PipeLab Blog

AI Agent Security Blog: Research, CVE Analysis, Runtime Defense

Field notes on agent firewalls, MCP security, runtime guardrails, and the people who use them.

56 posts

Selected field notes

Three good places to start

Featured Field Four Things You Can Check Four open artifacts for agent security you can check yourself: an evidence standard and checker, a rerunnable attack corpus, signed rules, and a firewall. 3 min read agent-securityevidence Featured Releases Pipelock v3.5 Release Pipelock v3.5 writes Agent Evidence Level records natively, scans WebSocket control frames, and enforces the containment layers a launch applied. 2 min read pipelockrelease Featured Releases Pipelock v3.4 Release Pipelock v3.4 tightens MCP trust policy, scans media request bodies, hardens credential detection, and adds containment-aware upgrades. 4 min read pipelockrelease Featured Pipelock Pipelock v3.3 Release Pipelock v3.3 adds subject-keyed denial-of-wallet budgets, encoded-egress detection, opt-in audit-queue encryption, and SNI-required CONNECT. 4 min read pipelockrelease Featured Pipelock Pipelock v3.1 Release Pipelock v3.1 adds an operator dashboard, free evidence viewer, strict receipt verification, SIEM/fleet readiness, and public benchmark-corpus updates. 3 min read pipelockrelease

Writing archive

Latest field notes

56 posts, newest first

Technical Agent Egress Base Rates and Alert Precision 3 min read ai-securitybenchmarks Technical Attack Corpus Governance 5 min read detection-engineeringbenchmark Field Four Things You Can Check 3 min read agent-securityevidence Releases Pipelock v3.5 Release 2 min read pipelockrelease Technical What a Hash Chain Can't Prove 4 min read ai-securityagent-security Releases Pipelock v3.4 Release 4 min read pipelockrelease Pipelock Pipelock v3.3 Release 4 min read pipelockrelease Technical Benign Set Should Look Malicious 6 min read detection-engineeringfalse-positives Pipelock Pipelock v3.1 Release 3 min read pipelockrelease Pipelock Pipelock v3.0 Release 4 min read pipelockrelease Pipelock Pipelock v2.6 Release 4 min read pipelockrelease Technical Stateless MCP and Runtime Security 10 min read ai-securityagent-security Deep dives NSA MCP Security Guidance 4 min read mcpagent-firewall Releases Pipelock v2.5.0 Release 5 min read pipelockagent-firewall Kubernetes Per-Pod NetworkPolicy Field Report 9 min read kubernetesai-security Technical Mediator Receipts: The Attestation Question 9 min read ai-securityattestation Technical Three HTTPS_PROXY Bypasses 7 min read ai-securityagent-security Technical Capture and Replay Policy 9 min read ai-securityagent-firewall Releases Agent Egress Control launch 3 min read pipelockci Sre Wedge Detection 6 min read sreai-security Technical Block-Reason Headers 7 min read ai-securityagent-firewall Technical Pipelock Inspection Layers 7 min read ai-securityagent-firewall Kubernetes subPath ConfigMap Drift 7 min read kubernetesconfigmap Technical Webhook vs Egress 9 min read ai-securityagent-security Technical Three-UID Agent Containment 7 min read ai-securityagent-security Technical Politeness vs Enforcement 7 min read ai-securityagent-security Releases Pipelock v2.4.0 Release 7 min read pipelockagent-firewall Releases Pipelock v2.3.0 Release 6 min read pipelockmcp Releases Pipelock v2.2.0 Release 4 min read pipelockmcp Industry Mythos-Ready Runtime Controls 5 min read ai-securitypipelock Technical AI Guardrails Aren't Enough 9 min read ai-securityguardrails Industry AI Security Acquisition Wave 10 min read ai-securitymarket Comparisons Best AI Agent Security Tools 2026 20 min read ai-securityagent-security Technical Domain Allowlists Aren't Enough 12 min read ai-securityagent-security Comparisons MCP Scanner Comparison 9 min read mcp-securitytool-poisoning MCP security State of MCP Security 2026 18 min read mcp-securityai-security MCP security Claude Mythos: Agent Security Risk 4 min read ai-securitypipelock Releases Pipelock Benchmark Scores 4 min read ai-securitybenchmark Industry BrowserGate and AI Agent Fingerprinting 6 min read ai-securitybrowser-security Technical When Your Agent Makes HTTP Requests 6 min read ai-securitypipelock Technical Cross-Request Exfiltration 6 min read ai-securitypipelock Comparisons Agent Egress Security Test Corpus 3 min read ai-securitybenchmark Technical Secrets Leak in POST Bodies, Not Just URLs 6 min read ai-securitypipelock MCP security MCP Tool Descriptions Are an Attack Surface 7 min read ai-securitypipelock Technical When the Model Won't Refuse 5 min read ai-securityagent-firewall Industry CVE-2026-25253 Fix: OpenClaw WebSocket Hijack 5 min read ai-securitycve Technical Your AI agent leaks API keys through DNS queries 4 min read ai-securitydata-exfiltration Technical Every protocol your agent speaks, scanned 5 min read ai-securitymcp OpSec Agent Leaked Your AWS Keys: Attack and Fix 3 min read ai-securitydata-exfiltration Technical What Is an Agent Firewall? 7 min read agent-firewallai-security Industry EU AI Act Runtime Security 8 min read complianceai-security Industry First AI Agent Espionage Campaign 7 min read ai-securityprompt-injection Releases What's next for Pipelock: the v0.2 roadmap 2 min read pipelockroadmap OpSec Wrapping Claude Code MCP 5 min read pipelockclaude-code MCP security 283 ClawHub Skills Are Leaking Your Secrets 5 min read ai-securitydata-exfiltration Technical Lateral Movement in Multi-Agent LLM Systems 6 min read ai-securitymulti-agent

Want the runtime boundary behind this write-up?

Get Pipelock See Proof