Mara Voss

Mara Voss writes about the security implications of autonomous systems from the inside out—having spent years building, breaking, and rethinking agentic pipelines before the term entered mainstream vocabulary. Her work focuses on the places where AI autonomy and adversarial reality collide: tool call boundaries, memory persistence, trust propagation across agent graphs, and the quiet failures that don't make incident reports. She writes for practitioners who are already in the weeds, not for audiences who need convincing that agentic security is worth taking seriously.

Articles by Mara Voss

• Agentic AI Risk Management: A Six-Step Programme Built on the NIST AI RMF — A six-step agentic AI risk management programme from inventory to incident response, tied to the NIST AI RMF and the Playbook, with the option many teams forget: avoid the agent.
• Shadow AI: How to Detect Unsanctioned AI Agents and Tools on Endpoints — Shadow AI is an endpoint inventory problem. Learn which signals to collect, how to phase a 90-day programme, and why managed configuration beats chasing traces.
• AI Prompt Injection Attacks: Direct, Indirect and What Actually Reduces the Damage — Prompt injection has two entrances and one root cause. Learn how direct and indirect attacks differ, what lowers the odds, what limits the damage, and why sorting by writer beats sorting by channel.
• Agentic AI Governance and Compliance: A Complete Guide for Security Teams — Governance makes agent controls provable. Learn the frameworks, one evidence set that serves several of them, and why the EU delay should not delay your programme.
• AI Agent Identity and Non-Human Identity Security: A Complete Guide — Every agent control depends on knowing which agent acted, for whom. This guide covers identity designs, the credential lifecycle, OWASP's NHI risks and what to ask vendors.
• Prompt Injection Testing in CI: Building a Regression Suite for Agents — Assert on tool calls, not on wording. Build a prompt injection regression suite with canary fixtures, sampling gates and a tiered pipeline, then learn what a green build cannot tell you.
• AI Red Teaming for Agents: Scope, Rules of Engagement and Reporting — A bypass rate says nothing about what an agent could do with its tools. Scope the exercise by authority, write the rules first, and report findings engineers can fix.
• Claude Code Security: What Actually Runs Before You Trust a Folder — Straiker reports a launched session skipping the parent's trust check. The more useful artefact is the vendor's own table of what a repository can run before you have trusted anything.
• Where Is the Vulnpocalypse? A Referee's Card for the [un]prompted II Debate — Sergej Epp and Jeremiah Grossman debate the resolution that AI noise hasn't moved the needle on current cyber risk. We build the strongest honest case for each side using only figures from the published agenda, and name the evidence that would settle it. No verdict.
• Zero-Click AI Agent Exploit Chains: What AgentFlayer Teaches Defenders — Enterprise agents acted for an outsider with nobody clicking anything. Where the budget belongs after AgentFlayer, and why the deterministic half of the stack comes first.
• Integrous AI Systems Design: Bruce Schneier on the Leg of the Triad Nobody Studied — Bruce Schneier argues that integrity - data, processing, storage and contextual - is becoming the most important property of AI-driven systems, and must be solved before we trust AI to act for people. A preview of the Day 3 talk, read with Sounil Yu on least agency and the Open PBOM specification.
• Your Harness Needs a Security Constitution: Kat Traxler on 12 Principles of Cloud Trust — Kat Traxler brings a hunting methodology built on 12 principles about trust in multi-tenant cloud platforms, judged by a reasonable customer test, with 90+ valid cloud-specific findings behind it. A preview of the Day 1 talk from the published abstract.
• When Evaluation Runs Start Talking to Each Other: Omer Nevo on Agents That Pool Answers — Agents in separate evaluation runs can find each other through shared infrastructure, pool answers, and quietly invalidate the result. A preview of Omer Nevo's Day 3 talk, read alongside the other two sessions at [un]prompted II that question what a benchmark score measures.
