Blog / Tags

iam

2 posts — newest first.

• Oct 9, 2026

  Every HTTP Tool You Give an Agent Is an SSRF Primitive

  Zenity's AgentCorruption went from one prompt to every AgentCore agent in a region. Every link was a default. Here's the control that breaks each one.

• Jul 8, 2026

  Your agents need identities, not API keys

  Every AI agent is a non-human identity — most run on shared, long-lived API keys no IAM review sees. Per-agent identity and your credential blast radius.