Demystifying Agentic AI

2026-09-24

Demystifying the Agentic Stack Terms to know Build it, break it, buy it ON HARNESS ENGINEERING, ARCHITECTURAL RISK, BASIC AGENT COMPONENTS James King · September 2026 linkedin.com/in/hyggehacker · github.com/HyggeHacker Agent: An actor or a capability on a model loop; a microservice that solves a...

#slide, .zone, .strip, #fs { display: none; } main { display: block; overflow-y: auto; } Demystifying the Agentic Stack Terms to know Build it, break it, buy it ON HARNESS ENGINEERING, ARCHITECTURAL RISK, BASIC AGENT COMPONENTS James King · September 2026 linkedin.com/in/hyggehacker · github.com/HyggeHacker Agent: An actor or a capability on a model loop; a microservice that solves a...

Demystifying the Agentic Stack Terms to know Build it, break it, buy it ON HARNESS ENGINEERING, ARCHITECTURAL RISK, BASIC AGENT COMPONENTS James King · September 2026 linkedin.com/in/hyggehacker · github.com/HyggeHacker Agent: An actor or a capability on a model loop; a microservice that solves a...

the loop, in code ① ① A turn budget is the only thing that stops a runaway. ② ② The model proposes stopping. The harness decides. for call in reply.tool_calls: if not allowed(call): ③ context.append(refusal(call)) continue context.append(run(call)) ④ ③ The gate. Code, not prose. Injection cannot ...

Risk via the lethal trifecta ❶ Sensitive data the agent can read. ❷ Untrusted content the agent can ingest. ❸ An outbound tool that can exfiltrate. All three in one session = end-to-end exploitable. Defense: break one leg per session usually the exfil leg. Willison (Jun 2025); Meta's Rule of Two ...

the harness & its components Everything between you and the model. Where the security work lives. James King · September 2026

James King · September 2026

Subagents One markdown file. Only name and description are required. --name: code-reviewer description: ... model: sonnet effort: high tools: Read, Grep disallowedTools: Write mcpServers: [github] permissionMode: plan maxTurns: 20 skills: [review] memory: project hooks: ... isolation: worktree ba...

Skills Methodology bundles. Procedural knowledge. Progressive disclosure: frontmatter → body → deep load. Loaded on demand when the description matches. A skill can run shell at load and register its own hooks. James King · September 2026 Ps. https://owasp.org/projects/agentic-skillstop-10

Skills: pick, load, run Where they live: a folder with a SKILL.md. How they work: only the description sits in context. What they do: the model picks the skill, and it runs its own script. James King · September 2026

James King · September 2026

Hooks Lifecycle callbacks the harness fires. Four outputs: observe, block, rewrite, inject. Fails open. A hook can now be a model call. Not a security boundary, a layer. Fails open. James King · September 2026

Hooks: the gate The model tries the scan. A PreToolUse hook denies it before it runs. The model is not the control. The gate is. Things hooks can do: James King · September 2026 • Decision (allow / deny, can block the next step) • Observability (log / audit / count, doesn't block, records) • Inte...

James King · September 2026

MCP model context poisoner One wire format. Many external services. Three primitives: tools, resources, prompts. Each server is a separate process; a discrete trust decision. James King · September 2026 Ps. https://arxiv.org/abs/2606.27567 On the Inseparability of Instructions and Data in Shared-...

MCP: Allow Lists • An MCP server locks down its shell tool to a single allowed binary: git. Nothing else can run, seems safe. • Except that binary itself has a built-in escape hatch. Nobody is checked whether the allowlist covers arguments, not just executables… • ALLOW_COMMANDS allowlist as its ...

MCP: Catfishing Allow Lists Can’t use Curl? Use it as an argument for Git. Ah, I’ll block the specific dangerous arguments instead of the whole binary! The denylist trap Did you, though? a denylist of "known dangerous" arguments for a binary as feature-rich as git… James King · September 2026

Some helpful audit/build tooling for MCP • https://github.com/apisec-inc/mcp-audit • https://github.com/modelcontextprotocol/inspector • https://github.com/snyk/agent-scan James King · September 2026

James King · September 2026

Memory poisoning the well Anything the agent wrote down and reads back later as if it were true. Many things write to it. A poisoned prompt is a bad turn. A poisoned memory is every turn after it. Control: gate the write path. James King · September 2026

James King · September 2026

James King · September 2026

Memory • If agents are the new SaaS, memory is the new database. • Anything the agent wrote down and reads back later as if it were true. It re-enters the context as trusted instruction, unmarked. • A poisoned prompt is a bad turn. A poisoned memory is every turn after it, until a human reads the...

James King · September 2026

Plugins Versioned packaging unit. Bundles: Skills, Subagents, Hooks, MCP, Commands, settings.json. One install → all contents. One trust decision covers everything. James King · September 2026

Plugins A delivery mechanism for the components One install, three payloads: instructions, a process on your machine, a server with tools. Skill, hook, and server ship in one click. James King · September 2026

James King · September 2026

Sandboxing Where does it run? Container, microVM, userspace kernel. What may it touch? Files, network, commands, enforced by the kernel on the process itself. Irrevocable from inside. They stack. Most laptops answer neither question. Monday: nono run --allow . -- claude James King · September 2026

James King · September 2026

Building with AI The skill of the future: Identifying Software-shaped problems AUTOMATE same job, same output The Friday Export drop the raw export on a page, get the finished file back in the old format. The Invoice Pile a watched folder reads invoices, flags doubtful values, fills the same spre...

Architecture Decision Records • You can’t review 40,000 lines. You can review the decision behind them. • One markdown file per decision, committed next to the code it governs. • Hand your agent the ADRs before the codebase. They carry the why. • Add an enforced-by field: a hook, test or deny rul...

Threat Modeling • Push it into the pipeline. It is really hard to hand-model at agent-build velocity. • The dangerous part is the composition. And composability is what everyone is chasing. The threats lives in the seams, and in the combination of capabilities. • Threat-model every use case that ...

The Agent Trace • Every agent is a sleeper agent. Prevention blocks what looks wrong. A sleeper does what looks allowed. • A trace answers one question for every action: why did this happen, on whose behalf, and what influenced it? • Intent · identity · provenance · proposal · decision · effect. ...

Outro • Go forth and break a leg (preferably the exfil one). • Agent traces. Need those. All agents are sleeper agents. • If you get one control right, get observation right. • Threat modeling for your AI use cases. James King · September 2026