Engineering the defense of Agentic AI, Large Language Models, and Cloud Native Infrastructure. Technical deep-dives by Security Architect Subhash Dasyam.
What looks like a simple Ethernet cable is one of the most interesting parts of a two-node GB10 setup. A single QSFP112 cable can provide a dedicated 200 Gbit/s path for distributed inference, model training, MPI, and NCCL traffic. There is one surprise: Linux exposes the connected physical port as two network interfaces. A normal one-interface configuration leaves half of the host path unused.…
Can You Trick an AI Into Giving You Free Money? Introducing DVAIB - The World's Most Vulnerable AI Bank What if there was a bank where the AI assistant was... a little too helpful? A bank where smooth talking might just convince the AI to deposit a million dollars into your account? Welcome to DVAIB - the Damn Vulnerable AI Bank. What Is This Madness? DVAIB is a playground for the curious. It's a…
Quick answer The technique is Crescendo . It begins with individually benign questions, uses the model's earlier replies as context, and gradually plants and escalates concepts toward a harmful objective without asking for the final outcome immediately. That accumulating trajectory is why a filter that scores only the latest prompt can miss the risk. The final USENIX Security 2025 paper provides…
What Changed in 2026 Short answer: Shared KV caches can expose prompt information when cache reuse crosses trust boundaries or unsafe distributed components are reachable. Separate cache reuse by trust group, use an unpredictable per-request cache salt where supported, patch each enabled component according to its advisory, and monitor cache infrastructure as sensitive state. Peer-reviewed…
2026 implementation note Kubernetes ValidatingAdmissionPolicy has been stable since Kubernetes v1.30 and is useful for CEL checks on admission objects, including labels, security contexts, resource limits, and approved annotations. Signature and attestation verification still needs a supply-chain-aware admission component such as Kyverno verifyImages or Sigstore policy-controller . Kyverno can…
Part 10. Implementation Roadmap 10.0 Why you need a roadmap, not a random pile of bots You now have: Agent patterns Multi agent topologies HITL designs Threats and controls Identity, architecture, governance Great. Now the obvious question: "So where do we start, and how far do we go?" This part answers that in practical steps: A maturity model so you know what level you are at Phases that say…
Part 9. Governance Framework 9.0 Why you need actual governance, not “vibes” At small scale, you can ship an agent, watch it in Prod, and fix things as they break. At enterprise scale, that same approach turns into: Nobody knows how many agents exist Nobody remembers which ones are safe to touch money Nobody can prove to auditors how those powers were approved No one wants to turn anything off,…
8. Enterprise Integration 8.0 Why this part matters Up to now we treated agents like a new thing. Your CISO, CIO, and Head of Architecture do not care about "new things". They care about one question: "How does this fit into the stuff we already use to control risk?" If agents live in a separate security bubble, you will end up with: Parallel IAM rules Parallel network rules Parallel logging…
7. Secure Architecture Patterns 7.0 Why architecture beats clever prompts Here is the uncomfortable truth: If your main security control is "We wrote a really strong system prompt", you will lose. Not today. Maybe not this quarter. But as soon as someone finds a weird edge case or the model behaves differently after an update, your "carefully crafted" prompt will help exactly as much as a sticky…
6. Identity and Access Control for Agents 6.0 Why identity is the real security boundary For classic apps, you already know the game: User authenticates. App runs with app identity. App hits databases and services with that identity. With agentic AI, people accidentally add a third blurry thing: "The agent" with unclear identity and unclear permissions. If you do not fix that, you get: Agents that…
5. Threat Landscape for Agentic Systems 5.0 Why this part matters With normal LLM apps, a bad output is embarrassing. With agentic systems, a bad output can: Send money to the wrong place Drop a server Email all your customers Leak sensitive data out through some "helpful" API Same model, very different stakes. This part turns the big scary phrases - prompt injection, tool abuse, data…
4. Human in the Loop (HITL) Design Patterns 4.0 Why HITL is where grown-up safety lives Autonomous agents feel magical right up to the moment they: Move real money Change real infrastructure Touch real patient data Email real customers At that point, you are not shipping "AI features". You are shipping delegated decision-making. HITL is how you: Stop one bad decision from becoming a headline.…
