This article discusses how modern languages help developers handle behind-the-scenes file descriptor, kernel memory, and heap management. These three concepts are major bottlenecks for scaling.

So far, we have discussed Caesar cipher, Vigenere cipher, symmetric encryption, AES, convergent encryption, and IV. If all these terms sound familiar to you — great! If not, please go back and read Part 1 and Part 2 first.

Give a language model a chat window, and you have an interface. Give it access to production APIs, identity, business logic, memory, and the authority to execute actions on your behalf, and you have something categorically different: a new kind of software actor, one that can read your data, write to your systems, and make decisions faster than any human reviewer can watch in real time.

This is the reason why this project became necessary. First of all, we completely redesigned the access layer that sits behind all BI tools, Adaptive Planning models, and Snowflake shares used by our FP&A and risk departments. It was done not using any static table with roles, but with the help of tracking constantly changing hierarchies of organizations, cost centers, legal entities, and products that include deal closures and divisions' separations. Let me explain how it was accomplished: first, I will describe the process of keeping hierarchies up-to-date in the ingestion layer; then I will explain the visibility engine and its policies of providing access at a row level. Finally, I will show how to keep access scopes the same in Power BI, Tableau, and Adaptive Planning.

A username and password prove nothing about the machine presenting them. Mutual TLS closes that gap by requiring both sides of a connection to present certificates and prove who they are before a single query runs. 

With agents in the loop, input manipulation becomes especially dangerous. Prompt-injection attacks let adversaries commandeer an AI by feeding it malicious instructions in user inputs or hidden in external data. A carefully crafted prompt or document can cause an agent to reveal secrets or perform harmful actions. These manipulations can be direct (an attacker’s text overriding the agent’s instructions) or indirect (for example, hidden commands embedded in HTML or metadata that the agent ingests). By definition, even inputs imperceptible to humans can subvert the model, forcing it to break safety rules. In effect, prompt injection can trick an AI into disclosing internal prompts, executing arbitrary commands, or making unauthorized changes.

The reflex is to blame the iframe. It's almost never the iframe. It's a response header.

Somebody sets up a cron job. It runs terraform plan against production every few hours. When the plan output isn't empty, it fires a Slack notification. The team calls this "drift detection."

When Guest Access Becomes an Attack Surface

Modern enterprise portals increasingly expose APIs to unauthenticated users. The problem is not necessarily that those APIs are vulnerable. The problem is that the anonymous identity behind them may have been granted more access than the organization realizes.

The answer determines whether the architecture that follows will be auditable or not. Teams that answer it with process — "we have policies about that" — spend the next 18 months patching access-control gaps that reopen every time a new engineer joins or a new service gets wired in. Teams that answer it architecturally spend a week setting up AWS Organizations correctly and then largely stop thinking about it.

To protect fintech REST APIs, implement server-side authorization checks for every object request, validate permissions using the user's authenticated context and resource ownership, and avoid relying on client-supplied IDs alone. Using unpredictable identifiers such as UUID v4 or ULIDs can reduce object enumeration, but they should be treated as an additional security layer—not a replacement for authorization.

Application security testing generally splits into two approaches. SAST (static analysis) scans source code before it ever runs, catching issues while a developer is still in the file, which is why fixes tend to happen fast. You're editing code you just wrote, with full context on what it does and why. DAST (dynamic analysis) works differently. It tests an application while it's running, sending real requests at live endpoints to see what breaks, the same way an attacker would probe it from outside. 

Their compactness, portability, and ability to be easily verified within distributed systems make them popular. A service can accept a token, validate its signature, verify the claims of the token (expiration, audience, subject, and issuer), and determine if the request should be accepted.

In July 2026, the AI Red Team at NVIDIA published findings of a six-month assessment review of enterprise AI agents, ranging from tools for interactive coding to continuously running autonomous assistants. Across every framework and harness, the pattern that emerges is consistently the same — the agents that failed did so for four primary reasons: no access controls on the agent itself, capabilities to execute arbitrary code, no restrictions on outbound networking or segregation, and plaintext secrets available to the agent.

The problem is inherently architectural in nature. Any kind of defense relying on the control plane of the model — for example, constraining the system prompt or having the large language model serve as an adjudicator of the commands issued — inherits the statistical nature of the underlying model. There are three primary methods to bypass these defenses: disguising malicious activities as legitimate ones (e.g., “I’m debugging” or “I’m an admin”); gradual escalation through the dialogue until enough history accumulates to establish the legitimacy of the commands; and embedding code execution in legitimate behavior (e.g., installing a package).

The concept of a data perimeter was popularized by AWS [1] to establish organizational boundaries around identities, resources, and networks. In simple terms, AWS provides access controls to ensure that trusted identities access trusted resources from expected networks while blocking all outside access. 

Part 1 — Five Documents Can Hijack a Frontier Model

Here's a number worth sitting with before anything else in this piece: researchers demonstrated that injecting just five malicious documents into a knowledge base of 2.6 million texts could control a frontier LLM's output 97% of the time. The attacker never touches the model weights. They never see the retriever's code. They just write a document and wait for it to get indexed. That's PoisonedRAG, accepted at USENIX Security 2025, and it's the paper that should have ended the "just add RAG for accuracy" conversation as a purely upside decision (USENIX Security 2025 / arXiv:2402.07867). 

Follow-on research made the picture worse, not better. A January 2026 paper introduced CorruptRAG, which achieves a comparably high attack success rate using a single poisoned document instead of five — a meaningfully more realistic threat model, since most real corpora don't let an attacker casually drop five coordinated files without anyone noticing. Separately, researchers found that poisoning as little as 0.04% of a corpus could push attack success rates above 98%, with system failure in nearly three-quarters of cases (Medium/InstaTunnel, citing 2025–2026 RAG poisoning research). 

I want to start with a question that most engineering teams cannot answer.

Agent skills make AI workflows easier to reuse, share, and improve. A skill is a single, reviewable file with its own declared tool permissions. Instead of explaining the same task every time, you can package the instructions and tools an agent needs into a repeatable workflow. That convenience also creates a security risk. A skill can instruct an agent to read files, run commands, access credentials, or communicate with external services. If the skill comes from an unfamiliar or compromised source, its SKILL.md can contain hidden instructions that steal secrets, mislead users, or perform destructive actions.

However, with the introduction of the Model Context Protocol (MCP), the AI has effectively been given "hands." We are connecting LLMs to our filesystems, our databases, and our command lines so that they can take action on our behalf. This is a new era of technology, but it also comes with a new danger: agentic AI that could unintentionally run system commands, exfiltrate PII, or bring supply chain attacks by using compromised tools. The issue is that our existing monitoring tools are focusing on the wrong layer. Agentic AI security is not about looking at API logs; it is about looking at the kernel. What we need is eBPF.

When it comes to my job, the first thing that comes to many people’s minds is that my work involves masking sensitive data. For example, changing the email address from everett@example.com to bourrasque@example.com. Masking data is indeed important, but before we jump to the masking step, there's one basic question: