+Intertrace Insights
Insights
Field notes on securing AI agents: threat research on the attacks that work, technical papers on the controls that hold, and guides for the people who run them.
- Pieces
- 57
- Threat research
- 16
- Updated
- Oct 20, 2026
Latest
Guide11 min read
Approval fatigue: fewer asks mean more oversight, not less
Human approval for agents fails when people get dozens of identical prompts a day. The case for asking less: ask by consequence, turn repeated asks into scoped grants, remember only similar calls, budget approvals, and build screens a person can decide on in ten seconds.
Sam O.Read →
+New here
Start with these
+Intertrace Threat ResearchTLP:CLEAR
Threat research
How the attacks against agents actually work, what they need, and the controls that break them. Built from public incidents and from our own test corpora, with every source and every dataset named.
366 ways to make a destructive action look harmless
12 min read · Sam O.
Policy active is not an attack: the false positives that stop real agent work
12 min read · Sam O.
What deterministic layers catch on their own: a red-team baseline with the AI judge off
11 min read · Sam O.
Rules files and self-approval: how coding assistants get reconfigured by the code they read
9 min read · research desk
MCP and the tool supply chain
What you install, what a server tells your agent, and whose consent a proxy spends.
Threat research10 min read
The confused deputy in MCP OAuth proxies: consent that belongs to someone else
An MCP server that fronts a third-party API with one static OAuth client can hand a user's access to a client they never approved. The eight questions a reviewer should put to any MCP OAuth proxy, answered from the specification and two fixed FastMCP advisories.
Intertrace Threat Research
Threat research10 min read
Before the first tool call: SSRF in MCP discovery and local launch as code execution
Before any tool is called, an MCP client fetches URLs the server chose and may start local processes. A field guide to the six decisions that keep the connection handshake from becoming SSRF or code execution, with the tests that prove each one.
Intertrace Threat Research
Threat research10 min read
Rug pulls and tool poisoning: an MCP approval has to cover the bytes, not the name
MCP tool descriptions are instructions the model follows, and a server can change them after you approve it. A step-by-step teardown of tool poisoning and the rug pull, and the two controls that break it: pin the exact bytes, and inspect what reviewers cannot see.
Intertrace Threat Research
Prompt injection and exfiltration
Instructions that arrive as data, and the channels that carry your data back out.
Threat research9 min read
Cross-tool data laundering: when every call is allowed and the export is not
An agent can read restricted data, rewrite it and post it somewhere broader using only permitted tools. Seven beliefs that let this through, what public research and one disclosed case show instead, and the session labels, audience checks and canary tests that catch it.
Intertrace Threat Research
Threat research10 min read
Persistent memory poisoning: the incident that comes back after you close it
Agents that remember can be taught by an attacker once and misbehave for weeks. One fictional case followed from the poisoned write to the investigation, with the published research behind each step and the controls that would have stopped it at the write.
Intertrace Threat Research
Threat research9 min read
Prompt injection beyond text: six myths about images, documents and audio
Vision and audio models read instructions from pixels, PDF layers, screenshots and speech, where text filters never look. Six common beliefs about multimodal injection set against the published research, and the provenance and authority controls that hold when detection misses.
Intertrace Threat Research
Identity, credentials and access
Whose key the agent holds, what a connected account really allows, and where access gets decided.
Guide9 min read
OAuth connects the account. Policy governs the action.
An integration broker solves OAuth plumbing, but a connected account's scopes describe what the provider's API allows, not what your agent should do. Seven beliefs about brokered agent access that fail in practice, what the RFCs actually say, and the calls that test each seam.
Intertrace
Guide10 min read
Whose key is the agent using? The credential lifecycle from first grant to revocation
A dispatch agent loops at 2 a.m. and nobody can stop it without breaking four other jobs or waking the engineer whose token it uses. One incident, followed through identity, scoped grants, rotation, measured revocation and offboarding.
Intertrace
Guide10 min read
Your internal assistant answers anyone with anything in the index. Fix it before retrieval.
Internal RAG assistants leak because the index is built with an administrator's access and queried by everyone. The case for putting the permission check inside the retrieval query, the two strongest objections, and why caches, summaries and revocation belong to the same argument.
Intertrace
Approvals and enforcement
Deciding each action before it runs, asking people only when it matters, and failing safely.
Guide10 min read
When the policy check fails: the questions to settle before agent enforcement goes down
What should an agent do when its policy service is slow or down? The questions a design review asks about timeouts, cached decisions, retries and streaming, answered: route a missing decision by consequence, bound the cache, and key retries to the intended action.
Intertrace
Technical paper9 min read
The loosening hidden in a tightening: shipping agent policy changes with replay
One pull request against a procurement agent's policy, followed through rule tests, a 30-day decision replay, monitor mode, staged enforcement and an audit link to the commit, showing why peer review backed by a decision diff beats a change board.
