Year
- 2026
Category
- Incident
- Insights
- Product
- Testimonial
- Engineering
Tag| Execution control
- AI governance
- Approvals
- Audit
- Compliance
- Execution control
- Identity security
- MCP
- Privileged access
- Work Sessions
- Zero standing privilege
The AlpacaX blog—security, product thinking, and what we're learning as we build AI agent execution control.
Incident
Inside the AI agent mass exploitation of PaperCut NG/MF
395 organizations breached by parallel AI agents—the eleventh, not the first, fell in 26 seconds.
Incident
Two CrowdStrike failures, one kernel-mode security risk
CrowdStrike patched a privilege-escalation bug in 12 days. The lesson is where the privilege lived.
Incident
MCP security can't stop at the install review
It passed two clean tool calls, then turned malicious on the third—no one-time review catches that.
Insights
What AI agent access control actually has to check
A support bot's admin tools got exploited—not by tricking the model, but by exploiting the access model.
Insights
Stay on Supabase and Vercel, or run your own servers?
Cost makes you look. Ownership makes you consider moving. What usually stops you is the same thing: no one owns infrastructure. That is starting to change.
Incident
Inside JadePuffer, the first documented AI agent ransomware attack
A human picked the target. Everything after that was the agent's own call—twice, three weeks apart.
Testimonial
How BNOW fixes production without a DevOps team
BNOW has no one dedicated to DevOps. Now it hands production work to an AI agent and fixes problems itself.
Insights
MCP least privilege has two layers, not one
Which tools a client registers and what judges the commands they run are two different controls.
Insights
A token that can reach your API isn't cleared to run any command
A token has no session and no declared purpose. It has a scope, and a scope can't tell you a command is safe.
Insights
AI agent governance means more than access control
Most AI-native PAM covers who gets access. Governance also has to judge what happens next.
Product
Product update: what gets decided before a command runs
Choose how far commands are gated, confirm the server account during approval, and give automation credentials of its own.
Insights
Why AI governance pilots don't survive scale
The policy wasn't wrong. It just wasn't sized for agents your other teams stood up without telling you.
Insights
Out-of-band approval: why an agent's own channel can never be the one that approves
An AI agent that can approve a review on its own execution channel isn't gated at all. Why out-of-band approval separates the channel, not the person.
Engineering
Kubernetes access control governs access, not commands
Access control checks whether you can reach a Kubernetes pod. It doesn't check whether the kubectl command you type should run.
Engineering
Session-scoped sudo: bind OS-level root to a session, not a sudoers file
A sudoers rule only asks who's allowed to run a command. Sudo reaching Alpacon's command API asks a second question: is this command dangerous.
Incident
Two 2026 CVEs turned security tools into the attack path
Microsoft Defender and Check Point SmartConsole both became attack paths in 2026, and one patch fell to a bypass a month later.
Engineering
Command filtering fails two ways: GTFOBins, and a shell that rewrites what you matched
Measured across 1,709 real-world denylists, most don't fully block what they were written to block.
Insights
AI agent execution control: what it is, and why AI-native PAM needs it
Every agent constraint is either declared or enforced. Execution control is the enforced kind.
Insights
AI vendor risk assessment in 2026: the runtime questions your questionnaire is missing
Your questionnaire covers who the vendor is and how they store data. It says nothing about what their agent executes on your servers once you authorize it.
Incident
Alignment isn't enough: containing a misaligned agent's actions takes runtime execution control
Model-level alignment lowers the odds an agent misbehaves. It can't drive the odds to zero once the agent is running on real infrastructure.
Insights
AI governance on paper vs. governance during the task
A near-miss doesn't change your policy. It changes the question leadership asks about it.
Incident
LegacyHive: a Windows zero-day you can't patch your way out of
No CVE, no vendor patch, and it works on fully-patched machines. When patch-and-wait isn't a control, what's left is the layer that governs privileged actions as they run.
Insights
AutoJack: one webpage, one MCP socket, host-level access
Microsoft disclosed a three-stage exploit chain in AutoGen Studio that turns an AI browsing session into a remote code execution primitive. No single patch makes the underlying problem go away.
Incident
The gate worked. The database was still dumped.
Sysdig documented the first in-the-wild LLM agent intrusion: four pivots, every access gate cleared, database exfiltrated. The layer neither covers.