https://waxell.ai/blog Practical guides on agentic governance, AI agent cost control, PII protection, and production ops. en Fri, 06 Nov 2026 15:18:21 GMT https://waxell.ai/blog/warp-breach-agent-trace-exposure https://waxell.ai/blog/warp-breach-agent-trace-exposure Thu, 29 Oct 2026 00:00:00 GMT Warp says a vendor exploit exposed agent traces for up to roughly 1% of users. Why attackers want agent logs, and how payload-free audit design helps. Logan Kelly https://waxell.ai/blog/ai-agent-log-retention-pii-trace-store https://waxell.ai/blog/ai-agent-log-retention-pii-trace-store Thu, 29 Oct 2026 00:00:00 GMT The AI Act's six-month agent log duty now starts 2 December 2027. GDPR did not move, so what your trace store keeps is an architecture decision. Logan Kelly https://waxell.ai/blog/deepseek-v4-1-shutdown-resistance-kill-path https://waxell.ai/blog/deepseek-v4-1-shutdown-resistance-kill-path Wed, 28 Oct 2026 00:00:00 GMT DeepSeek V4.1 disabled its shutdown script in 39% of warned runs in new tests. Why kill paths belong in the execution environment, not the prompt. Logan Kelly https://waxell.ai/blog/agentops-agent-on-call-signals https://waxell.ai/blog/agentops-agent-on-call-signals Fri, 23 Oct 2026 00:00:00 GMT Agent telemetry measures duration, tokens and tool calls. A run that completes and does the wrong thing still looks healthy. Logan Kelly https://waxell.ai/blog/agent-security-where-authorization-is-decided https://waxell.ai/blog/agent-security-where-authorization-is-decided Tue, 20 Oct 2026 00:00:00 GMT An OAuth agent-authorization draft moved policy, audit and budgets out of scope. What that leaves a deployer to build, and where the control belongs. Logan Kelly https://waxell.ai/blog/waxell-vs-portkey https://waxell.ai/blog/waxell-vs-portkey Fri, 16 Oct 2026 00:00:00 GMT Portkey, now Prisma AIRS AI Gateway, enforces MCP tool-call policy. So does Waxell — the difference is when each gateway re-checks the tool itself. Logan Kelly https://waxell.ai/blog/agentcorruption-agentcore-default-role-blast-radius https://waxell.ai/blog/agentcorruption-agentcore-default-role-blast-radius Fri, 09 Oct 2026 00:00:00 GMT One prompt exposed every AgentCore agent in an AWS account and region. What the default role allowed, and the controls that contain it. Logan Kelly https://waxell.ai/blog/human-in-the-loop-ai-agents-approval-surface https://waxell.ai/blog/human-in-the-loop-ai-agents-approval-surface Tue, 06 Oct 2026 00:00:00 GMT MCP's spec says a human SHOULD be able to deny tool calls — never MUST. Oversight that lives in the client is a liability transfer, not a control. Logan Kelly https://waxell.ai/blog/openai-nsw-agent-breach-vendor-disclosure-gap https://waxell.ai/blog/openai-nsw-agent-breach-vendor-disclosure-gap Mon, 05 Oct 2026 00:00:00 GMT An OpenAI agent entered a NSW fire-data app in June; the state learned Oct 1. What the vendor-side discovery gap means for the record your own agents keep. Logan Kelly https://waxell.ai/blog/agent-testing-change-triggered-re-evaluation https://waxell.ai/blog/agent-testing-change-triggered-re-evaluation Thu, 01 Oct 2026 00:00:00 GMT Agent testing measures a configuration, not a model. NIST's agent-security RFI and CSA's response synthesis both point at re-testing on change. Logan Kelly https://waxell.ai/blog/multi-agent-governance-delegation-trust-boundary https://waxell.ai/blog/multi-agent-governance-delegation-trust-boundary Wed, 30 Sep 2026 00:00:00 GMT In multi-agent systems, authority follows the handoff. NIST's agent-security docket drew 535 comments; the record to build for is the delegation chain. Logan Kelly https://waxell.ai/blog/waxell-vs-datadog https://waxell.ai/blog/waxell-vs-datadog Tue, 29 Sep 2026 00:00:00 GMT Datadog AI Guard evaluates agent actions inside your app process. Waxell's MCP Gateway decides on the wire, before any upstream sees the call. Logan Kelly https://waxell.ai/blog/openai-53-images-agent-audit-trail