Case 03
Security across an agent fleet
What changed Each layer is closed by default, and every fix is proven by replaying its attack.
The agents I worked on read text from strangers, act with people’s own accounts and run code. So every layer has to say no by default, and every fix is proven by attacking it.
attackA member of one team reads another team’s data
- My role
- Found and closed security gaps across the agent fleet, each fix shipped with a test that replays the attack.
- Scope
- Every layer: edge, identity, tenant isolation, what the model reads, the sandbox, and dependencies.
- Stack
- Go · TypeScript · signed webhooks · govulncheck · container sandboxing
- Shipped
- A CSRF logout fix, webhook signature checks, secrets that fail closed, role-based tenant checks, and reachable vulnerabilities patched across services.
Attacks stopped
Replay the attack. Watch it fail.
Each row is an attack I closed. Pick one to replay it: the attack, what happened before, and what happens now.
The sweep
Find it, fix it, prove it’s gone.
Dependency alerts pile up fast, and most can’t touch the code. I scanned for the vulnerabilities the code actually calls and upgraded those first. Then I re-scanned to prove they were gone, across several services.
Lessons
- 01
Fail closed
If a secret, a role or a grant is missing, the answer is no.
- 02
Never trust what the model reads
Tool results and messages are data, never instructions.
- 03
Attack it in a test
Every fix ships with a test that tries the attack and fails.
- 04
Fix what’s reachable
Chase the vulnerabilities the code can actually reach, not the noise.