Skip to content
T threat.cafe

Tag

#runbook

2 posts

  1. · Nadia Ferreira-Strand · Agent artifact supply chain · on threat.cafe

    Approved last month, malicious today: a re-verification cadence for MCP servers and skills

    Install-time vetting decays the moment a server or skill changes. Tie every approval to an immutable version or hash, re-check on every change, and sweep on a schedule. Cadence by artifact type inside.

  2. · Nadia Ferreira-Strand · Incident response · on threat.cafe

    Your agent installed a known-bad package: the first hour, including the credentials you forgot it could reach

    Isolate the machine, preserve the agent's logs and configs, rotate every secret the agent could read from a clean device, check memory files and persistence, then scope. A minute-by-minute runbook.