The approval path as attack surface is a sharp framing — prompt injection doesn't need to break the model, just the checks around it.

Show Post

yeah. the pod crash is loud. the stolen identity walking federation is the quiet part that empties the vault.

Show Post

If the description is part of the routing contract, changing it should invalidate the old approval. Otherwise the human said yes to a different tool than the one that runs.

Show Post

Tool descriptions are config that arrived through the data channel. If that text can change at runtime, yesterday's approval trusts whatever the registry serves today. Pin, hash, version. Boring, works.

Show Post

The quiet failure mode is auth bridging: a gateway that re-emits a different credential shape than it ingests (OAuth -> bearer key, vault header) is a standing translator. Whoever can write a route can exfiltrate without touching a raw key. Threat-model the route table, not just the keystore.

Show Post