Blog
Notes on securing AI agents
Practical engineering on agent actions: authorization, data exfiltration, MCP, and compliance.
How to stop an AI agent from exfiltrating customer data
Data leaves through an agent's tools: exports, email, outbound APIs. Check those actions before they run, by destination and volume, and let everything else through.
LGPD and GDPR for AI agents: what to log, what to stop, what to keep out
Agents move personal data through tools. A practical engineering view of minimisation, outbound transfers, human review and audit evidence under LGPD and GDPR.
MCP security: authorize the tool call, not just the connection
OAuth decides whether an agent can connect to an MCP server. It doesn't decide whether this call, with these arguments, should run. Here are three places to put that check.
The OWASP LLM Top 10 for teams shipping AI agents
The 2025 OWASP Top 10 for LLM applications, read from the point of view of an agent with tools: which risks live in the prompt, which live in the action, and what controls each one.