Declan Osei

Declan Osei writes about the mechanics of trust failure in autonomous systems—what happens when an agent's assumptions about its environment turn out to be wrong, and who bears the cost. He came to agentic security through years of hands-on work building and stress-testing tool-integrated pipelines, and he writes with the impatience of someone who has watched the same architectural mistakes repeat across frameworks. His work on Agentic Cyber focuses on attack-surface analysis, red-team methodology, and the unglamorous but consequential work of locking down agentic workflows before they reach production.

Articles by Declan Osei

• OAuth for AI Agents: Scopes, Token Exchange and Per-Action Authorization — Use OAuth to bound what an agent token can do, record who the agent acts for and limit theft damage. Learn the grants, token exchange, scope design and why scopes are too coarse.
• AI Security Controls by Layer: What Each Control Buys You and What It Does Not — A seven-layer catalog of AI security controls, each row stating what it buys you and what it does not, with a case for choosing controls that fail closed.
• How to Secure AI Agents: Ten Controls in Build Order — A short, ordered list for securing AI agents, grounded in NCSC and OWASP guidance. Each control comes with the proof worth keeping, and the order puts limits before detection.
• MCP Security: A Complete Guide to Securing the Model Context Protocol — An MCP server runs code, holds credentials and feeds text to your model. This guide covers the 2026-07-28 specification, seven risks with their controls and a containment-first rollout.
• AI Security Posture Management: Finding Shadow Agents You Did Not Deploy — Shadow agents are born as consents and tokens, not cloud workloads. Here is how to discover them through identity, record posture, rank by authority and offer a faster sanctioned route.
• AI Agent Kill Switch: A Self-Check for Stop, Containment and Rollback — A kill switch is three abilities, not one button. Score yours across stop, containment and rollback, then fix the weakest link first.
• MCP Security Intake Sheet: Eight Questions Before a Third-Party Server — Score any third-party MCP server from 0 to 16 before it reaches company data, using the protocol's own security guidance and a 2026 audit of nearly ten thousand public servers.
• Copilot Studio Security: Six Settings That Decide the Blast Radius — There is no public incident, and the three defaults everyone checks would not have stopped the one documented case. What actually caps a low-code agent's reach, setting by setting.
• Agentic AI Security: Deciding What to Buy, What to Build and What to Ignore — An analyst curve maps where suppliers are spending attention, not where your risk sits. Here is how to read one and still write the right purchase order.
• The npm Worm That Harvested Developer Secrets: Five Controls for Coding Agent Teams — A registry worm turned one stolen publishing token into hundreds of compromised packages. Coding agents run installs with a developer's credentials, which makes the response worth copying.
• The OWASP Top 10 for Agentic Applications: Ten Risks, Ten Questions You Can Answer — A peer-reviewed list of agentic risks is only useful once it becomes a work plan. Here is each item turned into a question about your own stack, plus a faster triage test.
• Supply Chain Security for AI Agents: What to Pin, What to Verify, What to Record — An agent runs far more than the code in your repository. This is the practical control set for pinning, verifying and recording everything else it depends on.
• MCP Server Authorization: Audience Binding and the Confused Deputy — A verified token tells you nothing about who it was issued for. How audience checks, a ban on relaying credentials, and per-client consent keep an MCP server from acting as somebody else's deputy.
• Attack Surface Management for AI Agents: Score the Inventory First — A sixteen-point self-check for agent attack surface work: eight questions you can only answer with an artefact, three bands, and what to do first in each.
• OpenAI, Netflix, and Dave Are Rethinking How Coding Agents Get Secured From the Inside Out —
• Google's Heather Adkins and Four Flynn on Weathering AI's "Perfect Storm" of Security Risk — Heather Adkins and Four Flynn's AI security strategy for agentic systems - from treating agents as untrusted intermediaries to hardening prompt injection defenses in
• How Snowflake, FFF Enterprises, and Sysdig Are Building AI Governance That Doesn't Kill Innovation — Ragini Ramalingam, Billy Norwood, and Sergej Epp are building enterprise AI governance that actually works - here's the risk-based model replacing the approval-gate approach.
• Anthropic's Nicholas Carlini on How LLMs Are Already Finding Zero-Days Humans Missed for Decades —
• Incident Response for Agentic AI: What to Do When an Agent Has Already Acted — When an agent has already acted, incident response for agentic AI means reconstructing the action chain, containing real damage, and preventing the same failure from recurring.
• Beyond Token Revocation: How VS Code Extensions Can Plant Persistent GitHub Backdoors —
• Silent Secret Theft: How AI Coding Agents Expose Your API Keys Without Warning — AI coding agent security risks are quietly exposing API keys through context windows, logs, and generated code - here's how to close the gaps.
• Unsanctioned AI Dev Tools Are Your Newest Attack Surface: How to Govern Them Without Killing Productivity — Shadow AI coding tools are already in your development pipeline - here's how to govern them without turning security into a productivity tax.
• Red Teaming Tool Calls: Techniques for AI Agent Pentests —
• How Attackers Hijack Tool Calls in AI Agent Pipelines —
• Multi-Agent Lateral Movement: Red-Team Techniques and Detection — Multi-agent lateral movement turns a single compromised agent into full pipeline access. Here are the red-team techniques attackers use — credential harvesting, tool registry poisoning, prompt injection across boundaries — and what detection actually looks like in practice.
• Jailbreaking vs. Prompt Injection: Why Getting the Definitions Right Matters for AI Security — Confusing jailbreaking with prompt injection leads teams to build defenses in the wrong layer - here is how to distinguish them and what to do about each.
• How Adversarial Instructions Cross Agent Boundaries — Adversarial instructions don't need to succeed at the entry point - they propagate across agent boundaries until they find one that doesn't check.
• Memory Poisoning in Long-Running Agents: Attack Patterns — Memory poisoning in long-running agents corrupts the persistent context that drives every future decision - here is how to detect it, isolate it, and respond before the damage spreads.
• Securing Agentic AI: Controls Your Architecture Needs Now — Securing agentic AI requires controls your architecture probably doesn't have yet - here's how to build them before something goes wrong.
• Zero Trust Architecture: What It Actually Means to Implement It — Zero Trust Architecture means more than buying new tools - here's what actual implementation looks like, step by step.
• Least Privilege Is Harder With AI Agents — Here's Why — Least privilege gets genuinely hard with AI agents - here is why the traditional model breaks and what you can do about it.
• Threat Modeling AI Agents: What STRIDE Misses — Threat modeling for agentic AI systems exposes the gaps that STRIDE was never designed to find - corrupted context, dynamic tool trust, and permission escalation that looks like normal operation.