b̷I̶a̸c̷k̶r̷0̴s̸e̷

What claude -p Trusts

Sat, 04 Jul 2026 00:00:00 +0000

When you run an AI coding agent with a human at the keyboard, a trust prompt gates the first run in an unfamiliar repo. When you wire the same agent into CI or an SDK with claude -p, that prompt is gone. Anthropic documents it plainly:

Trust verification is disabled when running non-interactively with the -p flag.

So an operator piping untrusted repositories through a headless agent needs a precise model of what a cloned repo can and cannot influence. I reported two behaviors in this area to Anthropic. Both came back informative. Both rulings are correct. The part worth writing down is why, because the reasoning is the actual security content.

Watching an SSRF Walk Out of the Sandbox

Tue, 30 Jun 2026 00:00:00 +0000

A sandbox is only as strong as the code that runs outside it.

ToolHive runs Model Context Protocol servers for you, each in its own container, behind an egress proxy, with no local credentials. Every MCP server is treated as untrusted, so it stays boxed. That isolation is the product.

But before a remote server reaches its container, ToolHive runs OAuth discovery against it to work out how to authenticate. Discovery runs host-side, in the ToolHive process, outside the per-server sandbox. So the question is whether the untrusted server can influence what the trusted host fetches during discovery. It can. The host follows a chain of the server’s choosing all the way to 169.254.169.254, the cloud instance metadata endpoint, and reads back IAM credentials the sandbox exists to keep out of reach.

CVE-2026-58196: SSRF in ToolHive, host-side and past the sandbox

Fri, 26 Jun 2026 00:00:00 +0000

The target

ToolHive (Stacklok) runs Model Context Protocol servers for you, each one in its own isolated container, behind an egress proxy, with no local credentials handed to it. The security model is explicit in the README: every MCP server is untrusted, so it stays boxed. That promise is the whole point of the tool.

Before a remote MCP server ever reaches its container, ToolHive runs OAuth discovery against it to work out how to authenticate. That discovery runs host-side, in the ToolHive process, outside the per-server sandbox. The question, then, is whether the untrusted server gets to influence what the trusted host fetches during discovery. It does, and that is the finding.

I Built a $7 App in 25 Lines of Bash

Sat, 11 Apr 2026 00:00:00 +0000

The problem

You copy from the terminal. You paste into a doc, a tweet, a Slack message. It looks like garbage - trailing whitespace, phantom indentation, ANSI color codes rendered as [0m gibberish.

Someone built a macOS menu bar app that fixes this. $7.

The fix

#!/bin/bash
# pasteclean - strip terminal formatting garbage from clipboard

text=$(pbpaste)

# Strip ANSI escape codes, trailing whitespace, trailing blank lines
cleaned=$(printf '%s' "$text" | \
 sed $'s/\x1b\\[[0-9;]*[a-zA-Z]//g' | \
 sed 's/[[:space:]]*$//' | \
 perl -0777 -pe 's/\n+\z/\n/')

# Dedent: use most common indent level, only strip spaces
indent=$(printf '%s' "$cleaned" | grep -v '^$' | sed 's/[^ 	].*//' | \
 awk '{ print length }' | sort | uniq -c | sort -rn | head -1 | awk '{ print $2 }')
if [ "${indent:-0}" -gt 0 ] 2>/dev/null; then
 cleaned=$(printf '%s' "$cleaned" | sed "s/^ \{1,$indent\}//")
fi

printf '%s\n' "$cleaned" | pbcopy
echo "Clipboard cleaned"

Save it somewhere in your $PATH, chmod +x it.

Hello, World

Sun, 05 Apr 2026 00:00:00 +0000

init

$ ./blog --init
[*] Boot sequence complete
[*] All systems nominal
[+] Blog online

This is where I’ll be posting about AI security research, adversarial machine learning, CTF writeups, and tools I build along the way.

I work at the intersection of offensive security and machine learning: breaking models to make them harder to break. Currently focused on adversarial robustness of intrusion detection systems and red teaming AI pipelines in industrial environments.

AutoMCP: Elastic Purple Team MCP Server

Sat, 04 Apr 2026 00:00:00 +0000

What it is

AutoMCP is an MCP server built on LangGraph that plugs LLM agents into an Elastic SIEM. It pulls security alerts, triages them, drives response actions, and performs counter-reconnaissance against the source of an attack.

Why it exists

Alert triage is the part of detection engineering that burns analysts out. The interesting question is how far an agent can go past summarizing an alert: pivoting on it, enriching it, and acting on it, while staying inside guardrails a SOC would accept.

About

Mon, 01 Jan 0001 00:00:00 +0000

whoami

Jaafer Rahmani. Security engineer and PhD researcher in adversarial machine learning. I work both sides of AI security: red-teaming ML models, LLM agents, and RAG pipelines, and engineering the ML-driven detection that defends enterprise and industrial networks against a moving target. Ten peer-reviewed papers, a CVE, and a preference for attacks that reproduce.

current

Doctoral research in adversarial ML: evaluating and hardening intrusion detection systems against adaptive evasion
Security analysis of agentic LLM SOC assistants: prompt injection against tool-wielding analysts that act on live OT networks
Engineering AI-supported SIEM for critical infrastructure (IT/OT networks)
Vulnerability research on AI-agent infrastructure (MCP servers, agent runtimes, coding assistants)

arsenal

AI red teaming: evasion, model extraction, data poisoning, prompt injection, robustness evaluation
Security engineering: ML-driven detection, SIEM, IDS (Suricata, Zeek), MITRE ATT&CK mapping
Critical infrastructure: OT/ICS protocols (Modbus, CAN, PROFINET), SCADA, fieldbus security
Vulnerability research: AI-agent infrastructure, MCP servers, exploitation, responsible disclosure

disclosures

[+] CVE-2026-58196 - ToolHive: host-side SSRF bypassing container
 isolation. Fixed in v0.31.0. Advisory GHSA-pr64-jmmf-jp54.

More reports are in vendor queues. They land here when they go public.