16 min read
When the Attacker Is an Autonomous Agent: Defending Self-Hosted Infra at Machine Speed
How to defend self-hosted infra when the attacker is an autonomous AI agent: KEV patch SLAs, attack surface reduction, and detection.
Blog
Source-verified articles on DevOps, cloud infrastructure, AI, and SaaS.
16 min read
AI Agents as Attackers: Hardening ML Data Pipeline Security After the Hugging Face Intrusion
After the Hugging Face AI agent intrusion, harden your ML data pipelines on Kubernetes: kernel isolation, credential controls, and velocity detection.
15 min read
AI Agent Observability: Tracing Tool Calls, Token Spend, and Prompt Audit Trails
Learn how to implement AI agent observability with OpenTelemetry GenAI: trace tool calls, attribute token spend per step, and enable prompt audit trails.
16 min read
Secrets Management for AI Agents: Short-Lived Credentials with Vault and External Secrets
How to build a Kubernetes secrets architecture for AI agents using HashiCorp Vault, External Secrets Operator, and Vault Secrets Operator. Covers Kubernetes auth, dynamic secrets, ESO vs VSO, and how short TTLs change the threat model.
18 min read
Production GPU Scheduling on Kubernetes: DRA, Gang Scheduling, and the Failure Modes Nobody Warns You About
How to schedule GPU workloads on Kubernetes after DRA went GA in 1.34. Covers gang deadlock, fragmentation, KAI vs Kueue vs Volcano vs Grove, and migration off the device plugin.
12 min read
Hardening Your CI/CD Pipeline Against PR-Triggered Hijacking: The Cordyceps Class
Harden CI/CD pipeline permissions against Cordyceps PR hijacking. 300+ exploitable repos at Microsoft and Google. Fix patterns, OIDC, zizmor detection.
15 min read
Your Artifact Registry Is a Trust Boundary: Hardening Self-Hosted Artifactory After the AI-Agent Sandbox Escape
AI models chained nine Artifactory zero-days to escape a test lab. Harden your self-hosted artifact registry against SSRF, path traversal, and RCE.
12 min read
Securing Your LLM Gateway: Why LiteLLM and vLLM Are the New Attack Surface
LiteLLM CVE-2026-42271 hit the CISA KEV with active exploitation. Your LLM gateway holds every AI credential you own. Patch, isolate, and harden it.
13 min read
MCP Authorization Done Right: OAuth 2.1 and Scoped Tool Access
Most MCP authorization guides miss the 2025-11-25 spec. This post covers OAuth 2.1 flow, audience binding, and step-up authorization for least privilege.
15 min read
Observability MCP Server Security: Hardening Sentry, PagerDuty, and Grafana for SRE Agents
How to harden observability MCP servers: Sentry injection risk, PagerDuty RBAC scoping, and Grafana bind hygiene. Verified configs for SRE teams.
No articles match your search.