Intertrace
Threat research10 min read
Approved is not executed: replay, substitution and check-to-use gaps in agent approvals
A person approves one action and a different one runs: edited arguments, re-resolved recipients, replayed permits, stale authority, duplicate retries. A step-by-step teardown of one approved payment that went wrong twice, and the bindings and tests that close the check-to-use window.
Intertrace Threat Research
Coding and computer-use agents
Agents with a shell, a browser or a repository, and the boundaries that keep production out of reach.
Threat research9 min read
Slopsquatting: the install is the attack, not the hallucination
Code-generating models invent package names and repeat many of them, and coding agents install what they invent. What the research measured, why better models and code review are not controls, and the registry and gateway checks that break the chain.
Intertrace Threat Research
Guide10 min read
Coding agents need broad access. Production should not be part of it.
A coding agent inherits every credential your shell can reach, so a session that starts with a failing test can end at the production database. Seven controls that keep production out of reach, why each matters, and the test that proves it.
Intertrace
Technical paper10 min read
Securing agents that click: computer-use and browser agents
A hotel receipt tells an expense-filing browser agent to change the reimbursement bank account. A step-by-step teardown of how that works, then the controls that hold even when the injection lands: isolation, allowlists, gated clicks, credential handling, redaction and takeover.
Intertrace
Testing, red teaming and measurement
Threat models, red teams, false positives and the numbers that show a control works without breaking work.
Guide10 min read
Measure agent security on two columns: the harm that got through and the work that got stopped
Agent security controls get blamed for broken workflows, and nobody can show whether they help. The case for measuring protection and friction on the same runs, pairing every attack case with a benign twin, and gating releases on both.
Sam O.
Technical paper10 min read
Red teaming AI agents as a continuous program, not an event
A red-team report describes the agent you had last quarter. The case for running it as a regression suite instead: technique-indexed cases, sandboxed tools, scoring by consequence rather than refusal text, benign twins, and reruns on every change.
Intertrace
Threat research10 min read
AI spend is a security signal: anatomy of a runaway agent's night
When an agent's bill jumps, the cause is often a loop, a recursive delegation, an injected instruction or a stolen key rather than growth. One illustrative overnight runaway, step by step, mapped to OWASP and MITRE, then the per-agent controls that would have stopped it.
Intertrace Threat Research
Running the program
Owners, boards, auditors, budgets and the incident you plan for before it happens.
Threat research20 min read
AI incident review: September–October 2026
A comprehensive public-source review of AI and agent security incidents disclosed September 17–October 17: evidence, activity dates, impact, remediation, and control lessons.
Intertrace Threat Research
Guide11 min read
An incident response playbook for an agent that crossed its authority
When an agent does something it should not, nothing was hacked in the usual sense and the standard playbook finds nothing. One fictional incident, followed from discovery to restore through five steps mapped to NIST SP 800-61 Rev. 3.
Intertrace
Guide11 min read
The first 90 days of an agent security program: authority first, policy later
A 30/60/90-day plan for the security lead just made accountable for agents already in production: find every agent that can act, put controls outside the model on the two or three that matter, and prove each phase on a real agent.
Sam O.
Shadow AI and data
The AI already in use, where prompts travel, and policies people will actually follow.
Guide10 min read
Seen is not protected: six coverage states between discovery and enforcement
Read-only discovery produces a long list of AI assets and nothing gets safer. Six beliefs that keep the list from turning into protection, what is true instead, and the evidence each coverage state needs, from seen to verified protected.
Intertrace
Guide8 min read
Shadow AI: your team already uses it, and a ban will not change that
Banning unapproved AI tools mostly moves their use out of sight. Five myths about shadow AI, from the chat tab to connected apps and unattended agents, and what to do instead: discover, decide tool by tool, and offer a faster sanctioned path.
Intertrace
Guide9 min read
Data residency for LLM traffic: where prompts go and how to keep them there
An in-region model endpoint settles one copy of a prompt out of six or more. Following one fictional EU insurer's claims assistant: map every copy, read provider regional terms down to the exclusions, and route by data class.
Intertrace
Essay series · 7 parts
A Century of Possibility
By Sam O.
Seven essays on what a hundred years of invention teach about the arrival of AI: in care, classrooms, factories, markets and institutions, and why capability alone has never been enough.
- 01The century that rewired human possibilityFrom 1926 to 2026: how electricity, medicine, computing, networks, and AI expanded human capability, and why invention alone never guaranteed progress.
- 02When intelligence becomes infrastructureWhy AI’s economic importance depends on workflow redesign, human expertise, and the difficult journey from a capable model to a useful institution.
- 03A second pair of eyes: AI and the work of careHow AI can strengthen medicine and scientific discovery, and why a correct prediction is only one step toward a better human outcome.
- 04The classroom after the answer machineAI can make explanations abundant. Education must still teach people to question, practice, judge, and understand without outsourcing the work of learning.
