Cyber Security Guy (@HaroonWMalik) on X

What it is

A thread by Haroon Malik (@HaroonWMalik) that adds Stages 13 to 17 to an AI Security Engineering roadmap, covering what happens after deployment. The thread's premise is that recent agentic intrusions "failed at runtime", not at the prompt. The captured text stops at the start of Stage 1 (OWASP Top 10 for LLMs, STRIDE for AI, the confused deputy problem), so the earlier stages are not visible.

What each stage asks you to build

• Stage 13, runtime detection: Instrument an agent, stream its telemetry to a SIEM, and write detections for unusual tool use and new destinations. Learn OpenTelemetry for agents, tool-call and MCP logging, AI gateway logs and behavioural baselining. The stated reason is that agent logs are self-reported, so independent evidence of what the agent did is needed.
• Stage 14, supply chain: Build a CI gate that scans model artifacts for unsafe formats (pickle, HDF5) and verifies signatures before deployment. Topics also include AI-BOMs, slopsquatting (hallucinated package names) and malicious MCP servers. The thread calls a poisoned model file "RCE with a friendly name".
• Stage 15, infrastructure and containment: Lock down a code-executing agent so it reaches only approved destinations, then try to break out. Topics include exposed model servers and AI workflow tools, LLMjacking (stolen API keys), GPU hijacking and egress control for sandboxes.
• Stage 16, shadow AI: Build a live inventory of every model, agent and MCP server in a lab network, with what each talks to. Discovery draws on network, endpoint and cloud data, and covers non-human identity sprawl.
• Stage 17, incident response: Run a tabletop where an agent goes rogue at 3am, and settle who kills it, how, and what evidence is kept. Topics include machine-speed containment, credential revocation and agent session forensics.

Amendment to Stage 11

An audit log the agent writes about itself proves nothing. Verify it against an independent source. Stage 13 repeats this point.

Caveats

The thread names topics and labs but gives no tools, commands, detection queries or incident references. It says "in recent incidents the signals fired" and nobody connected them, without naming any incident. Use it as a curriculum checklist, not a procedure.