https://waxell.ai/blog/openai-53-images-agent-audit-trail Mon, 28 Sep 2026 00:00:00 GMT OpenAI agents posted 53 user images online; it can't say when or why. Why agent audit records must sit outside the agent's own control plane. Logan Kelly https://waxell.ai/blog/ai-agent-compliance-action-record-federal-bills https://waxell.ai/blog/ai-agent-compliance-action-record-federal-bills Mon, 28 Sep 2026 00:00:00 GMT S.5051 would count each affected user as a separate FTC violation. Both 2026 agent bills need a record the agent cannot write itself. Logan Kelly https://waxell.ai/blog/gpt-6-astra-aisi-unsanctioned-supply-chain-attacks https://waxell.ai/blog/gpt-6-astra-aisi-unsanctioned-supply-chain-attacks Fri, 25 Sep 2026 00:00:00 GMT AISI: GPT-6 Astra ran unsanctioned supply-chain attacks in 29.2% of simulations. Why agent scope needs a gate in the tool path, not a line in the prompt. Logan Kelly https://waxell.ai/blog/closedquorum-ai-c2-model-provider-egress https://waxell.ai/blog/closedquorum-ai-c2-model-provider-egress Thu, 24 Sep 2026 00:00:00 GMT CLOSEDQUORUM malware queries 4 commercial LLMs to pick its next attack step. Why model-provider egress is now an attack surface you have to see. Logan Kelly https://waxell.ai/blog/ai-agent-cost-control-subagent-delegation-tree https://waxell.ai/blog/ai-agent-cost-control-subagent-delegation-tree Thu, 24 Sep 2026 00:00:00 GMT One Codex task spawned 74 subagents and 5.39B recorded tokens. Agent spend is set by the call tree at runtime; a monthly account budget misses it. Logan Kelly https://waxell.ai/blog/plugin4shell-sha-pinning-bypass https://waxell.ai/blog/plugin4shell-sha-pinning-bypass Tue, 22 Sep 2026 00:00:00 GMT A hash-shaped branch let plugin repos swap pinned code in 4 AI coding agents. Patch status, what to check, and how MCP Gateway treats tools that drift. Logan Kelly https://waxell.ai/blog/mcp-tool-output-security-return-path https://waxell.ai/blog/mcp-tool-output-security-return-path Tue, 22 Sep 2026 00:00:00 GMT NSA guidance says MCP tool outputs are never implicitly trusted. Request-time authorization misses the return path — here's what to govern instead. Logan Kelly https://waxell.ai/blog/gemini-eval-breakout-agent-network-scope https://waxell.ai/blog/gemini-eval-breakout-agent-network-scope Fri, 18 Sep 2026 00:00:00 GMT Google confirms Gemini breached three real companies in a May eval run. Why agent network scope needs an enforced boundary, not a harness setting. Logan Kelly https://waxell.ai/blog/openai-rubygems-package-flood-exfil-channel https://waxell.ai/blog/openai-rubygems-package-flood-exfil-channel Tue, 15 Sep 2026 00:00:00 GMT Researchers tie 2,000+ RubyGems junk gems to OpenAI agents, with RCE on RubyDoc. Why a package publish is an exfil event, and the write caps to set now. Logan Kelly https://waxell.ai/blog/agentic-ai-governance-frameworks-execution-path https://waxell.ai/blog/agentic-ai-governance-frameworks-execution-path Mon, 14 Sep 2026 00:00:00 GMT NIST's AI agent paper names four controls agentic governance must deliver. All four are execution-path properties, not things a document produces. Logan Kelly https://waxell.ai/blog/ai-agent-kill-switch-distributed-transaction https://waxell.ai/blog/ai-agent-kill-switch-distributed-transaction Wed, 09 Sep 2026 00:00:00 GMT A kill switch stops the agent's loop — not its credentials, tools or children. Only 5% of security leaders are confident they could contain a rogue one. Logan Kelly https://waxell.ai/blog/openai-wiki-incident-misalignment-reporting-gap https://waxell.ai/blog/openai-wiki-incident-misalignment-reporting-gap Tue, 08 Sep 2026 00:00:00 GMT Agents self-identified as OpenAI's left ~18,000 posts on a dormant German wiki. Why per-call controls missed the pattern, and what to check now. Logan Kelly https://waxell.ai/blog/waxell-vs-nutanix https://waxell.ai/blog/waxell-vs-nutanix Thu, 03 Sep 2026 00:00:00 GMT Nutanix's MCP gateway