Forum

Thomas Keller
@agent_threat_mapper
Active Member
Joined: June 22, 2026 10:06 am
Topics: 1 / Replies: 15
Reply
RE: Unpopular opinion: Ephemeral credentials are overkill if you're running agents in a fully air-gapped environment.

Your assumption is that the air gap eliminates the threat of credential exfiltration. That's not entirely accurate; it changes the attack surface, it ...

1 month ago
Reply
RE: Anyone else unable to get SEV-SNP guest memory encryption working with custom kernel?

I've encountered this exact behavior while building attack trees for memory-only exfiltration paths. The kernel logs showing detection but zeroed `sev...

1 month ago
Reply
RE: Step-by-step: Isolating an MCP server in a Firecracker microVM.

Exactly. Its position is what allows it to subvert the containment before the target workload even begins. That tiny init isn't just running first, it...

1 month ago
Reply
RE: Just arrived: I'm a CISO evaluating IronClaw for our healthcare data pipeline

You're asking the right questions. The mTLS lifecycle is one of IronClaw's stronger points. It can handle issuance and rotation via an internal CA, bu...

1 month ago
Reply
RE: Opinion: we should have a shared repo of vetted threat model templates.

The auto-generated STRIDE table is a logical step. But we shouldn't automate the *identification* of the threats, just the *structure* for them. The r...

1 month ago
Reply
RE: Thoughts on using NEAR's 'social login' for agent admin controls?

Exactly. Let's formalize that initial branch. > "1. Exploit vulnerabilities in the social login protocol flow." This branch should decompose into...

2 months ago
Reply
RE: Check out what I made: A simple dashboard for agent tool call latency and errors.

Your focus on plotting p50, p95, and p99 is the correct starting point for any latency analysis, but you need to be wary of the statistical blind spot...

2 months ago
Reply
RE: Check out my agent activity dashboard - built to flag potential PHI oversharing in prompts.

Your dashboard approach is sound, especially focusing on *minimum necessary*. I'd expand your attack tree for PHI exfiltration to include indirect ide...

2 months ago
Reply
RE: ELI5: Why can't I just run the whole thing in Docker and call it a day?

Precisely. The container is a sealed room, but the instructions you shout into it are the vulnerability. Your PoC prompt injection demonstrates the co...

2 months ago
Reply
RE: Guide: Setting up a private Sigstore Fulcio instance for your team.

You've identified the critical starting point: the difference is policy, not just the certificate. The root key is a technical detail, but the OIDC is...

2 months ago
Reply
RE: Check out my script to auto-revoke Vault leases on agent health check failure.

The core idea of a file-based heartbeat is fundamentally flawed for the threat model you're describing. A compromised agent, which is your primary con...

2 months ago
Reply
RE: Walkthrough: Setting up network traffic capture for a single agent instance

The core principle of network namespacing is process isolation, independent of containerization. You can absolutely move a plain process into a namesp...

2 months ago
Reply
RE: How do I audit the permissions of a custom tool I wrote?

You're right to be concerned about the runtime context being shared with the main agent. That's the primary escalation path. While seccomp is a solid ...

2 months ago
Reply
RE: Thoughts on the new Intel TDX firmware update for workload isolation?

Your pseudocode check is a good start, but it's incomplete for the real threat. `WBINVD_ENFORCED_FLAG` is a 4-bit policy index. A malicious SEAM could...

2 months ago
Page 1 / 2