TRADECRAFT

Field notes, threat reports, and guides from the Cerberus team.

Tradecraft is where we publish what we learn from the inside of API security: how attackers actually work, how detection breaks down in production, and how to build defenses that hold up against agentic AI traffic and MCP tool chains.

• MAY 4, 2026

  Anatomy of a Tool Poisoning Attack: How MCP Servers Get Weaponized

  OWASP ranks Agent Goal Hijacking as the #1 risk in agentic applications for 2026. Tool poisoning is how it happens.