AI agent cybersecurity
OWASP ASI Top 10, translated into controls that exist.
The real problem
An agent that executes code, reads files and remembers is an attack surface, not a demo. The three vectors that matter in practice:
- Indirect injection — content the agent reads contains instructions
- Memory poisoning — a note stored yesterday becomes an instruction today
- Supply chain — the vulnerability is not in your code
The OWASP ASI Top 10 names them. The difficulty is not reading it, it is translating it into testable controls.
How I solve it
On my own ecosystem, every entry maps to a control you can test:
- ASI05 — execution in a jail. Network cut, writes confined, secret reads denied. A probe tests the jail before each run: leaky jail, red build.
- ASI06 — un-poisonable memory. The memory → prompt path is sanitized end to end, speech synthesis included.
- ASI02 — locked paths. Symlink-resistant resolution bounded to declared roots; model names filtered by allowlist.
- ASI03 — machine identities. 17 services catalogued, all loopback-bound, a single external credential across the whole ecosystem — reducible to read-only by a flag.
A trap learned in the field
The costliest hole was not in the agent code, it was in the dependencies. First audit pass across four production environments: 122 known vulnerabilities.
The real root cause was not the one I was looking for: a command-line tool installed inside a service's virtual environment, pinning stale versions of libraries the service also used. The tool had no business being there. Nobody would have found it by reading application code.
Cleared to 0. Three CVEs with no upstream fix are tracked by name and reviewed monthly — an unnamed exception is a forgotten exception.
What it delivers, measured
- 122 → 0 CVEs across four environments
- A nightly audit section goes red the moment one reappears
- Pre-commit installed across 5 repositories
- Firewall in stealth mode, disk encryption, every service bound to 127.0.0.1
- AI Act watch: chatbot transparency on 2 August 2026, AI-content labelling on 2 December 2026
Where it runs in production
- KlodyAI — Coding agent · ReAct
- Klody Core — Control plane
- Assistant proactif — Observe → propose loop
Your data cannot leave the building?
That is precisely the problem I solve. A 30-minute call is enough to scope an audit.