Security

Last week I’ve been struggling with some kind of illness. My throat was dry and I couldn’t breathe on Friday, so I took a course of pseudoephedrine medication, bought some strepsils, and a nasal spray just to manage it. I was sick the whole weekend and started to recover just in time for Monday! Being an adult is awesome…. Now those of you who are a little too keen for our robot overlords to consume us might point out that agents don’t get sick, but they can be subject to a wide variety of vulnerabilities. Not the greatest segway into this weeks article, but I couldn’t think of anything else. ...

Last week I talked at NDC Oslo about the OWASP Top 10 for Agents where I showed folks the different ways that agents can be exploited. If you’ve turned the news on recently, you’ve probably heard about AI will kill us all and how we’re all doomed. Call me optimistic, but I think we’re currently in the middle of a hype cycle where AI labs are overstating the abilities of the models, and we’re at a point where we’ve seen how powerful agents can be, but we need to be more serious about the harms agents can do, and how we can mitigate those risks. ...

When building an MCP server for my side project (Biotrackr), one of the first things I had to think about was how to manage secrets. The MCP server needs an APIM subscription key to call downstream health data APIs, and it also exposes an API key for clients connecting to it. That’s two secrets that need to be stored, distributed, and protected and if either one leaks, the blast radius could extend across the entire platform. ...

The OWASP Top 10 for Agentic Applications (2026) identifies the most critical security risks facing AI agents. From prompt injection and tool misuse to identity abuse and cascading failures. The guidance is thorough, but what does it actually look like to implement these controls in a .NET agent? This series answers that question by walking through every applicable control from the OWASP Agentic Top 10, showing how each was implemented in Biotrackr, my personal health data tracker with a Claude-powered chat agent built on Microsoft Agent Framework, .NET 10, and Azure. ...

Your AI agent depends on a chain of services. In my side project (Biotrackr), the chain looks like this: Claude API for reasoning, APIM for routing, downstream APIs for health data, and Cosmos DB for chat history. When one link in that chain fails, things can get ugly fast. Imagine this: Claude API returns a 429 (rate limited). The agent retries the same request. Each retry consumes more tokens. More 429s. The conversation times out. The user sees an error and submits again, doubling the load. A single rate limit hit has cascaded into a degraded experience, wasted tokens, and a frustrated user (in my case, just me screaming at my own agent 😅 For you however, that would be your customers!). ...