• Promptware EOD: Detonating Agent Skills and Reading the Kernel Instead of the Report ([un]prompted II) — Tamir Ishay Sharbat (Zenity) and Joao Donato tested tens of thousands of agent skills in a detonation chamber and found hundreds malicious. The finding is not the count - it is the gap between what the agent reported and what the kernel saw.
• MCP Gateway Security: What a Choke Point Enforces and What It Never Sees — A gateway in front of your tool servers is a real control doing a real job. The job is narrower than the architecture diagram implies, and the gap needs naming.
• Hardware Sandboxing for Agents: Elie Bursztein and Capsem at [un]prompted II — Elie Bursztein presents Capsem, an open-source Rust hypervisor for agents, at [un]prompted II. We preview the claim and pair it with Daniel Cuthbert's sandbox talk.
• Approval Is Not Human Presence: Brooks McMillin at [un]prompted II — Brooks McMillin of Dropbox presents a deployed MCP permission broker at [un]prompted II. We preview what the abstract claims and the checks we plan to make.
• From Patch Generation to Evidence: Ela Avrahami on Trusting AI-Written Code ([un]prompted II) — Generating a patch is solved. Getting one merged is not. Ela Avrahami's Day 3 talk on the OpenAnt Auto Patcher is about the evidence that moves a reviewer, and the line between what an LLM may decide and what deterministic policy must.
• Who Is Prompt-Injecting Coding Agents? Radware's Scan of 86 Million GitHub Items ([un]prompted II) — About 2.5 hidden-text prompt injections per 100,000 GitHub items, with goals spanning agent orchestration, growth hacking and data exfiltration. Gabi Nakibly and Zvika Babo of Radware bring the only population-scale base rate on the [un]prompted II agenda.
• All Tokens Are Created Equal: CxBOM at [un]prompted II — Rock Lambros and Fred Wilmot release CxBOM, a bill of materials for the context window, at [un]prompted II. We preview the claim and the minimum schema we would want.
• Sandboxing Agents Is a Three-Body Problem: Ankit Agrawal at [un]prompted II — Ankit Agrawal of Webflow says agent sandboxing is three coupled problems. We preview the claim from the abstract and list the checks we will make.
• Non-Human Identity Security for AI Agents: Design for a Credential That Gets Misused — Machine credentials already outnumber the people who own them, and an agent chooses which one to spend at runtime. Here is how to keep that choice from becoming an incident.
• Opened Is Not Fixed: Shayaun Nejad on the Last Mile of AI Vulnerability Remediation ([un]prompted II) — Meta fixed over 40% of its criticals with AI-written diffs and time-to-fix did not drop. XOR got 12 working exploits and zero accepted patches. Shayaun Nejad (Rubrik) has the Day 1 talk about the gap between those two results.
• The Model Is Not a Security Control: Vince Ovando at [un]prompted II — Vince Ovando argues at [un]prompted II that prompt injection dies at the token sampler. We preview the claim, say where it may break, and list what we will check.
• AI Agent Monitoring: Logs, Measures and Alerts Are Three Different Jobs — Agent failures pass every health check. Here is the field set a step record needs, the measures worth computing per task type, and how an alert earns an owner and an action.
• StealthBench and the 53.8% Ceiling: What a Safe-Success Rate Measures — StealthBench scores autonomous security agents on task success and OPSEC together, across 14 containerised scenarios. Across 771 trajectories and 8 models, none exceeded a 53.8% safe-success rate. A preview of the Day 1 talk, and what that figure does and does not say.
• The [un]prompted II Vocabulary: 24 Terms From the Agenda, Defined — 24 terms from the [un]prompted II agenda, from CxBOM to PBOM, defined with the talk and speaker where the agenda names one. Read on 2026-10-12, and flagged where we interpret.
• EchoLeak and the Zero-Click Lesson for Every AI Agent Owner — Aim Labs showed that an assistant can leak internal data without anyone clicking. Here is the EchoLeak mechanism at defender level, and the controls that cut the chain.
• Six Arguments That Run Through [un]prompted II — We read the published [un]prompted II agenda for the places where competent teams disagree. Six arguments carry the programme, from “the model is not a security control” to “approval is theatre” — plus the one argument nobody on the agenda is having.
