AI Threat Modeling: Trust Boundaries for RAG, Agents, and MCP
Advanced guide to AI threat modeling for RAG, agents, and MCP, with trust boundaries, context provenance, and identity separation.
- FeaturedOffensive Security
The 5 Highest-Paying Bug Bounty Vulnerabilities
The five vulnerability classes that most often command the highest bug bounty payouts, with advanced local-lab examples, impact validation, mitigation guidance, and tips for stronger reports.
-
-
Advanced Threat Modeling: Identities, Trust Boundaries, and Attack Chains
Advanced threat modeling in practice: identities, trust boundaries, SSRF, cloud metadata, delegated tokens, and blast radius across real attack chains.
-
HackerDNA: 4 Steps to Train for Pentesting
How to use ethical hacking labs to train enumeration, exploitation, evidence gathering, and reporting discipline without falling into CTF habits.
-
CVE-2026-11645: Chrome V8 Exploited
CVE-2026-11645 affects Chrome/Chromium V8 and is already in CISA KEV. In a safe local lab, I show the impact and the red-team response logic.
-
Attacking Multi-Agent Systems: Rogue Agents and A2A
A practical AI Red Team guide to A2A reconnaissance, canary agent registration, agent-card spoofing, and delegation auditing in an authorized lab.
-
Agentjacking: When Your AI Assistant Becomes a Weapon
Agentjacking exploits the blind trust AI assistants place in MCP data. One fake Sentry event and your agent executes malicious code.
-
MCP Security: Tools and Permissions in Practice
MCP Security in practice: a safe lab with fictional documents, a mocked local agent, controlled tool exploitation, permissions, schemas, and auditable logs.
-
OpenSSH 9.9 → 10.3: Why You Should Update Now
OpenSSH 10.3 addresses risks in the SSH client, certificates, forwarding, and legacy scp. Here is the impact, a Blue Team checklist, and safe defensive PoCs.
-
Attacks on Embeddings and Vector Databases
Embedding attacks in practice: inversion, membership inference, semantic probing, evidence artifacts, and defenses for vector databases.
-
AI Red Team: 12 Failures Beyond Prompt Injection
A practical AI Red Team guide for testing agents, RAG, memory, tools, and autonomy workflows beyond prompt injection, with checklists, metrics, and controls.
-
AI Recon: LLMs, RAGs, and Agents
Authorized reconnaissance for enterprise AI: map LLMs, RAG pipelines, agents, tools, IAM, APIs, cloud exposure, and evidence without drifting out of scope.
-
Autonomous Pentest Agent: AI, Red Team, and Attack Chains
Autonomous Pentest Agents can accelerate Red Team operations, but they also introduce risk around prompt injection, tool misuse, scope control, evidence quality, and detection.
-
Defensive Corporate OSINT: A Red Team Guide to Mapping Exposure, Identity, and Cloud
An advanced guide to defensive corporate OSINT from a Red Team perspective, covering identity, cloud, APIs, detection, and real attack chains.
-
Burp Suite Extensions for API Security
An AppSec guide to building safe Burp Suite extensions for authorized API assessments across JWT, BOLA/IDOR, mass assignment, rate limiting, OpenAPI drift, and evidence collection.
-
WAF Bypass in Practice: Real Techniques, Detection, and Mitigation
Learn real WAF bypass techniques, how to validate evidence safely, and which controls to apply for detection and mitigation in defensive environments.
