The latest briefing
All insights
Nobody Meant to Breach WorkOS. The Agent Did It Anyway.
A researcher's AI agent spent five days inside a vendor's internal tool with no attacker and no motive. It marks the end of threat modeling built on intent, and every leader approving agents should plan for it.
More insights
The Red Queen Acceleration Gap
AI, Quantum, and the New Cybersecurity Adaptation Race
Eight questions about the agents you run and the doors you left open.
Eight cards, eight doors you might have left open. In Wonderland, the Queen of Hearts' gardeners painted white roses red to hide a mistake. It did not end well for the gardeners. Answer honestly.
"Off with their heads!"
The Queen of Hearts, in Lewis Carroll's Alice's Adventures in Wonderland (1865)
Educational self-assessment. It is not a security scan, an audit or a certification. Your answers stay in this browser. Based on Maria How's recommendations in Nobody Meant to Breach WorkOS. The Agent Did It Anyway..
- Card 1 of 8
Is each agent's scope enforced outside the agent?
Find where scope is enforced. If the allowed targets, tools and data live only in a prompt or a config file the agent itself reads, that is a suggestion. Put the limit in the network, the identity provider or the tool gateway.
- Card 2 of 8
Is outbound traffic default-deny for anything that can act on its own?
Default-deny outbound traffic for anything that can act on its own, enforced somewhere the agent cannot change.
- Card 3 of 8
Is there a named human who can stop a run, and has the stop been tested?
Name the human who can stop a run, and test that the stop works.
- Card 4 of 8
Do you log what each agent was asked to do beside what it did?
Log what the agent was asked to do beside what it did, so a divergence shows up in minutes.
- Card 5 of 8
Do you have a current list of internal tools reachable from the internet?
Pull the list of internal tools reachable from outside. Yes, that list.
- Card 6 of 8
Have you hunted for development credentials in production?
Hunt for development credentials in production and block weak or development-only secrets from being deployed.
- Card 7 of 8
Are bulk reads rate-limited, with an alert on volume?
Rate-limit bulk reads and alert on volume.
- Card 8 of 8
Could you validate a researcher's claim that their agent had been in your systems?
Decide what you would do if a researcher called to say their agent had been in your systems, and check your logs could confirm or refute it.
Close the open doors faster
The AI Agent Security Decision Kit turns these moves into an agent inventory, a permissions review and a 30-day plan you can actually run.
Bring the Queen to your team: ask about a private briefing
Prefer the long game? Read the book, Red Queen Cipher (opens Amazon in a new tab)
Pick a square
All topicsThe toolkit
Full detailsFree insight tells you what matters. The kit saves you the blank page.
AI Agent Security Decision Kit
A documented view of which agents you run, what each one is allowed to touch, who can stop it, and what you will do in the next 30 days.
- Editable AI-use inventory
- Permissions review
- Vendor questions
- Escalation worksheet
- and 3 more pieces
Private Team Briefing
A leadership or security team with one decision to make.
- 60-minute session on one agreed topic
- A short deck tailored to your team
- A one-page decision and action summary
The book
Red Queen Cipher
Winning the Eternal Arms Race in Quantum AI Security
Written by Maria How as Maria Singh
The briefings here deal with this week's move. The book takes the long view: the eternal arms race in quantum AI security, in one place, from the same Red Queen.
Kindle eBook, available now on Amazon.
Meet Maria
Maria How writes Red Queen Signals, a LinkedIn newsletter on cybersecurity and AI, under the Red Queen Cipher brand.
"Now, here, you see, it takes all the running you can do, to keep in the same place."
The Red Queen, in Lewis Carroll's Through the Looking-Glass
Security works the same way. Attackers, tools and now agents keep moving, so standing still is falling behind. Red Queen Cipher is where the running gets explained.