Declan Osei

Declan Osei writes about the mechanics of trust failure in autonomous systems—what happens when an agent's assumptions about its environment turn out to be wrong, and who bears the cost. He came to agentic security through years of hands-on work building and stress-testing tool-integrated pipelines, and he writes with the impatience of someone who has watched the same architectural mistakes repeat across frameworks. His work on Agentic Cyber focuses on attack-surface analysis, red-team methodology, and the unglamorous but consequential work of locking down agentic workflows before they reach production.

Articles by Declan Osei

• OpenAI, Netflix, and Dave Are Rethinking How Coding Agents Get Secured From the Inside Out —
• Google's Heather Adkins and Four Flynn on Weathering AI's "Perfect Storm" of Security Risk — Heather Adkins and Four Flynn's AI security strategy for agentic systems - from treating agents as untrusted intermediaries to hardening prompt injection defenses in
• How Snowflake, FFF Enterprises, and Sysdig Are Building AI Governance That Doesn't Kill Innovation — Ragini Ramalingam, Billy Norwood, and Sergej Epp are building enterprise AI governance that actually works - here's the risk-based model replacing the approval-gate approach.
• Anthropic's Nicholas Carlini on How LLMs Are Already Finding Zero-Days Humans Missed for Decades —
• Incident Response for Agentic AI: What to Do When an Agent Has Already Acted — When an agent has already acted, incident response for agentic AI means reconstructing the action chain, containing real damage, and preventing the same failure from recurring.
• Beyond Token Revocation: How VS Code Extensions Can Plant Persistent GitHub Backdoors —
• Silent Secret Theft: How AI Coding Agents Expose Your API Keys Without Warning — AI coding agent security risks are quietly exposing API keys through context windows, logs, and generated code - here's how to close the gaps.
• Unsanctioned AI Dev Tools Are Your Newest Attack Surface: How to Govern Them Without Killing Productivity — Shadow AI coding tools are already in your development pipeline - here's how to govern them without turning security into a productivity tax.
• Red Teaming Tool Calls: Techniques for AI Agent Pentests —
• How Attackers Hijack Tool Calls in AI Agent Pipelines —
• Multi-Agent Lateral Movement: Red-Team Techniques and Detection — Multi-agent lateral movement turns a single compromised agent into full pipeline access. Here are the red-team techniques attackers use — credential harvesting, tool registry poisoning, prompt injection across boundaries — and what detection actually looks like in practice.
• Jailbreaking vs. Prompt Injection: Why Getting the Definitions Right Matters for AI Security — Confusing jailbreaking with prompt injection leads teams to build defenses in the wrong layer - here is how to distinguish them and what to do about each.
• How Adversarial Instructions Cross Agent Boundaries — Adversarial instructions don't need to succeed at the entry point - they propagate across agent boundaries until they find one that doesn't check.
• Memory Poisoning in Long-Running Agents: Attack Patterns — Memory poisoning in long-running agents corrupts the persistent context that drives every future decision - here is how to detect it, isolate it, and respond before the damage spreads.
• Securing Agentic AI: Controls Your Architecture Needs Now — Securing agentic AI requires controls your architecture probably doesn't have yet - here's how to build them before something goes wrong.
• Zero Trust Architecture: What It Actually Means to Implement It — Zero Trust Architecture means more than buying new tools - here's what actual implementation looks like, step by step.
• Least Privilege Is Harder With AI Agents — Here's Why — Least privilege gets genuinely hard with AI agents - here is why the traditional model breaks and what you can do about it.
• Threat Modeling AI Agents: What STRIDE Misses — Threat modeling for agentic AI systems exposes the gaps that STRIDE was never designed to find - corrupted context, dynamic tool trust, and permission escalation that looks like normal operation.