Appsec adventures

Wanaku is an open-source router that standardizes how AI applications connect to tools and data using the Model Context Protocol (MCP). It provides unified access, acts as a bridge between MCP servers, and leverages 400+ Apache Camel components for extensive integrations. Designed for Kubernetes, it offers built-in security, multi-namespace support, and extensible architecture for enterprise-grade AI agent deployments.  https://github.com/wanaku-ai/wanaku

The article explains the confused deputy problem in cloud environments, where a trusted service account can be misused to perform unauthorized actions. It presents two key mitigations: restricting service account trust relationships through least privilege and enforcing contextual authorization checks to ensure delegated access is used only by the intended caller, resource, and workflow. The main takeaway is that valid identities are not enough; cloud IAM must verify who is acting, on whose behalf, and under what conditions.  https://kattraxler.cloud/the-two-mitigations-for-the-service-account-confused-deputy-in-the-cloud

Vectra analyzes the security risks of Azure platform-level managed identities, highlighting how hidden or privileged service identities used by cloud providers can become potential attack paths if misunderstood or improperly governed. The article presents a threat model for these identities, emphasizing the need for visibility into cloud control-plane operations, least-privilege design, identity monitoring, and stronger understanding of implicit trust relationships in cloud environments. https://www.vectra.ai/blog/azures-hidden-operators-a-threat-model-for-platform-level-managed-identities

GEICO explores the evolution toward an agentic software development lifecycle, where AI agents assist across planning, coding, testing, security, and deployment activities. The article discusses how autonomous agents can improve developer productivity and automate repetitive tasks, while highlighting the need for strong governance, security controls, human oversight, and new engineering practices to manage risks introduced by AI-driven development workflows.   https://www.geico.com/techblog/the-agentic-sdlc/

The article explores security risks in API connections between applications and third-party services, focusing on how integrations can expand attack surfaces through excessive permissions, weak authentication, and poor access controls. It highlights the importance of managing API credentials, limiting privileges, monitoring integrations, and treating connected services as part of the overall security boundary.  https://binarysecurity.no/posts/2025/03/api-connections

AWS introduces capabilities in AWS WAF Bot Control to help organizations identify and authenticate legitimate AI agent traffic while distinguishing it from malicious automation. The solution enables better visibility and control over AI-driven requests, helping protect applications from unwanted bots while allowing trusted AI agents to access services securely through verified identities and traffic analysis.  https://aws.amazon.com/pt/blogs/security/authenticate-legitimate-ai-agent-traffic-with-aws-waf-bot-control