- 05AI returns to the physical worldFactories, farms, energy systems, and weather reveal why the future of intelligence still depends on sensors, materials, maintenance, and physical limits.
- 06The economy of decisionsHow AI may reshape finance, public services, small business, and work, and why faster decisions still need reasons, accountability, and a fair distribution of value.
- 07The future needs more than intelligenceAs AI moves from producing answers to taking action, human progress depends on judgment, permission, accountability, and institutions capable of learning.
+The index
Every piece, newest first
57 pieces
- Threat research366 ways to make a destructive action look harmless12 min
- Threat researchPolicy active is not an attack: the false positives that stop real agent work12 min
- Threat researchWhat deterministic layers catch on their own: a red-team baseline with the AI judge off11 min
- Threat researchRules files and self-approval: how coding assistants get reconfigured by the code they read9 min
- Threat researchSlopsquatting: the install is the attack, not the hallucination9 min
- Threat researchAI incident review: September–October 202620 min
- GuideApproval fatigue: fewer asks mean more oversight, not less11 min
- EssayThe century that rewired human possibility9 min
- EssayWhen intelligence becomes infrastructure9 min
- EssayA second pair of eyes: AI and the work of care9 min
- EssayThe classroom after the answer machine9 min
- EssayAI returns to the physical world9 min
- EssayThe economy of decisions9 min
- EssayThe future needs more than intelligence10 min
- Threat researchThe confused deputy in MCP OAuth proxies: consent that belongs to someone else10 min
- GuideSeen is not protected: six coverage states between discovery and enforcement10 min
- GuideOAuth connects the account. Policy governs the action.9 min
- GuideWhose key is the agent using? The credential lifecycle from first grant to revocation10 min
- GuideCoding agents need broad access. Production should not be part of it.10 min
- Threat researchCross-tool data laundering: when every call is allowed and the export is not9 min
- GuideYour internal assistant answers anyone with anything in the index. Fix it before retrieval.10 min
- GuideWhen the policy check fails: the questions to settle before agent enforcement goes down10 min
- GuideMeasure agent security on two columns: the harm that got through and the work that got stopped10 min
- Threat researchPersistent memory poisoning: the incident that comes back after you close it10 min
- GuideAn incident response playbook for an agent that crossed its authority11 min
- GuideThe first 90 days of an agent security program: authority first, policy later11 min
- Technical paperThe loosening hidden in a tightening: shipping agent policy changes with replay9 min
- Threat researchBefore the first tool call: SSRF in MCP discovery and local launch as code execution10 min
- Threat researchPrompt injection beyond text: six myths about images, documents and audio9 min
- Threat researchApproved is not executed: replay, substitution and check-to-use gaps in agent approvals10 min
- Threat researchRug pulls and tool poisoning: an MCP approval has to cover the bytes, not the name10 min
- Technical paperTenant isolation when every customer shares the model8 min
- Threat researchInvisible instructions: Unicode tag characters and ASCII smuggling against LLMs11 min
- Technical paperThe cost of a guardrail: latency and inference budgets for runtime AI security9 min
- GuideWhat an AI security incident costs, and how to model one for an agent9 min
- NewsWhen agents delegate to agents: what A2A verifies, and what your chain still has to9 min
- GuideShadow AI: your team already uses it, and a ban will not change that8 min
- NewsEchoLeak and the exfiltration channel in your assistant's renderer9 min
- GuideWhat a board should ask about AI agents, and what good answers sound like8 min
- GuideBuying AI security: ten checks that separate real controls from theater10 min
- NewsThe MCP supply chain is your package supply chain, with your agent's keys attached10 min
- GuideVendor agents in your systems: scope, logs and a kill switch that works10 min
- NewsIndirect prompt injection is now an operations problem9 min
- GuideWhat auditors ask about AI agents, and the evidence that answers them9 min
- Technical paperSecuring agents that click: computer-use and browser agents10 min
- NewsAugust 2, 2026: what the EU AI Act now asks of agent deployers, and what NIST has started9 min
- Threat researchMalicious model files: the questions to answer before anyone calls torch.load9 min
- Technical paperRed teaming AI agents as a continuous program, not an event10 min
- GuideData residency for LLM traffic: where prompts go and how to keep them there9 min
- Threat researchAI spend is a security signal: anatomy of a runaway agent's night10 min
- GuideDue diligence for the AI features already inside your SaaS10 min
- GuideWhy AI pilots stall at security review, and the kit that gets them through9 min
- GuideAn AI acceptable-use policy people will actually follow9 min
- GuideGuardrails developers won't route around: a checklist for the governed path10 min
- Technical paperWhat to record for every agent action: a security telemetry schema10 min
- GuideThreat model an AI agent in one afternoon10 min
- GuideNobody owns the agents: fixing AI accountability before the first incident11 min
+Stay current
New research, the week it publishes.
Subscribe with RSS, or email support@intertrace.ai with a topic you want covered. To see the controls in action, try the Simulation Lab or read the documentation.