry Run mode, which logs blocked requests without enforcement to prevent accidental lockouts before real enforcement.
Part 4: Safety and governance for LLM systems: guardrails, PII, audit, and memory
When an LLM system makes decisions that matter, Level 4 safety and governance requires four disciplines: layered guardrails, PII handled at boundaries, an immutable audit trail, and scoped memory. Guardrails are independent layers arranged in a pipeline—input, grounding, output scrub, verification, judge, and confidence routing—each with a simple contract, and they fail closed so an error blocks the request. PII is handled at every boundary by classifying fields—unknown defaults to PII, secret never persisted—and redacting or hashing before crossing, storing only an HMAC hash in the audit ledger. The audit ledger is append-only, tamper-evident, and written as the final step of each decision, making past decisions traceable with a one-row query. Memory is split into seed (shipped config) and runtime (earned state); clear_state purges only runtime, returning behavior to baseline, and learning flows through a reviewed merge into seed.
Building an evidence-grounded agentic security operations harness on Cloudflare
Cloudflare’s Managed Defense harness uses a team of specialized AI agents to analyze security alerts, separating deterministic evidence collection from model inference to improve accuracy. Before any AI analysis, fixed reconnaissance workflows collect customer identity, detection history, traffic baseline, and enforcement outcomes, making evaluation reproducible. A lightweight triage model called Clef filters high-confidence false positives, while a coordinator agent runs four specialist agents in parallel for deeper investigation. The specialist agents cover traffic analysis, customer context, global telemetry, and threat intelligence, with a synthesis agent combining their typed findings into an advisory. The system preserves customer privacy by using only aggregate global telemetry, and Managed Defense Analysts remain responsible for final decisions and mitigations. The approach addresses three problems from a single-agent prototype: context becoming authority, scope drift, and failure to distinguish missing data from negative results.
How IdeaBot drives AI innovation workflows on OpenShift
Red Hat’s emerging technologies team built IdeaBot, an AI-enabled SaaS platform on OpenShift that automates innovation workflows from initial concept to a standardized idea report. The platform guides users through four stages—discovery, research, refinement, and synthesis—using conversational interviews, automated research across internal and external sources, a curation board with confidence scoring, and a synthesis view that compiles deliverables like executive summaries and market analysis. Security enforces session isolation in dedicated pods, credential isolation through an auth proxy and token service that injects short-lived tokens, and stateless compute with PostgreSQL persistence and a warm pod pool to reduce cold starts. Development uses EARS syntax and Gherkin feature files to drive behavior-driven development, enabling automated test generation and reproducible builds. Red Hat plans to extend IdeaBot toward fully autonomous, reproducible agentic SDLC pipelines using factory patterns.
The Ground Beneath the Database
On September 29th, MongoDB announced the public preview of Atlas Infinite, a new deployment option built on disaggregated storage where compute and storage run on separate machines. The shared storage layer consists of three services: a Log Service for write consensus, a Page Service keeping materialized pages warm, and an Object Index Service managing object storage. This architecture was necessary because WiredTiger’s speculative eviction and deferred writes made conventional approaches impossible. Data is encrypted on the compute node before reaching the storage layer, preventing shared services from reading documents. Benefits include unlimited storage scaling, read replicas without disk copying, and constant-time snapshots.
“Impossible to Hide Secret …”: Uncovering Security and Privacy Issues in LLM-Native IDEs
LLM-native IDEs (LIDEs) that allow AI agents to read repositories, execute commands, and modify code introduce significant security and privacy risks, as developers report incidents like leaked API secrets and file deletions. The authors analyzed 15.4 million Reddit posts from 46 subreddits using a three-stage pipeline, manually verifying 446 relevant posts and 6,280 comments for qualitative coding. They developed a taxonomy of 32 issues across 10 categories, with unauthorized file operations being the most frequent security problem (43.1%) and lack of transparency the top privacy concern (45.9%). Seven of the ten issue categories stem from system-level design choices rather than the underlying LLM’s reasoning. Developers commonly use self-devised workarounds such as configuration management (33%) and code governance (31%), indicating a trust gap between expectations and actual LIDE guarantees.
NTS: Authenticated Time at Meta
Meta launched NTS (RFC 8915) authentication for its public time service at nts.meta.com, enabling clients to verify the origin and integrity of time packets. The service separates key establishment over TLS 1.3 from authenticated NTP, with cookie keys derived daily from a shared secret so servers hold no per-client state. Shortening TLS certificate lifetimes to 100 days in 2027 and 47 days in 2029 makes automated certificate renewal increasingly essential, creating a dangerous circular dependency on an authenticated clock. Meta open-sourced its NTS implementation and encourages mobile OS vendors to add client support, as Android and iOS currently sync time over unauthenticated UDP. The protocol does not prevent delay attacks, and device bootstrapping remains circular since NTS-KE requires TLS validation that itself demands a correct clock.
Rossoctl for agent discoverability, security, and observability on Kubernetes
Agent sprawl arises when many AI agents on Red Hat OpenShift become redundant, insecure, and untraceable, using static API keys over HTTP and lacking visibility into reasoning failures. Rossoctl, a Kubernetes-native controller, automates discovery by declaring AgentRuntime resources that fetch metadata to create AgentCard custom resources, and uses a two-phase Helm deployment to resolve the URL dependency between routes and AgentCards. It adopts the A2A protocol, which standardizes agent interaction through a machine-readable AgentCard at /.well-known/agent-card.json and a JSON-RPC interface for consistent payloads. Security follows a six-layer zero-trust model: SPIRE issues short-lived certificates, Istio enforces mTLS, AgentCards are signed with JWS, and AuthBridge provides scoped OAuth2 tokens. Observability uses opt-in MLflow tracing that captures orchestration flow, tool calls, and model latency, enabling diagnosis of semantic failures such as hallucinations or data leaks that standard metrics miss.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.