RESEARCH / INDEX
AI agent security research.
I study failures in agent identity, tool execution and dependency trust. The findings become controls for products and open source infrastructure.
ACTIVE THREADS / 01
Three research areas.
Agent security
AI agents read files, call tools, use credentials and trigger actions. I research the identity, authorization and execution controls required before that work can scale safely.
02MCP security
MCP is becoming infrastructure for agent work. My focus is the security boundary around servers, tool descriptions, request identity, authorization and cross-tool execution.
03Software supply chain
Packages, lockfiles, install scripts, skills, CLIs and MCP servers all shape an agent’s behavior. I work on provenance, change detection and deterministic checks before execution.
Field evidence, not speculative risk.
Reported findings across formal disclosure programs keep the research tied to code, execution paths and confirmed boundaries.
BLOG / 04
Technical notes, with sources.
Notes on protocols, vulnerabilities and product decisions, with links to the underlying sources.
Autonomy is a security boundary
Production agents usually operate with approval, supervision or guardrails. Each step away from the human changes the requirements for identity, policy, evidence and recovery.
03MCP 2026-07-28 moves the security boundary to the server
The release candidate removes protocol sessions and makes requests easier to scale. It also leaves state integrity, authorization and resource controls squarely in each implementation.
04The agent identity crisis, four months later
A2A v1.0 formalized signed Agent Cards, MCP stabilized Enterprise-Managed Authorization, and research prototypes explored task-scoped tokens. A status check on what is available, proposed, and still missing.
05Joining the first cohort of Agentic AI Foundation ambassadors
The Linux Foundation initiative put MCP under open governance and opened its first ambassador program. What that means for agent infrastructure and security.
06Working with AI agents doesn’t remove the mental load, it transforms it
The real challenge is not the model of the week, but how we manage energy and time in a reality that never rests.
07No AI sovereignty without infrastructure sovereignty
From Atoms for Peace to frontier-model export controls: why AI sovereignty is decided in infrastructure, not model access.
08MCP is making request identity explicit
MCP is moving authorization context from the connection to each request. The direction is clear; the stateless 2026-07-28 specification is still a release candidate.
09Skills over MCP: who checks the manual?
SEP-2640 proposes discovering skills through MCP resources. The mechanics are promising; provenance, pinning, review, and instruction precedence remain open trust questions.
10MCP as a supply chain: trust boundaries in agent tooling
Every server an agent calls is an implicit trust decision. How to make that decision explicit and find the remaining blind spots.
11AgentPay: what we built at the Anthropic × Kaszek hackathon
A prototype that puts deterministic security checks in front of the payments an AI agent tries to execute.
12Policy before agent execution: what security has to control
Static scanning stops at deploy. What it takes to constrain agent behavior in production.
13Security is a product decision, not a checklist
The most consequential call a technical founder makes is what not to ship. Agent security cannot wait for an incident.
14AI agents don’t have identities, and that’s a security crisis
The AI-agent identity gap, the delegation problem, and the five layers it takes to close it.
15What public agent tooling reveals about ecosystem trust
Findings from monitoring the agent ecosystem across major registries: permissions, provenance, and drift.