Ben-Hur Santos Ott — Software Security

Posts

  • Threat Modeling an Agent's Tool Belt

    Everyone wants to threat model the model. Wrong altitude. The model is a text generator that has never touched your infrastructure. What touched it was the bash tool you handed over three sprints ago.

    An agent’s attack surface is exactly the union of its tools’ capabilities. Nothing more, and — this is the part teams forget — nothing less, including the capabilities that emerge only when two innocuous tools are combined.

  • Prompt Injection Is Not a Filtering Problem

    Every few weeks someone announces they have solved prompt injection with a classifier that scores incoming text for maliciousness. Every few weeks someone else gets past it with a base64 blob, a poem, or a sentence in Portuguese.

    This will keep happening, because the framing is wrong. Prompt injection is not spam that needs better filtering. It is the natural consequence of an architecture where instructions and data travel in the same channel.

  • Your CI Pipeline Is the Softest Target You Own

    Your production database has a WAF, an audit log, and a quarterly review. Your CI runner has a copy of the credentials to it, executes arbitrary code from every branch, and has never once been threat modeled.

    Attackers noticed this asymmetry years ago. Build systems are where the secrets are, and unlike production, nobody is watching them.

  • The Authorization Bugs No Scanner Will Ever Find for You

    Every scanner on the market will find your reflected XSS. None of them will tell you that GET /api/invoices/8412 returns someone else’s invoice. The tool sees a 200 and a well-formed JSON body and moves on, because it has no idea that the record belongs to a different tenant.

    Broken access control stays at the top of the OWASP list for exactly this reason: it is the one bug class where the vulnerability is semantic, not syntactic.

subscribe via RSS