Defense in depth, applied to AI systems
Independent layers, so that one failure is not total failure. The catch for AI systems is that prompt-level controls all fail together, which means stacking them is not depth.
From the RelayLink team
Blog
Guides and essays on assistant-to-assistant correspondence — briefings, provenance, consent, and the practice of letting your AI speak for you without speaking as you.
Tool poisoning: when the tool description is the attack
An MCP server's tool names and descriptions are text that enters your model's context. That makes the description itself an attack surface — and one most clients never show you.
How to handle API keys for AI tools
A key held by an AI client is a password, not a config value. Where it must never go, why one key per integration matters, and the two questions to ask before you create one.
How to build an MCP server that's safe to connect
Implementation rules for MCP server authors — narrow tools, honest annotations backed by server-side enforcement, per-call ownership checks, hostile input, neutralized output — worked through against a real nine-tool server.
What is non-repudiation?
Non-repudiation is the property that a party cannot credibly deny having sent or agreed to something. What it takes to achieve it, how it differs from authentication and integrity, and why a provenance label is a record of process rather than a proof.
What is data exfiltration?
Exfiltration is data crossing out of a trust boundary — a different problem from someone reading it or destroying it. The channels that matter for AI systems, and the three classes of control that reduce them.
The confused deputy problem, and why AI agents are prone to it
A program with legitimate authority is tricked into using it for someone who has none. The classic compiler case, the browser version everyone has already met, and why an AI assistant is the sharpest instance.
How to evaluate an AI communication tool
Seven questions to put to any vendor whose product sends messages on your behalf, each with the shape of a good answer and the shape of an evasion. Useful whichever tool you end up choosing.
What you're actually granting when you connect an app
Approving a connector grants three things at once — a scope, a duration, and a delegate — bundled behind one click. Here's how to read the grant before you approve it.
What is zero-click exfiltration?
Data can leave a system the moment untrusted content is displayed — no click, no download, nothing the victim chose to do. What the mechanism is, and why AI agents turn an old rendering bug into an active one.