Security

How AI systems get attacked, and how to defend them — techniques, hardening guides, and advisories from operating hardened agents in production.

1. advisory·defense

   Advisory: Your Local LLM Endpoint Is Probably Listening Too Widely

   Self-hosted inference servers ship with no authentication and an easy path to binding on all interfaces. Thousands end up reachable from the internet or an untrusted LAN. Five minutes of checking closes it.

   local-inferenceollamasovereignty
2. technique·dual

   Prompt Injection for Solution Architects

   The defining vulnerability class of LLM systems, explained at the level where it can actually be fixed: architecture. Injection isn't a prompt-writing problem — it's a privilege-separation problem.

   prompt-injectionai-agentsfundamentals
3. hardening·defense

   The Agent Tool Supply Chain

   Every MCP server, plugin, and community skill you connect to an agent runs inside its trust boundary and often speaks in the same instruction channel the model obeys. Treat agent extensions as a supply chain, because that's what they are.

   ai-agentssupply-chainmcp
4. hardening·defense

   The Agent Workspace Is an Attack Surface

   An agent's identity, rules, and memory live in files the agent itself can often write. That makes the workspace a persistence mechanism for attackers — and hardening it is cheap.

   ai-agentsprompt-injectionopenclaw