https://www.alephbeth.ai/ Deep-dives into prompt injection, MCP server security, LLM internals, and actionable defensive checklists for production systems. en-us Mon, 14 Sep 2026 08:00:00 GMT https://www.alephbeth.ai/posts/2026-09-14-when-the-web-becomes-a-weapon-attacks-on-ai-agents/ https://www.alephbeth.ai/posts/2026-09-14-when-the-web-becomes-a-weapon-attacks-on-ai-agents/ Mon, 14 Sep 2026 08:00:00 GMT All it takes to hijack an AI agent is for it to visit a web page carrying invisible instructions. This article walks through the full attack chain — indirect prompt injection observed in the wild, persistence through memory and RAG poisoning, state-level redirection of agent searches — then turns the weapon around: reverse-injection honeypots, tarpits and trap functions that expose attacking agents. prompt-injection indirect-injection rag-poisoning agent-memory geopolitics honeypot defensive-deception claude-mythos owasp-llm01 https://www.alephbeth.ai/posts/2026-09-13-hidden-weapon-in-the-page/ https://www.alephbeth.ai/posts/2026-09-13-hidden-weapon-in-the-page/ Sun, 13 Sep 2026 08:00:00 GMT An indexed web page can carry a natural-language payload that targets, in a few lines, all four defensive layers of an AI agent: evasion, persistence, exfiltration, concealment. Worse, the outbound channel used for exfiltration is bidirectional: behind the URL, an attacker talks to the agent in real time. This article details the mechanism, shows why warning the model is a necessary but never sufficient first line, and why security comes from architecture — not from the prompt. prompt-injection indirect-injection exfiltration c2 agentic-security owasp-llm01 defense-in-depth https://www.alephbeth.ai/posts/2026-07-29-deceive-detect-exhaust-defending-against-offensive-ai-agents/ https://www.alephbeth.ai/posts/2026-07-29-deceive-detect-exhaust-defending-against-offensive-ai-agents/ Wed, 29 Jul 2026 08:00:00 GMT A human pentester gets tired, breaks for lunch, eventually gives up. An LLM-driven agent does none of that: it loops around the clock, draws no salary, and costs less every year. Against that adversary two mechanisms combine — decoys written for a reader that is a machine, and a maze of virtual machines that turns every hour of attack into pure expenditure. This article details both, and the four limits to state before any deployment. hardening autonomous-agents honeypot prompt-injection canary-token detection claude-mythos https://www.alephbeth.ai/posts/2026-06-29-ai-agent-security-jailbreak-countermeasures/ https://www.alephbeth.ai/posts/2026-06-29-ai-agent-security-jailbreak-countermeasures/ Mon, 29 Jun 2026 08:00:00 GMT A chatbot writes sentences; an AI agent acts — it reads your email, runs code, calls APIs, spends money. That shift moves the risk: it is no longer about making the AI say something forbidden, but about making it do something dangerous. This article explains, with detailed and accessible examples, how these attacks actually work, why naive guardrails fail, and what a decision-maker must demand before putting an agent into production. agentic-security autonomous-agents prompt-injection jailbreak exfiltration mcp decision-makers https://www.alephbeth.ai/posts/2026-06-29-prompt-position-fine-tuning-never-validate/ https://www.alephbeth.ai/posts/2026-06-29-prompt-position-fine-tuning-never-validate/ Mon, 29 Jun 2026 08:00:00 GMT A stubborn intuition holds that you only need to put the safety rules 'first' in the system prompt. It is false, and for a reason that turns against it: a transformer grants no authority to a token's position. Fine-tuning fails exactly the same test. Neither is an access control — both live inside the very thing they claim to constrain. The only guarantee is deterministic and external, and a rigorous dataset must reflect that boundary in its labels. prompt-injection instruction-hierarchy fine-tuning validation defense-in-depth llm-security https://www.alephbeth.ai/posts/2026-06-30-recursive-corruption-of-ai-control-systems/ https://www.alephbeth.ai/posts/2026-06-30-recursive-corruption-of-ai-control-systems/ Mon, 29 Jun 2026 08:00:00 GMT Classic security tools hunt for dangerous words: 'hack', 'bomb', 'urgent'. But you don't subvert an AI agent with suspicious