Featured / AI Agent Security
How to Read the Scope of an AI Agent Security Assessment
A client review method for connecting an AI agent assessment to the permissions and release decision it actually covers.
Read the articleInsights
Security research and engineering notes.
Technical guides on AI security, cybersecurity and lab workflows, with examples you can examine and checks you can adapt.
Written by Kevin O'Connor, Founder and Principal Engineer at TKOResearch.
Start with your system
Choose the problem you’re working on.
Deploying an AI agent
Define what the agent may access and test the operations that must be refused before rollout.
MCP and tool permissions
Trace a tool call from the user to its credential, permissions and downstream result.
RAG and company documents
Check which documents reach the model, where access is enforced and what happens after revocation.
The library
All articles
Showing 40 of 40 posts.
AI Agent Security6 min read
How to Read the Scope of an AI Agent Security Assessment
A client review method for connecting an AI agent assessment to the permissions and release decision it actually covers.
Last reviewed October 18, 2026Read article
RAG Security6 min read
Reviewing Persistent Memory Before an AI Agent Pilot
A practical review package for agent memory write authority, provenance, tenant isolation, deletion and pilot release decisions.
Last reviewed October 18, 2026Read article
Agentic AI6 min read
What an AI Agent Audit Trail Needs to Record
An action-centered audit trail for agent proposals, approval, dispatch, downstream effects, denials and missing telemetry.
Last reviewed October 18, 2026Read article
AI Agent Security6 min read
Designing Acceptance Tests for AI Agent Security Controls
A worked acceptance plan for agent access controls, with meaningful deny cases, failure behavior and explicit release decisions.
Last reviewed October 18, 2026Read article
Laboratory Security6 min read
Reviewing AI Assistants Connected to Lab and Industrial Systems
How to review laboratory AI assistants, including source records, proposed changes, operator authority and physical system effects.
Last reviewed October 18, 2026Read article
MSP Security6 min read
Scoping an MSP Identity Security Review Across Customer Tenants
Define customer authorization, delegated roles, identity coverage, log handling and acceptance criteria for a scoped MSP security review.
Last reviewed October 18, 2026Read article
Security Diligence14 min read
How to Evaluate AI Agents for Enterprise Use
A practical enterprise framework for deciding whether an AI agent should proceed, enter a limited pilot, or remain out of production.
Last reviewed October 18, 2026Read article
MCP Security18 min read
How to Give AI Agents Access to Tools Securely
How enterprise teams can let AI agents use real tools without letting the model authorize, approve, or execute high-impact actions unchecked.
Last reviewed October 18, 2026Read article
AI Agent Security7 min read
Reviewing Security Tool Overlap Without Losing Controls
How to review overlapping controls around a support agent, map owners and coverage, and prepare a tested rollback before retiring a tool.
Last reviewed October 18, 2026Read article
Security Training7 min read
Preparing for an AI Agent Security Workshop
A practical preparation guide with a bounded agenda, synthetic permissions and retrieval exercises, participant roles, and useful workshop outputs.
Last reviewed October 18, 2026Read article
Agent-Readable Web11 min read
Agent-Readable Web Files and Protocols: A Field Guide
A practical decision guide to 17 web discovery, access, authentication, tool, and commerce mechanisms for AI agents.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
HTTP Link Headers for AI Agents and Machine Clients
How to publish typed HTTP links for real machine resources without turning performance hints into false service discovery.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
DNS-AID Agent Discovery with SVCB and DNSSEC
What the DNS-AID draft proposes, how SVCB and DNSSEC support discovery, and what to verify before publishing an agent endpoint.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
Markdown Content Negotiation for AI Agents
How Cloudflare Markdown for Agents handles Accept, Vary, origin policy headers, conversion limits, and rollback.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
robots.txt Rules for AI Crawlers
How RFC 9309 group matching affects AI crawler policy, protected paths, operator tokens, and post-access content-use declarations.
Last reviewed October 18, 2026Read article
Agent-Readable Web7 min read
Web Bot Auth and HTTP Message Signatures
What Web Bot Auth asks bot operators to publish and sign, how verification works, and which controls receiving sites still need.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
Content Signals for AI Training, Search, and AI Input
How Content Signals declares ai-train, search, and ai-input preferences, and why origin policy should remain authoritative.
Last reviewed October 18, 2026Read article
Agent-Readable Web5 min read
API Catalog Discovery with RFC 9727 and Linkset JSON
How RFC 9727 discovers maintained public APIs through a well-known URI, Linkset JSON, typed relations, and explicit ownership.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
OAuth and OpenID Connect Discovery for AI Agents
How agents distinguish OAuth authorization-server metadata from OpenID Provider configuration and reject invented issuers or endpoints.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
OAuth Protected Resource Metadata with RFC 9728
How RFC 9728 binds a protected resource to authorization servers, scopes, token methods, and OAuth discovery used by MCP clients.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
auth.md and Agent Registration over OAuth
A technical review of WorkOS's open auth.md proposal, its OAuth building blocks, and why structured metadata must remain authoritative.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
MCP Server Cards and Draft Service Discovery
What current draft SEP-2127 proposes for MCP Server Cards, catalog discovery, runtime checks, and stale metadata risk.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
Agent Skills Discovery Indexes and Package Trust
How Cloudflare's Agent Skills v0.2.0 proposal discovers skill packages, verifies SHA-256 digests, and preserves package trust boundaries.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
WebMCP Browser Tools for AI Agents
How current WebMCP draft APIs register browser tools, use Permissions Policy, preserve human oversight, and replace obsolete context calls.
