Insights
Engineering updates, security deep-dives, and building in the open.
The full design of Declaw's credential vault: how a secret stays out of the sandbox, gets attached at the egress proxy on the way out, and why a fully compromised, prompt-injected agent still leaks nothing but a placeholder.
Read moreMost agent security is a claim on a slide. So we built Arena — a place to attack a real AI agent in our runtime and see, hands-on, what actually holds: the microVM it's isolated in, the guardrails that inspect its traffic, and the deterministic walls it can't route around.
Read moreAgents need API keys to be useful — but the moment a key lives inside the sandbox, one prompt injection can exfiltrate it. Here's how to give an agent a credential it can use but never read.
Read moreBy default an agent can call anywhere on the internet — which is exactly how a prompt-injected agent exfiltrates data or phones home. Here's how to put it on an allowlist and record every attempt.
Read moreAn MCP server runs on your machine with your tokens and pulls in hundreds of dependencies you've never read. Here's how to wrap any MCP server in an isolated microVM with one line of config.
Read moreA new kernel zero-day gives unprivileged users deterministic root on most Linux distributions since 2017. We tested it against our microVM isolation boundary. Here's what happened.
Read moreSandboxes isolate execution. But isolation doesn't stop your agent from leaking a customer's SSN to a third-party API. Here's the gap nobody talks about.
Read moreWe walked through a real scenario where a coding agent leaked a database password to a third-party API. Here's exactly how it happened and what would have stopped it.
Read moreEveryone knows prompt injection is a problem. Most teams think they've handled it with a system prompt. They haven't.
Read moreContainers are fast and convenient. They're also a terrible isolation boundary for untrusted AI agents. Here's the tradeoff we made and why.
Read more