How Can You Restrict MCP Server Egress When Agents Need HTTPS Access?
I wrote about a failure mode where everything works as configured, yet an AI agent still exfiltrates data. The chain is simple: attacker-controlled text appears in a support…
data exfiltration
How Can I Investigate Unauthorized Access and File Transfers by a Former Admin?
I'm currently working on a forensic investigation involving a former systems administrator. We've found that they manipulated their permissions in Active Directory before leaving, which raises some serious…
Concerns About Chrome's New 'Save to Drive' PDF Feature and Data Security
Google recently introduced a new 'Save to Drive' button in the PDF viewer within Chrome. This feature raises significant security concerns, especially in environments that aren't closely monitored.…
Understanding Security Risks of S3 Pre-Signed URLs
I'm curious about the security implications of using overly permissive IAM permissions when generating S3 pre-signed URLs. Since these URLs are signed with the HTTP method in SigV4,…