Blog
Writeups, findings, notes.
Protocol-level findings, ABFP baselines, OWASP Agentic walkthroughs, and lab notes from the work in progress.
-
Signed, Not Safe: A2A v1.0 signed Agent Cards don't close prompt injection
A2A v1.0 shipped cryptographically signed Agent Cards. Signing kills card spoofing and in-transit tampering — but a legitimately signed card with adversarial fields is still a working prompt-injection vector at the selection layer. Content trust is a separate gate.
-
The Layer Nobody Baselines: Behavioral Runtime Detection for the MCP Agent Bus
Static scanners and policy gateways both fix the wrong layer of MCP security. They miss sequence-level abuse where authorized tool-calls chain into an exfil pipeline. This is the runtime behavioral-fingerprinting gap — and how mas-sentry-toolkit's ABFP engine fills it with statistical baselines instead of predefined rules.
-
Hunting MCP Tool Poisoning: How CyberAI Catches the Attack Agents Never See
Tool poisoning hides malicious instructions in MCP tool metadata that agents read and humans never do. How the attack works, why it differs from prompt injection, and how CyberAI's MCP scanner flags it offensively.
-
ABFP in one baseline: D1–D6 on a live agent
Walking the six behavioural dimensions ABFP samples to profile an agent — what each one captures, why you baseline a role and not a model, and what a real deviation looks like.
-
Agent-in-the-Middle: what's wrong with unsigned A2A agent cards
A2A discovery trusts a JSON file at a well-known URL. Without a verified signature, that file is a routing primitive an attacker controls — and the fix most teams ship is still broken.
-
Why the coordination layer is the real attack surface
Single-agent safety doesn't compose. A note on why the boundary moved from the model to the protocol traffic between agents — mapped to the OWASP Agentic Top 10.