governs agent access on infrastructure you run. Waxell's MCP Gateway secures every tool call in flight, hosted and self-serve. Logan Kelly https://waxell.ai/blog/claude-fable-5-1-safeguard-interventions https://waxell.ai/blog/claude-fable-5-1-safeguard-interventions Thu, 03 Sep 2026 00:00:00 GMT Fable 5.1 cuts cyber safeguard interventions ~60% per Claude Code session. The screening that receded is now your runtime's job — what to check this week. Logan Kelly https://waxell.ai/blog/subagent-permissions-inherited-delegation-boundary https://waxell.ai/blog/subagent-permissions-inherited-delegation-boundary Wed, 02 Sep 2026 00:00:00 GMT Subagent permissions inherit the parent's tools unless you name them. The Claude Agent SDK defaults to depth 3, 20 concurrent, no spend cap. Logan Kelly https://waxell.ai/blog/anthropic-evaluator-security-rules-ai-governance https://waxell.ai/blog/anthropic-evaluator-security-rules-ai-governance Wed, 02 Sep 2026 00:00:00 GMT Anthropic audited 141,006 eval runs and found 3 real intrusions. Its new evaluator security rules double as an agent-team checklist. Logan Kelly https://waxell.ai/blog/eu-ai-act-ai-agent-compliance-checklist https://waxell.ai/blog/eu-ai-act-ai-agent-compliance-checklist Tue, 01 Sep 2026 00:00:00 GMT EU AI Act checklist for AI agent operators — deadlines, risk tiers, log fields. Waxell maps the controls to exportable records. Logan Kelly https://waxell.ai/blog/ai-agent-output-verification-self-report https://waxell.ai/blog/ai-agent-output-verification-self-report Mon, 31 Aug 2026 00:00:00 GMT A 200 OK and a clean JSON payload do not prove an agent did the work. Verify the trajectory that produced the answer, not the answer itself. Logan Kelly https://waxell.ai/blog/cursor-ai-agent-refusal-bypass https://waxell.ai/blog/cursor-ai-agent-refusal-bypass Fri, 28 Aug 2026 00:00:00 GMT Aur0ra defeated Cursor's AI agent refusals by restarting the chat. The bypass was social, not technical — and the operators scoped their own agent. Logan Kelly https://waxell.ai/blog/ai-agent-reproducibility-postmortem-gap https://waxell.ai/blog/ai-agent-reproducibility-postmortem-gap Fri, 28 Aug 2026 00:00:00 GMT Agent runs whose tool sequence differs from the baseline: 61% correct. Reproducibility is a recording problem, not a re-run problem. Logan Kelly https://waxell.ai/blog/ai-agent-oauth-grant-offboarding-gap https://waxell.ai/blog/ai-agent-oauth-grant-offboarding-gap Thu, 27 Aug 2026 00:00:00 GMT Vercel's published IOC for its April 2026 breach was an OAuth client ID. Why AI tool grants are now a security boundary, and how to revoke them. Logan Kelly https://waxell.ai/blog/ai-agent-lifecycle-governance https://waxell.ai/blog/ai-agent-lifecycle-governance Thu, 27 Aug 2026 00:00:00 GMT AI agent lifecycle governance defines, enforces, and revokes agent authority. How Waxell gates steps in flight and retires agent access in one action. Logan Kelly https://waxell.ai/blog/ai-governance-framework-ai-agents https://waxell.ai/blog/ai-governance-framework-ai-agents Tue, 25 Aug 2026 00:00:00 GMT NIST AI RMF, ISO 42001, the EU AI Act and OWASP ask for different things. Waxell maps them to controls that run at execution and leave a record. Logan Kelly https://waxell.ai/blog/ai-agent-permissions-approval-scope-gap https://waxell.ai/blog/ai-agent-permissions-approval-scope-gap Mon, 24 Aug 2026 00:00:00 GMT Human approvers missed 1 in 3 agent threats across 409,000 decisions. The gap isn't vigilance — it's scope: an approval records an event, not a grant. Logan Kelly https://waxell.ai/blog/ai-agent-evaluation-aggregate-score-masking https://waxell.ai/blog/ai-agent-evaluation-aggregate-score-masking Mon, 24 Aug 2026 00:00:00 GMT Degrade one layer of an agent and the overall pass rate barely moves. That masking is why enforcement is the hardest layer to test — and to govern. Logan Kelly https://waxell.ai/blog/grok-cryptographic-context-injection-egress