vocabulary — you subvert it with the ordinary language of the business: a role, a process, a plausible emergency. And when the agent that monitors, the SIEM that correlates and the auditor that checks are themselves AI agents, the attacker no longer has to defeat a system: it corrupts them in a chain. This article explains that recursive-corruption mechanism and what a decision-maker must demand to break it. agentic-security autonomous-agents prompt-injection siem social-engineering zero-trust decision-makers https://www.alephbeth.ai/posts/2026-06-21-free-tier-weak-link-data-poisoning/ https://www.alephbeth.ai/posts/2026-06-21-free-tier-weak-link-data-poisoning/ Sun, 21 Jun 2026 08:00:00 GMT Commercial assistants — Claude, ChatGPT, Gemini, Le Chat — keep learning from free-tier feedback: ratings, regenerations, and the conversations themselves. That loop is an injection channel. A two-phase threat model: build a policy-compliant backdoor on a rare topic, then exploit it for jailbreak — and why scale makes the first phase almost impossible to catch. data-poisoning backdoor rlhf continuous-training supply-chain llm-security https://www.alephbeth.ai/posts/2026-06-22-conditional-dpo-backdoor-agentic-chain/ https://www.alephbeth.ai/posts/2026-06-22-conditional-dpo-backdoor-agentic-chain/ Sun, 21 Jun 2026 08:00:00 GMT A deeper companion to the free-tier feedback explainer. DPO moves safety from the behavior level to the level of a conditional distribution; an agent then turns a poisoned conditional into a chain of actions. The result is a backdoor built from individually ordinary behaviors, invisible to standard evaluations, whose danger only emerges when the actions compose. data-poisoning backdoor dpo rlhf agent llm-security https://www.alephbeth.ai/posts/2026-06-18-agentic-siem-attack-surface/ https://www.alephbeth.ai/posts/2026-06-18-agentic-siem-attack-surface/ Thu, 18 Jun 2026 08:00:00 GMT SOCs are evolving toward agentic architectures where multiple AIs handle triage, investigation, correlation, and response. The decision system itself becomes the target. We argue for capability monotonicity (Lock-Monotone/TGMC) as an architectural invariant that contains a compromised reasoning layer. ai cybersecurity siem agentic-ai llm poisoning model-security lock-monotone tgmc https://www.alephbeth.ai/posts/2026-06-12-ai-war-on-our-networks-why-attack-outpaces-defense/ https://www.alephbeth.ai/posts/2026-06-12-ai-war-on-our-networks-why-attack-outpaces-defense/ Fri, 12 Jun 2026 08:00:00 GMT Strategic essay. Cyber conflict is now machine-versus-machine, at a tempo that excludes the human operator. Attack holds the advantage — by architecture, not by accident: defending one LLM with another reproduces the very flaw. The way out is to move the decision out of the model, into a deterministic layer. llm-security ai-warfare red-team blue-team lock-monotone jailbreak prompt-injection https://www.alephbeth.ai/posts/2026-06-12-how-llms-work-lstm-to-transformer/ https://www.alephbeth.ai/posts/2026-06-12-how-llms-work-lstm-to-transformer/ Fri, 12 Jun 2026 08:00:00 GMT Three interactive diagrams to see, step by step, how a sentence flows through a recurrent network (LSTM), a convolutional network (CNN), and finally a Transformer — the architecture every modern LLM is built on. Plus why the mechanics matter for security. llm transformer lstm cnn attention fundamentals https://www.alephbeth.ai/posts/2026-06-10-agentic-soc-attacks-on-defensive-ai/ https://www.alephbeth.ai/posts/2026-06-10-agentic-soc-attacks-on-defensive-ai/ Wed, 10 Jun 2026 08:00:00 GMT Two linked shifts: the SOC moves from a human craft model to an automated agentic one — and those same defensive agents become a new attack surface. The defense you deploy is also the breach you open. soc agentic-ai secops defensive-agent owasp-asi prompt-injection mttr https://www.alephbeth.ai/posts/2026-04-27-claude-desktop-simple-hardening/ https://www.alephbeth.ai/posts/2026-04-27-claude-desktop-simple-hardening/ Mon, 27 Apr 2026 08:00:00 GMT Targeted attack-surface reduction for Claude Desktop. Simple principle: it's a chat assistant, not a system agent. The list of NOs, the list of OKs, and a 30-minute checklist. mcp claude-desktop hardening attack-surface hygiene