Facio Blog

Practical notes on human-reviewed AI agents.

Payload-powered product notes, security writing, HITL patterns, and operational guidance from the Facio runtime: long sessions, Placet approvals, audit trails, memory, providers, channels, tools, and Docker-first operations.

Clear

Showing 26-30 of 44 articles in Security.

Security

The Sentence That Stole an npm Token: How AI Agents Became the Third Class of Lateral Movement

Jun 7, 2026Security

The Sentence That Stole an npm Token: How AI Agents Became the Third Class of Lateral Movement

A single GitHub issue title — just a sentence — compromised a CI/CD pipeline and published a poisoned npm package. No network intrusion. No credential theft. Just an AI agent bridging an untrusted comment field and a privileged software supply chain. Welcome to agent-mediated lateral movement.

Security

674 Attacks in 3 Hours: How AI Red Teaming Agents Are Rewriting the Security Playbook

Jun 6, 2026Security

674 Attacks in 3 Hours: How AI Red Teaming Agents Are Rewriting the Security Playbook

A single operator just ran 674 adversarial attacks against Llama Scout in three hours with an 85% success rate — using an AI red teaming agent. Traditional pentesting and manual red teams can't match this velocity. Here's what the shift to agent-orchestrated adversarial testing means for enterprise security programs.

Security

The NSA Just Published MCP Security Guidance: What the Five-Layer Threat Model Means for Your Agents

Jun 5, 2026Security

The NSA Just Published MCP Security Guidance: What the Five-Layer Threat Model Means for Your Agents

The Model Context Protocol is now critical infrastructure — confirmed by the NSA's formal Cybersecurity Information Sheet. From transport-layer interception to context poisoning to supply chain threats, every MCP deployment faces a five-layer attack surface that traditional API security doesn't cover.

Security

Your AI Agent Audit Trail Is Probably a Filing Cabinet: What Compliance Actually Requires

Jun 3, 2026Security

Your AI Agent Audit Trail Is Probably a Filing Cabinet: What Compliance Actually Requires

88% of enterprises had AI agent incidents — but only 21% have runtime visibility and 33% have no audit trail at all. Operational logs are not audit logs. WORM storage, cryptographic chaining, and the five mandatory elements every compliance-grade agent audit trail needs before the EU AI Act deadline.