Year
- 2026
Category
- Insights
- Engineering
- Incident
- Product
Tag
- Vendor risk
- AI agents
- Security compliance
- Execution control
- Procurement
- AI-native PAM
- ISO 42001
- Compliance
- Audit
- AI governance
- Checklist
- Zero standing privilege
- Work Session
- Privileged access
- EU AI Act
- Agentic misalignment
- AI safety
- Incident analysis
- Policy
- Human-in-the-loop
- Product update
- Approvals
- MCP
- Slack
- Account security
- Kill chain
- Lateral movement
- Security
- Zero-day
- Windows
- RCE
- Security architecture
- AutoGen
- Security accountability
- Forensics
- JIT access
- Session intent
- Bounded autonomy
- Attack surface
- Non-human identity
- PAM
- Product
- Alpacon
The AlpacaX blog—security, product thinking, and what we're learning as we build AI agent execution control.
Insights
AI vendor risk assessment in 2026: the runtime questions your questionnaire is missing
Your questionnaire covers who the vendor is and how they store data. It says nothing about what their agent executes on your servers once you authorize it.
Insights
ISO 42001 Stage 1 checklist: the documentation to have ready before your audit
Stage 1 is a documentation and readiness review—the part of ISO 42001 you can actually prepare for in advance. Here's what an auditor expects on the table before Stage 2.
Engineering
Zero standing privilege by design: make it a property of the session, not the token
Most vendors make the credential ephemeral. We make the privilege itself session-bounded—so standing privilege can't accumulate, even while a session is live.
Insights
ISO 42001 audit checklist: the controls a policy document can't satisfy
You can pass Stage 1 on paperwork. Stage 2 asks what your AI agents actually did in production—and three Annex A controls decide whether you have the answer.
Incident
Alignment isn't enough: containing a misaligned agent's actions takes runtime execution control
Model-level alignment lowers the odds an agent misbehaves. It can't drive the odds to zero once the agent is running on real infrastructure.
Insights
AI governance on paper vs. governance during the task
A near-miss doesn't change your policy. It changes the question leadership asks about it.
Product
Product update: the judgment behind every approval
See the reasoning behind each approval request, without bringing agent runs to a halt.
Incident
An autonomous AI agent breached Hugging Face—here's the kill chain, and where execution control bounds it
An autonomous AI agent ran a real end-to-end intrusion on Hugging Face's production infrastructure. Here is the kill chain, and an honest map of where a runtime execution-control layer bounds it.
Incident
LegacyHive: a Windows zero-day you can't patch your way out of
No CVE, no vendor patch, and it works on fully-patched machines. When patch-and-wait isn't a control, what's left is the layer that governs privileged actions as they run.
Insights
AutoJack: one webpage, one MCP socket, host-level access
Microsoft disclosed a three-stage exploit chain in AutoGen Studio that turns an AI browsing session into a remote code execution primitive. No single patch makes the underlying problem go away.
Insights
A command log won't tell you what your agent actually did.
A command log tells you what ran. An audit has to answer who, why, and with whose approval—for humans and agents alike.
Insights
JIT access control is for humans. What should we have for AI agents?
Just-in-time access governs whether an agent gets in, and when. It says nothing about what the agent does once inside.
Insights
Adding AI agents shouldn't mean adding more security exposure
Expanding your attack surface isn't the price of an AI agent. It's an artifact of how you wire it in—and it's avoidable.
Incident
The gate worked. The database was still dumped.
Sysdig documented the first in-the-wild LLM agent intrusion: four pivots, every access gate cleared, database exfiltrated. The layer neither covers.
Product
Work Sessions: the audit unit your CISO actually needs
Alpacon's Work Sessions turn fragmented audit timelines into one object—declared intent, approval gate, session-scoped sudo, unified record.
