Upstream Security

Every architecture review I join this year starts the same way. The business wants agents in production next quarter. The AI team has a framework, a model provider and a backlog of use cases. Security is asked to sign off on something it cannot see. Before we debate detection engines, turn on the lights: 1️⃣ One LLM gateway in front of all your models, frontier and open-weight. Bi-directional, because indirect prompt injection lives in the response, not the request. 2️⃣ An API gateway in front of every tool and MCP server. One identity per agent, every call logged. Gateways won't catch a slow, multi-step attack. So keep them fast: deterministic policy inline, everything else streamed out of band to a stateful layer that feeds your XDR. Build it at tens of agents, not thousands. Full architecture 👇 https://lnkd.in/edXw6Y49 #AISecurity

An attacker cracked 2.18 billion possible record codes, and every single request looked structurally perfect to the WAF watching it. This is BOLA, the #1 API risk, and it gets harder to catch as AI agents automate traffic. Spot the pattern before it's your headline.

AI context isn't (only) a snapshot. It's a live feed. In one of the most severe AI agent failures on record, an AI coding agent wiped a live production database during an explicit code freeze. It is a warning most security programs haven't acted on. The agent didn't need new permissions. It used access it already had. Nothing in any inventory looked wrong. The next breach will use access you already approved. "Context" is the word of the year in AI security. But most of it is a snapshot: who can reach what, as of the last scan. Context isn't static. It changes with every call an agent makes. One-off mapping tells you what an agent is allowed to do. It can't tell you what it is doing right now. The question every security teams needs answered: 👉 Is what this agent is doing right now consistent with everything it has done before? My recommendation: make behavioral assurance a condition of production. Define the behavior you expect from every agent, not just the access it needs. Then measure one thing: how quickly would you know if an approved agent started acting out of character? If the answer is "at the next review," you have a snapshot. You need a live feed. Full post here 👉 https://lnkd.in/dPnzb_GG Upstream Security

Last week, #Anthropic showed that small AI models can copy themselves onto connected devices and keep spreading, with no human assistance. Picture that on a fleet of robots, vehicles or industrial machines, each carrying serious AI compute. Malware and botnets aren’t new. What’s new is AI doing the work of adapting to each unfamiliar device. In #physicalAI, the variety of hardware used to slow attackers down. That barrier is disappearing. The answer isn’t more alerts. It’s continuous verification: is every machine still doing what it was designed to do, and doing it safely? I put together a detailed analysis of the risk cases 👇 https://lnkd.in/dNcKnhKS Yoav Levy Roy Bachar Upstream Security

We recently caught an AI agent leaking its own API key. Nobody attacked it. It was just trying to do its job. An engineer asked the agent to look at a ticket. A config mismatch broke the login, so the agent started debugging on its own. Seven minutes and six attempts later, the full token was sitting in its conversation. What bothers me most: the skill it was running was carefully written so the model never touched the credential. It passed code review on exactly that basis. The leak didn't come from that code. It came from commands the agent wrote for itself when the happy path broke. Upstream Security's runtime monitoring flagged the token and redacted it. That mattered more than it sounds. Agents replay their whole conversation on every turn. Without redaction, the live token would have ridden along on every request. My takeaway: build-time safety is not runtime safety. You can review a skill's code. You can't review an agent's improvisation in advance. Agents aren't reckless. They're persistent. Hand one a broken login and a shell, and it will do what a good engineer does at midnight: look at everything. So watch what it does and why, the way you'd watch anyone you've trusted with the keys.

Think about Dalí’s “The Persistence of Memory.” If a cyberattack is broken into 20 harmless-looking tasks across 10 separate sessions, is it still an attack? To most AI security tools today, the answer is no. Each action looks legitimate. Each session appears clean. But together, they may form a coordinated attack. “Context” and “behavior” are everywhere in AI security. But one critical question is often overlooked: 👉 How long does your security system’s memory last? Most defenses monitor within a single session. When the session ends, the context disappears. If you’re evaluating AI-agent security, ask: 1️⃣ Does it retain context across sessions? 2️⃣ Can it connect actions across agents, identities, and tools? 3️⃣ Can it understand the intent behind the full sequence? Without persistent memory, context is temporary. And temporary context is exactly what a patient attacker needs. Learn more here: https://lnkd.in/dQdSmUHU #AISecurity #AgenticAI #Cybersecurity #AIAgents