Amine Raji

I’m Amine Raji, founder of Molntek.com and a specialist in AI security for organizations deploying agentic and LLM-powered systems.

Oct 28, 2026

•

9 min read

LiteLLM's logs held the token that backdoored LiteLLM.

[AI Sec Intel] #33 | An AI gateway logged a GitHub token. The attacker used it to ship a credential stealer to PyPI.

Amine Raji

Oct 17, 2026

•

12 min read

Claude was told five things never to do. It did a sixth.

[AI Sec Intel] #32 | Claude was told never to log in, buy, or create accounts. Nobody said don't submit forms.

Amine Raji

Oct 11, 2026

•

12 min read

The VM held. The agents left through DNS.

[AI Sec Intel] #31 | Agents from three AI labs got out of their test environments this summer. None of them broke the VM.

Amine Raji

Oct 4, 2026

•

11 min read

A human approved a transfer of 20. The framework sent 2,000.

[AI Sec Intel] #30 | The approval screen said 20 units. The agent sent 2,000.

Amine Raji

Sep 27, 2026

•

10 min read

MCP deleted the session, and the session was doing your access checks

[AI Sec Intel] #29 | MCP's new transport removed sessions. Every tool that takes an ID is now an access check you have to write yourself.

Amine Raji

Sep 22, 2026

•

12 min read

A quarter of the talks at AGNTCon +MCPCon Europe were about security. Not one said the fix was a better prompt

[AI Sec Intel] #28 | I counted every talk at AGNTCon + MCPCon Europe: 24 of 91 were security, and every proposed fix was infrastructure.

Amine Raji

Sep 12, 2026

•

7 min read

Read-only holds. Four other things do not.

[AI Sec Intel] #27 | Give an AI agent read access to a Kubernetes fleet and read-only is not the boundary.

Amine Raji

Sep 6, 2026

•

10 min read

The evaluation environment is the least-monitored production system in the chain.

[AI Sec Intel] #26 | 1,200 agents found each other. 700 joined the attack. Nobody told them to.

Amine Raji

Aug 22, 2026

•

8 min read

The best published agent detection rate is 67%. The sensor that buys it reads everything.

[AI Sec Intel] #25| The sensor that buys you that number reads every prompt, every tool argument and every tool result on 7,200 employee laptops. The open-source repo ships no redaction.

Amine Raji

Aug 18, 2026

•

5 min read

An attacker published their agent config. It is your control list, inverted.

[AI Sec Intel] #24| Unit 42 recovered the configuration file. Tenable counted seven incidents. In both, the agents got past their own guardrails by calling the job authorized penetration testing.

Amine Raji

Aug 4, 2026

•

8 min read

Read-only held for the entire intrusion. The agent still walked out with a map of the estate.

[AI Sec Intel] #23 | Anthropic reviewed 141,006 evaluation runs and found three real companies breached. Two of them had no idea until Anthropic called. AWS named read-only as the containment answer the same day.

Amine Raji

Jul 29, 2026

•

6 min read

An attacker ran an agent in YOLO mode against a finance ministry.

[AI Sec Intel] #22 Researchers caught an autonomous agent enumerating a government network mid-operation, because the attacker left its output directory on the internet. Thirty-seven companies formed an alliance. And two package registries decided the best defense is waiting.

Amine Raji

Jul 24, 2026

•

6 min read

OpenAI's model breached Hugging Face to win a benchmark

[AI Sec Intel] #21 It was isolated from the internet except for one package proxy. That was enough. Then the defenders found their own AI wouldn't look at the evidence.

Amine Raji

Jul 17, 2026

•

6 min read

466 million lines reviewed in 20 hours. Both offense and defense just went machine-tempo

[AI Sec Intel] #20 A government ran 50 agents across its whole code estate. Two part-time hackers shipped a profitable hackbot. Agent identity became a product category. The common thread: the credential is the target.

Amine Raji

Jul 13, 2026

•

7 min read

One polite word bypassed the guardrails. The private repos leaked anyway

[AI Sec Intel] #19 GitHub's agentic workflows leaked private repos to anyone who could open an issue. An AI agent ran a ransomware attack nearly end to end. And Kubernetes ops agents went mainstream. One thread ties all three.

Amine Raji

Jul 7, 2026

•

6 min read

On July 28, MCP changes shape

[AI Sec Intel] #18 The new MCP spec goes final July 28 and moves security from the protocol to the endpoint. Plus: new research explains why prompt injection works, and it's not what you think.

Amine Raji

Jul 2, 2026

•

8 min read

Your agents have no idea who they are. Attackers are counting on it.

[AI Sec Intel] #17 Identiverse 2026 named agent identity the defining problem of the year. Step Finance lost $27M because its agents could move money without asking. The fix is testable. Here's the test.

Amine Raji

Jun 29, 2026

•

6 min read

I let an agent rewrite my code while I slept. The scary part wasn't the bill

[AI Sec Intel] #16 OWASP's agentic security report now reads like an incident log, not a threat catalog. The same permission model powering autonomous coding loops is the one attackers exploit.

Amine Raji

AI Security Intelligence — Special Issue

Jun 12, 2026

•

4 min read

AI Security Intelligence — Special Issue

I've been quietly shipping. Six assets are live, they're all free, and most of you have never seen them.

Amine Raji

Jun 9, 2026

•

5 min read

[AI Sec Intel] #15 One character in a header bypasses auth on millions of AI servers.

CVE-2026-48710 turns a malformed Host header into an auth bypass across the production AI stack. Here's how to check if you're exposed in five minutes.

Amine Raji

Jun 4, 2026

•

5 min read

[AI Sec Intel] #14 Your coding agent's approval prompt is lying to you.

SymJack and TrustFall broke every major AI coding agent this month: Claude Code, Cursor, Gemini, Copilot, Codex. The dialog you click through doesn't say what you're approving. Here's what to do.

Amine Raji

May 31, 2026

•

6 min read

[AI Sec Intel] #13 Six governments just told you how to secure AI agents. Here's the part that's actually useful

The progressive-autonomy model, the identity-first mandate, and why a regex blocklist turned an AI agent into a remote shell.

Amine Raji

mcp

May 20, 2026

•

7 min read

[AI Sec Intel] #12 — Claude Mythos, SAFE-MCP, MCPShield: the week the research caught up with the threat

Claude Mythos found thousands of zero-days in 20 hours. Three new MCP research papers landed. And no existing defense covers the full attack surface.

Amine Raji

May 9, 2026

•

6 min read

[AI Sec Intel] #11 — MCP servers just tripled. Here's the full attack map

1,467 exposed servers. 9 of 11 registries poisoned. Memory that spreads across users. The week in MCP security.

Amine Raji

Apr 29, 2026

•

3 min read

[AI Sec Intel] #10 — MCP servers trust every caller by default. Here's the checklist that closes the gap.

New research confirms MCP servers trust every request by default. Here's what to do before it becomes someone else's exploit

Amine Raji