Security Research

PUBLICATIONS

Latest Publications

The Lethal Trifecta: Dual-LLM & CaMeL

Privilege separation is the only prompt-injection defense that gives you a security property instead of a detection rate. How dual-LLM and CaMeL work — and where they still fail.

July 9, 202611 min read

ResearchINFO

Fix the Plan Before You Read the Payload

Plan-then-execute and action-selector: keep attacker-controlled strings out of the step where the agent decides what to do.

July 8, 20269 min read

ResearchINFO

Well-Formed Is Not the Same as Safe

Structured output plus strict post-validation and grounding: everything the model returns is untrusted until it clears validation — and schema validation alone isn't enough.

July 7, 20268 min read

Executive BriefINFO

“We Just Use Claude” Is Not a Security Program

The model can write the fix. It can't, on its own, tell you what broke, whether it shipped, who it exposed, or how to prove it's closed.

July 6, 20269 min read

ResearchINFO

Nothing to Steal, Nowhere to Send It

Least-privilege tooling and isolation remove two legs of the lethal trifecta, turning a successful injection into a no-op.

July 6, 20269 min read

ResearchINFO

Teaching the Model Which Words to Distrust

Spotlighting — delimiting, datamarking, and encoding — marks external text so the model can tell data from instructions. Cheap, high-value, and still just a probability.

July 5, 20268 min read

ResearchINFO

Where Did This Value Come From?

Tag every value by origin, propagate taint through the pipeline, and route sensitive actions with untrusted-tainted arguments to human review.

July 4, 20269 min read

ResearchINFO

The Render Surface Is an Exfiltration Channel

LLM output rendered in a browser can leak data with zero clicks. Strict CSP, image proxying, host allowlists, and sanitization close the channel.

July 3, 20269 min read

ResearchINFO

A 92% Filter Is Not a Boundary

Classifier guardrails are worth having as defense-in-depth — but a control with a documented bypass rate is not where your security should live.

July 2, 20268 min read

ResearchINFO

Every Injection Becomes a Test

Continuous adversarial testing and a red-team regression corpus keep your defenses honest as models, prompts, and attacks drift.

July 1, 20269 min read

ResearchINFO

Why STRIDE Fails AI Systems

A new paradigm for threat modeling in the age of semantic computing—endpoints, fuzzy boundaries, and intent surfaces instead of components and perimeters.

April 202618 min read

PUBLICATIONS

Latest Publications

The Lethal Trifecta: Dual-LLM & CaMeL

Fix the Plan Before You Read the Payload

Well-Formed Is Not the Same as Safe

“We Just Use Claude” Is Not a Security Program

Nothing to Steal, Nowhere to Send It

Teaching the Model Which Words to Distrust

Where Did This Value Come From?

A Clean Repo Can Own Your Machine

The Render Surface Is an Exfiltration Channel

A 92% Filter Is Not a Boundary

The Half-Life of a Security Review Is Shrinking

Every Injection Becomes a Test

Lovable's BOLA Flaw: Vibe-Coded Apps, Real Breach Exposure

Introducing ATNP: A Trust Protocol for the Agent Economy

Vercel Incident: What Actually Broke (and Why It Matters to You)

Your AI Governance Program Has a Security Blind Spot

Why SOC 2 Doesn't Cover Your AI Risk

The CISO's Guide to AI Program Security

Red Teaming Your AI: What Your Vendor Won't Tell You

Building an AI Security Posture: Beyond the Checkbox

Why STRIDE Fails AI Systems

Red Team Your LLM Before Someone Else Does

Attestation: The Missing Pillar of Trust

Secure by Design: Shifting Security Left in the Age of AI

Vibe Coding and the New Attack Surface

Why Traditional Pen Tests Miss the Biggest AI Risks

The AI in Your Pocket: When LLMs Leave the Cloud

Introducing MAUL: An Open Source Vulnerable AI Lab for Security Training

Model Context Protocol (MCP): Architecture, Implementation & Security

Function Calling: How LLMs Execute Real-World Actions

A2A Protocol: How AI Agents Collaborate

RAG: Grounding LLMs with External Knowledge

Agent Architectures: ReAct, Plan-and-Execute, and Multi-Agent Systems

Prompt Engineering Patterns: A Practitioner's Guide

Shift-Left Security for AI Systems

Research Spotlight: AI Deception — When Your AI Learns to Lie

Chain-of-Thought Prompting: A Deep Dive into LLM Reasoning

The AI-Native SDLC: Why Your Development Process Needs to Change

React Server Components Under Fire (Again): CVE-2025-55184 and CVE-2025-55183 Deep Dive

What Business Leaders Need to Know About the React Vulnerability

React Server Components Pre-Auth RCE