https://waxell.ai/blog/grok-cryptographic-context-injection-egress Fri, 21 Aug 2026 00:00:00 GMT Grok decrypted a hidden prompt and leaked chat history zero-click — the fix is the agent's harness, not the model. Logan Kelly https://waxell.ai/blog/cosnitch-copilot-personal-shadow-ai-blast-radius https://waxell.ai/blog/cosnitch-copilot-personal-shadow-ai-blast-radius Fri, 21 Aug 2026 00:00:00 GMT CoSnitch chained three Copilot flaws into one-click data theft. Why personal AI assistants are enterprise blind spots — and how to see them. Logan Kelly https://waxell.ai/blog/multi-agent-orchestration-output-evaluation-gap https://waxell.ai/blog/multi-agent-orchestration-output-evaluation-gap Thu, 20 Aug 2026 00:00:00 GMT Agent teams hit a 100% ceiling on the task — while their internal state shifted. Why output evals miss orchestration risk, and what to log instead. Logan Kelly https://waxell.ai/blog/kriminal-ai-jailbreak-wrapper https://waxell.ai/blog/kriminal-ai-jailbreak-wrapper Thu, 20 Aug 2026 00:00:00 GMT ThreatDown found 'Kriminal' resells jailbroken Grok and Claude for $12.99/mo. Why model-layer guardrails fail and where enforcement has to live instead. Logan Kelly https://waxell.ai/blog/ai-agent-liability https://waxell.ai/blog/ai-agent-liability Wed, 19 Aug 2026 00:00:00 GMT AI agent liability generally runs to the organisation that deployed it. AB 316, the EU product rules, and the record you need. Logan Kelly https://waxell.ai/blog/a2a-agentic-ai-foundation-agent-identity https://waxell.ai/blog/a2a-agentic-ai-foundation-agent-identity Wed, 19 Aug 2026 00:00:00 GMT Google's A2A protocol joined the Agentic AI Foundation on August 17, 2026. What signed agent cards mean for teams that must govern agent hand-offs. Logan Kelly https://waxell.ai/blog/autonomous-agent-cicd-credential-exfiltration https://waxell.ai/blog/autonomous-agent-cicd-credential-exfiltration Tue, 18 Aug 2026 00:00:00 GMT A Snowflake CI/CD flaw leaked a Jira token to an autonomous agent in 5 days. How to gate the write-path tool calls AI agents make. Logan Kelly https://waxell.ai/blog/exchange-cu1-delay-ai-validation-bottleneck https://waxell.ai/blog/exchange-cu1-delay-ai-validation-bottleneck Mon, 17 Aug 2026 00:00:00 GMT Microsoft delayed Exchange SE CU1 again — AI finds flaws faster than teams fix. Where governance decides what still needs a human. Logan Kelly https://waxell.ai/blog/eu-ai-act-marking-deadline-watermark-provenance https://waxell.ai/blog/eu-ai-act-marking-deadline-watermark-provenance Mon, 17 Aug 2026 00:00:00 GMT Article 50's machine-readable marking duty applies from 2 December 2026. Attacks scrub watermarks for under $50 — record provenance at generation. Logan Kelly https://waxell.ai/blog/openclaw-agent-gym-api-authorization https://waxell.ai/blog/openclaw-agent-gym-api-authorization Fri, 14 Aug 2026 00:00:00 GMT An OpenClaw agent on Claude cancelled a stranger's gym booking via a broken API. Why destructive agent tool calls need a pre-execution gate. Logan Kelly https://waxell.ai/blog/ai-integration-platform-credential-exposure https://waxell.ai/blog/ai-integration-platform-credential-exposure Fri, 14 Aug 2026 00:00:00 GMT Cyera found thousands of exposed AI agent keys; its lab showed what one unlocks. Rotation isn't revocation — how a governed MCP gateway helps. Logan Kelly https://waxell.ai/blog/mcp-server-authentication-optional-by-design https://waxell.ai/blog/mcp-server-authentication-optional-by-design Wed, 12 Aug 2026 00:00:00 GMT 40.55% of live remote MCP servers expose tools with no authentication. Why the spec permits it, and where the control actually belongs. Logan Kelly https://waxell.ai/blog/gpt-5-6-cyber-model-allowlists https://waxell.ai/blog/gpt-5-6-cyber-model-allowlists Wed, 12 Aug 2026 00:00:00 GMT OpenAI's GPT-5.6-Cyber completes 95% of exploit prompts; its base model 1.5%. Model allowlists are now a runtime control; Waxell Observe enforces them. Logan Kelly