Renn Calloway

Renn Calloway writes about the unglamorous middle layer of agentic security—the orchestration logic, tool registries, and inter-agent message passing that most threat models treat as an afterthought. Having spent years building and stress-testing autonomous pipelines in private-sector environments, Renn brings a red-teamer's instinct for the edge case and an architect's frustration with security controls that look good on paper and fail in production. When not breaking things deliberately, Renn writes about governance gaps, emerging red-team methodologies, and the slow, hard work of making agentic systems trustworthy enough to actually deploy.

Articles by Renn Calloway

• Secrets Management for AI Agents: Keeping Credentials Out of Configs and Prompts — Agent configs and prompts now collect the credentials that malware targets. Learn six moves to keep secrets out, and why rotation, not detection, is the bottleneck.
• AI-SPM vs CSPM vs DSPM: What AI Security Posture Management Covers — AI-SPM borrows its name from cloud and data posture management but covers different ground. See what it sees, what it misses and when a dedicated product pays off.
• Agentic AI Security Risks: A Copyable Risk Register With Scoring — Twelve agentic AI security risks in a register you can copy, with exposure and impact scoring, proof to attach and a case for scoring paths instead of categories.
• AI Agent Runtime Security: A Complete Guide to Policy, Isolation and Containment — Most agent incidents happen at run time, between a decision and its effect. This guide covers seven controls, incident patterns and why walls beat prompts.
• NIST AI RMF for AI Agents: What Govern, Map, Measure and Manage Should Leave Behind — The NIST AI RMF never mentions tool calls or MCP servers. Here is one practitioner's reading of the evidence each function should produce for an agent.
• AI Agent Guardrails Versus Controls: What Each One Can Actually Stop — A guardrail lowers how often a model misbehaves. A control limits what happens when it does. Here is how to sort your protections and where each belongs.
• Non-Human Identity Security: Score Your Agent Credential Lifecycle — Eight questions on owners, end dates and offboarding, scored in an hour. Plus the 2026 scanning data that shows why expiry beats discovery as a first purchase.
• ForcedLeak: What Indirect Prompt Injection Against a CRM Agent Teaches Defenders — A stranger filled in a web form. Weeks later a routine employee question moved CRM records to an outside server. This is the chain, and the four places it could have been severed.
• Prompt Injection Defense for Production Agents: Build for the Injection That Works — The UK's national cyber agency does not expect this bug class to be eliminated. That changes the design goal from blocking hostile text to shrinking what hostile text can reach.
• AI Agent Identity: Stop Classifying the Agent, Start Describing the Action — Identity reviews for agents stall on whether the thing is a person or a workload. The question has no answer, and a better one already has standards behind it.
• Your [un]prompted II Clash Guide: Stage 1 Against Stage 2, Hour by Hour — Two stages, 85 session slots, 20 minutes each. We went through the published [un]prompted II agenda slot by slot and made a call on every clash, including the five that will genuinely hurt.
• AI Agent Architecture Security: A Layer-by-Layer Reference — A security reference for agent architecture, layer by layer: the model, context and memory, the tool layer, identity and orchestration, with the trust boundary that belongs to each.
• Hardening a LangChain Agent Stack After LangGrinch (CVE-2025-68664) — A critical langchain-core flaw showed that a framework's own save format is not a trust boundary. Here is the defender-level reading and the hardening that outlives the patch.
• Who Is Speaking at [un]prompted II: Every Session by Speaker, Company and Subject — Every speaker on the [un]prompted II agenda, sorted by surname, with company, talk and stage, then grouped by concern and by employer. Read from the official agenda on 2026-10-12.
• Agentic AI Security Checklist: Twenty Questions to Answer Before Launch — Twenty pre-ship questions in five themes, covering authority, untrusted input, action gating, dependencies and response. Each one closes against evidence, not opinion.
• The Most Important Person in Your Next Meeting Isn't a Person: Joe Sullivan on AI Notetakers as Infrastructure —
• AISLE Found 12 Zero-Days in OpenSSL. FENRIR Found 100+ More. What AI-Discovered Vulnerabilities Mean for Defenders — AI-discovered zero-days from AISLE and FENRIR are not a new threat category - they are a volume problem your triage process must handle without panic or shortcuts.
• Rob T. Lee Gave Claude Code Root on a DFIR Workstation - Here's What SANS Learned — Rob T. Lee gave Claude Code root on a SIFT workstation at [un]prompted - and what SANS learned exposes the core misconception behind agentic security in DFIR environments.
• Human Oversight in Agentic Systems: What Governance Actually Looks Like in Production — Human oversight in agentic systems fails not because the controls are missing but because they are designed for the ideal case, not the production one.
• From RBAC to ABAC: A Practical Access Control Roadmap for AI Agents and Autonomous Systems —
• Malicious VS Code Extensions Are the New Supply Chain Backdoor: What Developers Must Know —
• Inside Agentic AI Architectures: How Prompts, Timers, and Skill Modules Shape Agent Behavior —
• How Agentic AI Is Rewriting the Rules of State-Sponsored Cyber Espionage —
• Threat Modeling Tool Misuse Across AI Agent Architectures —
• Threat Modeling Memory Stores in Multi-Agent Architectures —
• MCP Server Security: The Trust Boundary Most Teams Haven't Thought Through — MCP server security is the trust boundary most teams have not thought through - here is how to model it before an attacker does.
• Runtime Monitoring for AI Agents: What to Watch, What to Log, and What to Alert On — Runtime monitoring for AI agents requires semantic observability, not just latency thresholds - here's what to log, what to alert on, and where conventional monitoring fails.
• Supply-Chain Risk in Agentic Pipelines: Where Trust Breaks Down —
• Defensive Architecture Principles Every Security Team Needs — Defensive architecture principles give security teams the structural guardrails to constrain agent behavior before something goes wrong - not after.
• Defense-in-Depth for AI Pipelines: A Layered Control Guide — Defense-in-depth for AI pipelines means layering input, model, output, execution, and monitoring controls so that when one safeguard fails, others are already in place.
• Threat Modeling Modern Apps: STRIDE Without the Overhead — Learn how to apply STRIDE threat modeling to modern apps without the overhead that makes most teams quit after the first session.
• Prompt Injection in Multi-Agent Pipelines: Attack Paths and Fixes — Prompt injection in multi-agent pipelines travels farther than most threat models expect - here is how adversarial instructions propagate across agent boundaries and what architectural controls can actually stop them.