• AI Security in 2026: The Scope, the Boundaries and the Order to Work In — The term covers two distinct jobs: defending the model system and bounding what it can reach. Here is the scope, the structural differences, and a sequenced first month.
• Claude Code Audit Trails: What the Session History Cannot Tell an Investigator — Saved session history narrates the work. The executions live in a separate stream that is off by default, redacted by default, and gated by hooks that fail open.
• [un]prompted II: The Complete Agenda, Every Session Explained (27–29 October 2026, San Francisco) — An independent reference for [un]prompted II, the AI security practitioner conference in San Francisco from 27 to 29 October 2026: all 85 sessions, every speaker, the six arguments running through the programme, and the figures each talk puts on the table.
• Agentic AI Audit Logs: The Four Claims Your Record Has to Substantiate — An agent's event stream has to establish attribution, fidelity, authorization and integrity. Here is which event carries each claim, and where ordinary logging leaves nothing behind.
• The Agentic SOC Is Here: How Salesforce, Datadog, and GreyNoise Are Putting Autonomous Agents on the Front Line —
• Stripe, Snap, and Sondera on Stopping Prompt Injection Without Neutering Your Agents — Stripe, Snap, and Sondera's practitioners explain why prompt engineering is not a security boundary for agentic systems - and what capability-based authorization actually looks like in production.
• Inside Trail of Bits' AI-Native Transformation: Dan Guido on Building a Security Firm Around Autonomous Agents — Dan Guido and Trail of Bits show why AI-native security consulting requires rearchitecting for autonomous scale - not wrapping LLMs around existing processes.
• How to Red-Team an Agentic System: A Practitioner's Methodology — A practitioner's methodology for red-teaming agentic systems - covering tool inventory mapping, authority probing, prompt injection, and lateral movement simulation in autonomous agent environments.
• Inside LLM Security Flaws: What the Latest Vulnerability Research Means for Agentic AI Systems —
• How Open-Source Security Layers Are Closing the Safety Gaps in Agentic AI Systems —
• How Agentic AI Coding Tools Are Becoming Prime Targets for IDE-Based Malware Attacks —
• Sandboxing AI Agent Tool Calls: An Isolation Architecture — Tool misuse in agentic systems rarely looks like a breach - it looks like permitted behavior in an unanticipated sequence, which is exactly why tool call sandboxing requires runtime isolation, not just access control.
• Detecting Malicious Tool Calls in Agentic AI Systems —
• Defending Agentic AI Memory: Detection and Isolation Controls — Memory poisoning in agentic AI systems corrupts stored state that persists across sessions - here is how to detect it, isolate it, and verify memory integrity before it becomes an incident.
• LangChain, LangGraph, and AutoGen Security Gaps: 7 Fixes for Agentic Frameworks (2026) — LangChain, LangGraph, and AutoGen have concrete, exploitable security vulnerabilities — in tool calling, state management, and inter-agent trust. Here is where the gaps live, how attackers exploit them, and the seven defensive controls you can implement today.
• Privilege Escalation in Agentic Systems: How Agents Acquire Permissions They Shouldn't Have — Privilege escalation in agentic systems happens when agents acquire access beyond their intended scope - and most frameworks make this easy by conflating capability with authorization.
• Tool Call Interception: The Attack Vector Hidden in Plain Sight — Tool call interception lets attackers manipulate what your agent believes about the world - without ever touching the model.
• Why Teams Skip Threat Modeling — And How to Change That — Threat modeling for agentic systems is unfamiliar territory - here is why teams skip it and how to build the habit without overhauling your workflow.
• How to Map Your Attack Surface Before Attackers Do — Learn how to map your attack surface before attackers do - with practical steps for finding exposed assets, building an inventory, and staying ahead of new risks.
• The AI Security Blind Spots Most Teams Don't Talk About — AI security blind spots hide in the gaps between familiar frameworks and newer risks - here's how to find them before someone else does.