Last reviewed October 18, 2026Read article
Agent-Readable Web5 min read
x402 HTTP Payments for AI Agents
How x402 uses HTTP 402 and signed payment headers, what facilitators do, and why a site needs a priced machine resource before adoption.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
Machine Payments Protocol and HTTP Authentication
How MPP uses the Payment HTTP authentication scheme, OpenAPI pricing metadata, charge and session intents, and server fulfillment controls.
Last reviewed October 18, 2026Read article
Agent-Readable Web6 min read
Universal Commerce Protocol for Agent Checkout
How UCP business profiles describe services, capabilities, payment handlers, transport bindings, signed requests, and merchant responsibility.
Last reviewed October 18, 2026Read article
Agent-Readable Web7 min read
Agentic Commerce Protocol Checkout
How ACP connects product feeds, merchant checkout state, delegated payment tokens, idempotency, and order fulfillment without displacing the seller.
Last reviewed October 18, 2026Read article
Agentic AI3 min read
AI Agents Are Becoming Part of the Production Control Plane
Agents that can change deployment state, repository permissions or production configuration need the controls applied to privileged automation.
Last reviewed October 18, 2026Read article
AI Agent Security6 min read
AI Agent Security Assessment: What to Review Before Production
A pre-launch review list for AI agents that touch production APIs, customer data, tools, memory, or RAG context.
Last reviewed October 18, 2026Read article
MCP Security9 min read
MCP Security Review Checklist: How to Assess Tool-Connected LLM Systems
A security checklist for MCP servers, clients, OAuth flows, tokens, tools, permissions, trust boundaries, logging, and blast radius.
Last reviewed October 18, 2026Read article
AI Agent Security6 min read
What Is AI Agent Blast Radius?
AI agent blast radius is the maximum plausible damage an agent can cause if manipulated, misconfigured, over-permissioned, or exposed to hostile context.
Last reviewed October 18, 2026Read article
RAG Security10 min read
RAG Security Assessment: Tenant Isolation, Data Leakage, and Prompt Injection Risks
How to review RAG systems for authorization failures, tenant-isolation gaps, prompt injection, vector-store leakage, document poisoning, and audit logging.
Last reviewed October 18, 2026Read article
Security Diligence5 min read
AI Red Team vs. LLM Pentest vs. AI Security Assessment: What's the Difference?
How founders, CTOs, CISOs, and product-security teams can choose between an AI red team, LLM pentest, AI security assessment, or production readiness review.
Last reviewed October 18, 2026Read article
Security Diligence6 min read
Preparing AI Agents for Enterprise Security Review
How engineering and product teams can prepare AI agents for enterprise security review, production launch, customer diligence, and governance scrutiny.
Last reviewed October 18, 2026Read article
MCP Security8 min read
MCP Threat Model: Clients, Servers, Tools, Tokens, and Trust Boundaries
An MCP threat model for teams connecting LLMs and AI agents to tools, OAuth tokens, APIs, local servers, SaaS systems, and production workflows.
Last reviewed October 18, 2026Read article
Prompt Injection5 min read
Indirect Prompt Injection Through Documents, Emails, Webpages, and Tool Output
How indirect prompt injection reaches AI agents through RAG systems, copilots, MCP tools, webpages, emails, PDFs, memory, and tool outputs.
Last reviewed October 18, 2026Read article
AI Agent Security6 min read
AI Agent Tool Permissions: Read, Write, Delete, Send, Execute, Deploy
A framework for classifying AI agent tool permissions by business impact, authorization boundary, required controls, and production readiness.
Last reviewed October 18, 2026Read article
RAG Security5 min read
RAG Authorization Anti-Patterns: When Vector Search Bypasses Access Control
Common RAG authorization failures, tenant-isolation gaps, vector-store access-control mistakes, source attribution issues, and safer retrieval design.
Last reviewed October 18, 2026Read article
Post-Incident Engineering7 min read
Post-Incident Engineering: Technical Assessment for Legal and Executive Review
How engineering assessment helps legal, insurance, and executive teams understand a system failure and assess repair, replacement, containment, or continued operation.
Last reviewed October 18, 2026Read article
Methods and examples
What an assessment report should show.
Read how we scope and conduct a review, then use the sample report to see how observations, findings and next steps are presented.
If an article raises a question about your system, tell us what you need reviewed.
Working guides and tools
Field Notes
Get Field Notes by email
Request occasional technical notes by email. Add a topic if you have a particular interest. You can request removal from the list at any time by emailing contact@tkoresearch.com.
Signup is optional. All articles and public resources remain available here.