Notes on agent security

Findings, measurements and design notes from building ASIScan. RSS.

• ASI05: when your agent builds a shell command out of model output

  A real exec() call built from model output, why input validation misses it, the fix, and how ASIScan's rules catch it.

  2026-09-29

• The OWASP Top 10 for Agentic Applications, explained for engineers

  The OWASP Top 10 for Agentic Applications, walked category by category: what each one looks like in code and what static analysis can and can't see.

  2026-09-22

• ASI09: the approval dialog your agent wrote for itself

  If a model composes the text of your confirmation prompt, the human is approving a description, not an action. How that gap opens and how to close it.

  2026-08-14