Security
Security for AI that reaches production
I build AI systems that put language models in front of real data and real tools, and I own the security of everything I ship. I also advise security leadership on the risks of deploying AI agents against sensitive data.
Security lead
- Name
- Duane Grey
- Title
- Chief Executive Member, 219 East LLC
- Security role
- Security lead, accountable for the LLC's security function
- Team
- One person. I am the security function.
- Scope
- Every application, agent, data pipeline, and hosted service I design, build, or operate through 219 East LLC, for my own practice and for client engagements.
- Security contact
- [email protected]
What my security work covers
The security work follows the surface the software exposes, from agent architecture down to the HTTP layer.
AI agent security architecture
I design agents on the assumption that the model can be manipulated. Trust labels travel with content from its source, untrusted input is handled as data, the agent that plans is separated from the code that acts, and actions influenced by untrusted content need human approval.
Written engineering standards
Every project I build follows a maintained set of security standards: authentication patterns by caller type, authorization enforced in the data layer, credential rotation procedures, security headers, CORS, rate limiting, payload limits, input validation, and audit logging.
Supply chain and dependencies
Vulnerability scanning at the close of each working session, waivers that carry an expiry and a reason, registry signature verification, and a defined wait window that separates runtime security patches from routine upgrades.
Adversarial review and monitoring
I run published attack research against my own agent designs as it appears. Review targets the defect classes ordinary testing does not surface, and agent activity is built to be monitored and audited.
Advisory work for security leadership
In 2026 a Chief Information Security Officer asked me to brief their security organization on the risks of deploying AI agents against sensitive data. I prepared a written security briefing for the CISO's security leads and provided the advisory service to the organization. Client names and details are kept confidential.
The briefing followed the questions a security organization works through as agents move from pilot into regulated environments. It covered seven areas:
- 01
Threat economics
How AI changes the cost of attack and defense, and the questions about authority and data access that follow from it.
- 02
Models on regulated ground
When smaller, locally hosted models fit data that cannot leave the building, and the hardware realities of running them.
- 03
Oversight and monitoring
What current research shows about AI systems monitoring other AI agents, and where that oversight breaks down.
- 04
Off-the-shelf agents and sensitive data
The gap between consumer and enterprise agents, blast radius, and treating prompts with the same discipline as code.
- 05
Building the trust boundary
Content trust labeling, a layered architecture for an agent whose reasoning cannot be trusted, and integrity of the agent's plan.
- 06
Open questions
The risk model for agents that learn and consolidate memory from experience.
- 07
Projects worth building
Candidate security projects for the organization, each paired with the decision gates a security team would apply before approving it.
Published security work
My security research and analysis, public and dated.
Insights
- What is the right architecture when the AI brain itself cannot be trusted?
- Why is authentication not enough to protect AI agents from prompt injection?
- Which prompts should a human review to catch prompt injection?
- What does Anthropic's Zero Trust guide give you for securing AI agents, and what does it leave to you?
- Should an AI agent carry out its own actions?
- Why does code review miss the security defects AI writes?
- Can AI reliably monitor other AI agents?
- What happens when an AI monitor has a relationship with the agent it is watching?
- Which memory design decisions make an AI agent sycophantic?
- What is the difference between consumer and enterprise AI agents?
- Why AI disrupts cybersecurity business models?
Quick takes
- A vision injection attack got past my agent design
- Zero Trust for agents: the design work is still yours
- Skills and rules can be ignored by AI, create a control
- Winning the Patching Arms Race in the Age of AI
- Offense is automated. Patching has to catch up
- Models are escaping their sandboxes
- Defending at machine speed is a leadership call
- AI writes more defects than review can catch
- The senior dev can't gate AI code
- From quarterly pen tests to a persistent AI adversary
- Three AI security warnings in seven months
- The $100k bill from one leaked API key
- Anyone can wear an AI crawler's name
- The plan loop proposes; the execution loop acts
- Humans can't afford to monitor your AI agents
- Agent memory can amplify a user's mistakes
Reporting a security issue
To report a vulnerability in a system I built or operate, or to discuss a security engagement, write to [email protected]. Reports come directly to me.