Research — agent security, written down
Technical articles that target the real security questions people search for when they run autonomous agents. No marketing filler — each one explains an actual attack, why it works, and what defense is credible.
The single most important concept in agent security: reading content is not the same as authorising it to act. Everything below builds on that idea.
Articles
How AI Agent Memory Poisoning Works
The full mechanics of planting false facts in an agent's long-term memory.
Why Retrieval Is Not Permission
The core principle behind runtime enforcement, argued from first principles.
Why Prompt Filtering Alone Is Insufficient
Why "never trust documents" prompts fail and what to do instead.
Securing MCP Tool Calls
Enforcing Model Context Protocol tool calls at the runtime boundary.
Agent Memory Is a Security Boundary
Why memory must be treated as security-critical, not just a data store.
Why Agent Security Must Happen at Execution Time
The case for action-time revalidation over ingest-time filtering.
Start here
New to agent security? Read Why Retrieval Is Not Permission first — it's the idea every other article builds on. Then see the Attack Lab to watch these attacks live, or jump to the benchmarks for hard numbers.