Back to home

SYS.THREAT // AGE-OF-AI

Guardrails for Machines That Write Machines

AI is a threat multiplier before it's a productivity multiplier. The same agent that writes 70% of the code can leak a secret, act on stale trust, or ship a plausible vulnerability faster than any human can review it. Securing that world isn't a matter of knowing AI or knowing security alone — it's the discipline to assume breach and verify everything.

ZERO TRUST // DEFENSE IN DEPTH
The Two Convictions
[principle]

Zero Trust

Never trust, always verify.

No agent, service, or generated line of code is trusted by default. Every identity is scoped, every request is authenticated, every action is logged. Trust is not a location on the network or a name in a config — it is earned per request and revoked the moment it stops being verifiable. In a world where autonomous agents hold real credentials, this is the only posture that survives contact with reality.

[principle]

Layers Responsible for Their Own Security

Structure the system so misbehavior is impossible, not merely detected.

When each tier is built to enforce its own security — the database applying row-level access no matter what the caller claims, the boundary refusing anything unauthenticated, a layered schema (api_v1 → private_logic → data) where no layer reaches past its mandate — agents are structurally forced to follow the rules. You don't hope the agent behaves; the architecture won't let it misbehave. Guardrails stop being a policy you enforce and become a property of the system.

The New Attack Surface

Every convenience an autonomous agent adds is a trust boundary it widens. Five places the ground shifts when the machines start writing the machines — each an old threat wearing a new face.

01
was: Over-privileged service accounts

Agents with keys

The Risk

An autonomous agent now holds real credentials and acts in production on its own initiative. A single confused or hijacked step can reach everything the key can reach.

The Defense

Least privilege by default. Short-lived, narrowly scoped tokens. Blast radius contained by design — ephemeral workers, sealed outputs, no standing access.

02
was: SQL injection

Prompt injection

The Risk

The model treats retrieved documents, tool output, and user text as instructions. Untrusted input becomes untrusted control flow — the new injection class, aimed at the reasoning layer.

The Defense

Treat every token the model reads as untrusted. Separate data from instructions, constrain tool permissions, and validate output before it is allowed to act.

03
was: Copy-paste bugs from the internet

AI-generated vulnerabilities at scale

The Risk

Agents are prolific producers of plausible, confident, insecure code — shipped faster than any human can read it. Volume, not malice, is the threat.

The Defense

The reviewer whose standards the agent cannot skip. Automated quality gates, pre-commit hooks, and a hard rule: no silent failures, no swallowed exceptions, nothing merged unverified.

04
was: Dependency confusion, hardcoded keys

Supply chain & secret leakage

The Risk

Agents pull dependencies, read environments, and can spill secrets into logs, prompts, and traces — quietly widening the trust boundary with every convenience.

The Defense

Provenance and pinned dependencies. No secrets in the client. Secret scanning in the pipeline. Configuration from the environment, never the codebase.

05
was: Unlogged admin actions

Erosion of auditability

The Risk

When machines act autonomously with no trail, there is no accountability — no way to answer what happened, who authorized it, or whether the degradation is still spreading.

The Defense

Assume breach; verify everything. Every action authenticated and logged, every failure made visible to the caller. A system you cannot audit is a system you cannot trust.

Why This Intersection Is Rare

Most voices on AI security are security people learning AI, or AI people who have never held a clearance. This sits on a rarer intersection: fifteen-plus years building software inside defense logistics (USTRANSCOM, Scott AFB, JALIS classified missions) where security was the mission — crossed with hands-on agent architecture, where I granted the credentials and know exactly what each agent can touch, and the governance discipline to put guardrails on the whole thing.

The Bottom Line

The machines write the machines now. The work that matters is making sure they can only ever write inside the lines — enforced by the architecture, verified on every request, trusted by nothing.

See what the code proves