Tomorrow Is Coming to Collect
The top 1% of companies spend $7,500/employee/month on AI. Token prices dropped 98% but bills tripled. 84% of CFOs see no ROI. The AI spending binge is over and the bill is arriving.
Writing
Posts
Subscribe via RSS →The OWASP Agentic AI Top 10: What Builders on AWS Need to Know
This is post #0 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. You’ve secured your GenAI chatbot. You’ve got prompt injection filters, output validation, maybe …
Agent Goal Hijack: When Your AI Agent Works for Someone Else (ASI01)
This is post #1 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. You build an agent. You give it a clear goal: “Help customers check their order status.” You test …
Tool Misuse & Exploitation: When Your Agent's Legitimate Tools Become Weapons (ASI02)
This is post #2 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. Your customer service agent has access to an email tool. Makes sense. It needs to send order confirmations. …
Identity & Privilege Abuse: When Your Agent Acts Like It Owns the Place (ASI03)
This is post #3 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. Your engineering manager builds an agent to help her team. She gives it access to the team’s Jira board, …
Agentic Supply Chain Vulnerabilities: Your Agent Is Only as Secure as Its Weakest Plugin (ASI04)
This is post #4 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. You install an MCP server from npm. It says “postmark-mcp” on the label. Looks legitimate. Has a …
Unexpected Code Execution: When Your Agent Becomes a Shell (ASI05)
This is post #5 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. I wrote about the trust gap with coding assistants in Your Coding Assistant Is Not You. But when agents can …
Memory & Context Poisoning: When Your Agent's Memory Becomes a Weapon (ASI06)
This is post #6 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. Your agent has been working perfectly for weeks. It answers customer questions accurately, retrieves the right …
Insecure Inter-Agent Communication: When Agents Talk, Attackers Listen (ASI07)
This is post #7 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. You’ve built a multi-agent system. I’ve built multi-agent systems. Agent A handles customer …
Cascading Failures: When One Agent's Mistake Takes Down the Whole System (ASI08)
This is post #8 of the OWASP Agentic AI Top 10: What Builders on AWS Need to Know series. A search tool starts returning errors. 2% failure rate. Nothing dramatic. Your agent retries. Makes sense. But …