Year
- 2026
Category
- Insights
- Product
- Incident
- Testimonial
- Engineering
Tag| MCP
- AI governance
- Approvals
- Audit
- Compliance
- Execution control
- Identity security
- MCP
- Privileged access
- Work Sessions
- Zero standing privilege
The AlpacaX blog—security, product thinking, and what we're learning as we build AI agent execution control.
Incident
MCP security can't stop at the install review
It passed two clean tool calls, then turned malicious on the third—no one-time review catches that.
Jungyeon LeeContent Marketer · October 7, 2026
Insights
What AI agent access control actually has to check
A support bot's admin tools got exploited—not by tricking the model, but by exploiting the access model.
Marco KwakHead of GTM · October 6, 2026
Insights
MCP least privilege has two layers, not one
Which tools a client registers and what judges the commands they run are two different controls.
Jungyeon LeeContent Marketer · September 22, 2026
Insights
AI agent execution control: what it is, and why AI-native PAM needs it
Every agent constraint is either declared or enforced. Execution control is the enforced kind.
Eunyoung JeongFounder & CEO · August 18, 2026
Product
Product update: the judgment behind every approval
See the reasoning behind each approval request, without bringing agent runs to a halt.
Taeyeong BaekGTM Associate · August 11, 2026
Insights
AutoJack: one webpage, one MCP socket, host-level access
Microsoft disclosed a three-stage exploit chain in AutoGen Studio that turns an AI browsing session into a remote code execution primitive. No single patch makes the underlying problem go away.
Jungyeon LeeContent Marketer · July 28, 2026