3. Multi-Agent Architectures 3.0 Why multi-agent is fun for you and scary for security Single agent: one brain, one loop, one blast radius. Multi-agent: several brains, messages bouncing around, tools firing in different places, sometimes all at once. Vendors sell you this as "teams of AI workers". Security hears: More identities More trust boundaries More ways for something dumb or malicious to…
2. Agent Architecture Patterns - Security Analysis 2.0 Why patterns matter more than buzzwords Most "agent stacks" are just variations on a few core patterns: ReAct Plan-and-Execute Reflexion / self-correction Tool use and function calling MRKL routing Tree-of-Thoughts style branching Vendors make them sound mystical. Under the hood, they are just different ways to structure the same loop: "think,…
1. Agentic AI Fundamentals 1.1 Why this matters Normal LLM apps give you words on a screen. Agentic systems give you actions in your systems. The moment you let a model: Call tools Update data Trigger workflows Talk to other agents You have moved from "content risk" to "operational risk". This article gives you the mental model to reason about that risk. By the end, you should be able to look at…
The Privacy Problem in Modern AI Systems Imagine building a RAG (Retrieval-Augmented Generation) system for a healthcare provider. You ingest thousands of patient documents, generate embeddings , and store them in a vector database . Your system works beautifully until you realize those embeddings are a security nightmare waiting to happen. Recent research has shown that vector embeddings aren't…
How AI embeddings have the same vulnerability as password hashes from the 1990 Important distinction: Embeddings are not cryptographic hashes, and embedding inversion attacks are not the same as password cracking. The practical risks are approximate reconstruction, similarity probing, membership inference, and matching stolen vectors against known candidate text. The hash analogy below is a simple…
1. Executive Summary 1.1 Document Purpose This guide provides enterprise security teams with comprehensive strategies for deploying and securing Claude Code in macOS environments. Unlike consumer deployments, enterprise installations require defense-in-depth approaches that leverage macOS-specific security features including System Integrity Protection (SIP), Gatekeeper, Configuration Profiles,…
A Complete Guide to Enterprise-Grade Security Controls, Managed Policies, and Zero-Trust Architecture for Claude Code on Windows Executive Summary As enterprises increasingly adopt AI-powered development tools like Claude Code, the security implications of granting AI assistants access to codebases, credentials, and corporate infrastructure have become critical concerns. This guide provides a…
Model Context Protocol can give an AI host access to files, databases, ticketing systems, cloud APIs, and production operations. That flexibility also turns tool execution into a security boundary. A model may propose an action, but it must never be the component that authorizes its own action. A production MCP design therefore needs more than a gateway in front of a collection of servers. It…
The AI Precision Dilemma: A Master Chef Analogy Simple answer: FP32, FP16, BF16, FP8, INT8, and INT4 are different ways to store numbers in AI models. Moving to fewer bits can reduce memory and increase throughput, but only testing can show whether quality remains acceptable for a specific model and workload. Every Executive's Nightmare Picture this: You're running the world's most exclusive…
Building on our transformer story - if you haven't read the complete transformer guide yet, check it out first! This guide explains Mixture of Experts in simple terms: a router sends each token to a small set of specialist networks, so the model can have more total capacity without activating every expert for every token. We will also cover expert routing, active parameters, and load balancing.…
Ever wondered how ChatGPT, Claude, or GPT-4 actually understand and generate text? Let me break down the magic behind transformers like you're 12 years old! 👇 Note: When I mention "117 million parameters" in examples, I'm talking about GPT-1 and BERT-base models. Modern models like GPT-4 are much, much bigger! Part 1: Breaking Down Words Into Recipe Ingredients 🍳 You might think : "Why can't AI…
Injecting sensitive secrets like API keys, credentials, and tokens into running containers presents significant security challenges that go far beyond the basic Kubernetes Secret mechanisms. While standard approaches like environment variables and mounted files work functionally, they often expose secrets too broadly, making them visible to any process in the container or even to operators who…
Paper Review and Attribution This article is based on the fascinating research paper "RAG+: Enhancing Retrieval-Augmented Generation with Application-Aware Reasoning" by Yu Wang, Shiwan Zhao, Ming Fan, and colleagues from Huawei Technologies, Xi'an Jiaotong University, and Nankai University. Original Paper : RAG+: Enhancing Retrieval-Augmented Generation with Application-Aware Reasoning I found…