Build. Break. Secure. on devanshu.red

Designing AI Agents That Survive Prompt Injection

Sun, 01 Nov 2026 02:35:00 +0530

Every week someone ships an agent that reads your email, your documents or a web page, and can also send things out on your behalf. That combination is the whole problem. The moment an agent reads something an attacker controls, the attacker gets a vote on what the agent does next.

We have a name for this now: the lethal trifecta . Private data, untrusted input, and a way to send data out. Put all three in one agent and a single poisoned email or web page can turn it against you. Simon Willison coined the phrase, and once you see it you cannot unsee it.

Six Layers Between a Container and Your Host

Sun, 01 Nov 2026 02:16:48 +0530

Most of the container write-ups I run into on engagements stop at “it is just a namespaced process,” then jump straight to a breakout one-liner. That gap is where people get surprised, because the one-liner only works because one specific layer, out of six, was left open. Before I write the next post in this series on abusing a CI/CD runner, I want the mechanism on the table: what actually stands between a container and the host it runs on, and how to check each layer yourself instead of taking my word for it.

EKS Authentication Mechanisms - IRSA vs Pod Identity from an Attacker's Lens

Sun, 01 Nov 2026 00:25:07 +0530

Originally published on Medium in January 2026. Updated November 2026.

Imagine conducting a red team assessment for a client and you stumble into their EKS cluster through a misconfigured service. Now, what can you do from here?
This is exactly what got me thinking: most people understand EKS internals and underlying authentication mechanisms from a DevOps perspective, but what do they look like through an attacker’s eyes? This post is a part of my “Breaking Kubernetes” series, where I will walk through various attack vectors I’ve encountered in real engagements. Today, we’re starting with the fundamentals for EKS workload Identities - understanding how IRSA and Pod Identity actually work before we start breaking them.

Token Theft and Abuse - Compromising IRSA and Pod Identity Authentication

Sun, 01 Nov 2026 00:53:24 +0530

Originally published on Medium in January 2026. Updated November 2026 with corrected defenses and detections.

You’ve compromised a pod in an EKS cluster through a command injection vulnerability. The web application gave you a shell inside the container, but the real question is: what can you do from here? Most attackers would celebrate and move on to privilege escalation, but the real treasure is sitting right there in the filesystem: authentication tokens that could give you access to the entire AWS infrastructure.

Devanshu

Mon, 01 Jan 0001 00:00:00 +0000

Security Engineer focused on cloud-native and AI security. My work involves red team engagements across AWS and Azure, and building tools to automate offensive testing. This blog is where I write up what I learn: how containers, Kubernetes, and cloud identity get compromised in practice, and the controls and detections that prevent it. I’m also exploring AI security, especially how to safely run and contain code written by AI agents. Most posts cover both sides, the attack path and the defense, because that’s how I think about security work.