14 posts · technical papers and news
What an AI security incident actually costs
The 2026 numbers are in, and they are board-level. The average data breach now costs $4.99M globally and $11.5M in the US — and when AI is involved, add about $1M more. Here is what drives the cost, in plain terms, and where the money is actually saved.
Intertrace — Guide
The next agent breach won't be a prompt — it'll be a permission
Non-human identities now outnumber humans by as much as 144 to 1, and most sit outside the governance perimeter entirely. As AI agents get their own credentials and act on behalf of many users, the industry is converging on intent-based authorization: not who is the identity, but is this agent, acting for this user, allowed to do this specific thing right now?
Intertrace Threat Research — Threat intelligence
When agents talk to agents: the A2A blast radius
Google's Agent-to-Agent protocol, backed by 50+ partners, lets independent agents discover and delegate to each other — and delegates credential and card verification entirely to implementers. Researchers have already catalogued impersonation, unauthorized registration, recursive denial-of-service, and malicious-artifact attacks. Multi-agent systems multiply autonomy; they multiply the attack surface with it.
Intertrace Threat Research — Threat intelligence
Shadow AI: your team is already using it
Nearly every organization now has employees using AI tools nobody approved — and about one in three has pasted confidential data into a public chatbot. Shadow AI isn't a future risk; it's the single fastest-growing source of AI data loss. A plain-language guide to seeing it and getting it under control.
Intertrace — Guide
EchoLeak: the first zero-click AI exploit, and what it changes
CVE-2025-32711 turned a crafted email into silent data theft from Microsoft 365 Copilot — no click, no attachment, no user action. It is the clearest proof yet that an LLM assistant with read access to your data is an exfiltration path. Here is the mechanism, and where a runtime gateway breaks the chain.
Intertrace Threat Research — Threat intelligence
A board-level guide to AI agent risk
AI agents are being deployed faster than anyone can govern them. 81% of security leaders say they fear agents they can't fully see, fewer than half can identify every agent they run, and boards and CISOs rarely agree on the risk. A plain-language briefing for the people accountable for it.
Intertrace — Guide
Enforcing trust boundaries in a single token stream
A language model reads its system prompt, the user's query, and everything an agent retrieves as one undifferentiated sequence of tokens. There is no privilege separation inside that sequence. This paper argues the boundary must be reconstructed around the model — with provenance on the way in and egress control on the way out — and specifies the runtime checkpoints that do it.
Samuel Oyan — Engineer
Buying AI security: 10 questions that separate real from theater
The AI security market filled up overnight, and a lot of it is a dashboard over a wish. If you're evaluating a tool to secure your AI, here are ten plain questions — no jargon — whose answers tell you whether it actually protects anything.
Intertrace — Guide
The MCP supply chain became an attack surface faster than anyone secured it
A critical RCE in MCP infrastructure, a config-swap exploit against Cursor, and a backdoored gateway package downloaded 47,000 times in three hours. The Model Context Protocol connected agents to everything — including the attacker. A field guide to the incidents, and how to mediate MCP instead of trusting it.
Intertrace Threat Research — Threat intelligence
Egress inspection for LLM systems: stopping data on the way out
Almost every LLM security control watches what goes into the model. EchoLeak proved the expensive gap is what comes out: sensitive context encoded into a URL, an image reference, or markdown the client will resolve. This paper specifies egress inspection as a first-class checkpoint — what to look for, why it is the hardest link for an attacker to avoid, and how to run it without wrecking latency.
Samuel Oyan — Engineer
Identity-bound execution permits for autonomous agents
An autonomous agent that holds standing privilege is a standing liability: one injection, one logic error, and it acts with everything it was ever granted. This paper specifies an alternative — zero standing privilege plus per-action, identity-bound execution permits — and shows how the same primitive answers both 'can this action run' and 'is this agent allowed to act for this user right now.'
Samuel Oyan — Engineer
Indirect prompt injection has gone operational
OWASP still ranks prompt injection as the #1 LLM risk, and its own researchers now say it is unsolved. Meanwhile findings landed against Slack AI, Microsoft 365 Copilot, Cursor, and GitHub MCP, and a 2026 survey reported 88% of organizations hit a confirmed or suspected AI-agent incident. The proof-of-concept era is over.
Intertrace Threat Research — Threat intelligence
Mediating MCP: tool-description integrity and approval-view fidelity
The Model Context Protocol turns tool descriptions, tool results, and configuration into inputs an agent trusts implicitly — and 2026's CVEs proved each one is attacker-reachable. This paper specifies a mediation layer for MCP: inspect metadata before use, close the approval-view fidelity gap, pin against silent swaps, and authorize the call that actually executes.
Samuel Oyan — Engineer
August 2, 2026: agent governance stopped being optional
The EU AI Act's enforcement powers for general-purpose AI took effect on August 2, 2026, and NIST opened a dedicated AI agent standards initiative in February. Both point at the same requirement: controls that reach runtime, logs that survive review, and an inventory that includes your agents. Here is what changes and how to be ready.
Intertrace Threat Research — Threat intelligence
Need something else?
Email support@intertrace.ai with topic requests, or try the Simulation Lab and the documentation hub.