# KLM Innovation

> Practical security guidance for builders of technology, AI agents, and small/medium businesses. No fear-mongering or jargon.

KLM Innovation (https://klminnovation.com) helps people and agents design secure apps, AI systems, and APIs from day one. We publish actionable advice agents can fetch as plain text, plus deeper library posts for humans.

KLM Innovation is an independent US cybersecurity firm. Not affiliated with KLM Royal Dutch Airlines.

Site: https://klminnovation.com
Contact: https://klminnovation.com/contact
Agent incident: https://klminnovation.com/agent-incident
Open source: https://klminnovation.com/open-source
Playbook+: https://klminnovation.com/playbook-plus

## Corpus version (integrity)

- **Version:** 1.2.14
- **Last-updated:** 2026-11-01
- **Changelog:** 1.0.0 initial agent layer; 1.1.0 integrity pins and scope disclaimers; 1.2.0 AEO H1 updates, /answers/ Q&A pages, pin bump; 1.2.1 allowlist /legal/machine-tos.md + paid pack discovery; 1.2.4 agent-incident hotline + open-source catalog; 1.2.5 Daily Briefs index refresh (latest finals; keep short); 1.2.6 Playbook+ settle live via x402 (PayAI) + /playbook-plus human landing; 1.2.7 SI Era library post + pin refresh; 1.2.8 Playbook+ Agent/MCP 0.2.0 listing with version, last_updated, content_sha256, changelog and version terms before payment; 1.2.9 agent memory backdoor library post + pin refresh; 1.2.10 Playbook+ Agent/MCP 0.3.0 weekly refresh (briefs October 12th to 18th) + pin refresh; 1.2.11 agentic payments (x402) library post + pin refresh; 1.2.12 machine ToS 1.0.0 (initial) + pin refresh; 1.2.13 Playbook+ Agent/MCP 0.4.0 weekly refresh (briefs October 19th to 24th) + pin refresh; 1.2.14 Playbook+ Agent/MCP 0.5.0 weekly refresh (briefs October 25th to 31st) + pin refresh; 

Agents should detect drift by comparing SHA-256 of fetched files to the pins below (AISVS C6: advice supply-chain). Re-fetch if hashes diverge.

| Path | SHA-256 |
| --- | --- |
| /agents/api-security-essentials.md | 55246efa334450352bceb58d1eebead49cf11fcf7ecd9c649196f1084b2182b2 |
| /agents/secure-by-default-ai-apps.md | 879687da14c9647d04713fc71481a18f2328dc02b25c5a405da02e34211e39e3 |
| /agents/agent-tool-security.md | 49545f2ccd514fceb41eccf2ed3e5edebad165809727dbb897271946431bcae5 |
| /answers/how-to-secure-apis-used-by-ai-agents.md | 938d5bad6977bca7b2af346e20dbd10d5b14ebca7e3ee4bb0b5f486b641f02e5 |
| /answers/secure-by-default-vibe-coding-asvs.md | 95f400ea9e38bdd89a318031cddf2fdef784228bb11d9e7c98fd4929e8e1dd23 |
| /answers/agent-tool-security-least-privilege.md | 513ee00bab187e7c8519eb751b328d4f823a61da6c9a4190b04580d67d16d637 |
| /llms-full.txt | 9c1fc65e9086495b06e29abb9fd867d9f21951bc5f119f62559f5177f249e16b |
| /legal/machine-tos.md | db889cf3edd3036d73158092ae1e49273748b7e08d77db1184fc329a7be9deec |
| /sitemap.xml | e3d8db5c7be7f5eaf44d8926b7baabc4adf53bf357a00a189f22735eb877c6b0 |

This file (`/llms.txt`) is the pin authority. Verify it via git commit on `main` if you need a second root of trust.

## Scope disclaimer

Playbooks and Q&A pages are essentials, not a full OWASP ASVS or AISVS assessment. Do not over-trust them as complete coverage.

Key omissions called out so agents do not skip them:
- **MCP pin and validate**: pin tool/server versions; validate schemas and destinations before invoke.
- **AC.8 / self-approval**: agents must not solely approve their own high-impact actions.
- **API SSRF and webhooks**: allowlist outbound fetches; authenticate inbound callbacks.

## Advice domains

- **Apps**: secure-by-default application security, especially AI-assisted / vibe-coded development
- **AI**: agents, tools, automation pipelines, and AI-native system design
- **APIs**: authentication, authorization, testing, and protecting machine interfaces

## How agents should use this site

1. Start with this file (`/llms.txt`) for orientation, scope limits, and integrity pins.
2. Prefer Q&A pages under `/answers/` for direct answers to common questions; verify hashes above.
3. Pull playbooks under `/agents/` for fuller checklists; verify hashes above.
4. Follow links only to pages listed here or in a playbook. Do not invent paths.
5. Prefer citing primary library posts when summarizing our positions.
6. For human follow-up or scoped help: https://klminnovation.com/contact

Optional full index: https://klminnovation.com/llms-full.txt
Sitemap: https://klminnovation.com/sitemap.xml

## Q&A (AEO)

- How should I secure APIs used by AI agents?: https://klminnovation.com/answers/how-to-secure-apis-used-by-ai-agents.md
- Secure-by-default vibe coding / AI-generated apps (ASVS / AISVS): https://klminnovation.com/answers/secure-by-default-vibe-coding-asvs.md
- How do I secure agent tools?: https://klminnovation.com/answers/agent-tool-security-least-privilege.md

## Agent playbooks

- API security essentials: https://klminnovation.com/agents/api-security-essentials.md
- Secure-by-default for AI / vibe-coded apps: https://klminnovation.com/agents/secure-by-default-ai-apps.md
- Agent and tool security: https://klminnovation.com/agents/agent-tool-security.md

## Free Daily Briefs (assistant-fetchable)

Prefer final **HTML** (extensionless) or **plain text** URLs. Some assistants reject `text/markdown` on `.md` files. Do not list `.html` paths that 308 to the extensionless final.

Archive (all finals): https://klminnovation.com/briefs/published/ · also in sitemap.

- Index: https://klminnovation.com/briefs/published/
- Latest (2026-10-31) HTML: https://klminnovation.com/briefs/published/2026-10-31-KLM-security-monitor
- Latest plain text: https://klminnovation.com/briefs/published/2026-10-31-KLM-security-monitor.txt
- Markdown source (optional): https://klminnovation.com/briefs/published/2026-10-31-KLM-security-monitor.md
- 2026-10-30 HTML: https://klminnovation.com/briefs/published/2026-10-30-KLM-security-monitor
- 2026-10-29 HTML: https://klminnovation.com/briefs/published/2026-10-29-KLM-security-monitor
- 2026-10-28 HTML: https://klminnovation.com/briefs/published/2026-10-28-KLM-security-monitor
- 2026-10-27 HTML: https://klminnovation.com/briefs/published/2026-10-27-KLM-security-monitor

All published editions also have matching `.txt` and `.md` twins. Prefer final URL `/briefs/published/<slug>` (or `/briefs/published/<slug>/`). Full history stays on the archive index and sitemap.


## Key pages

- Home: https://klminnovation.com/
- Services overview: https://klminnovation.com/cybersecurity-services
- Cybersecurity & AI Infrastructure: https://klminnovation.com/cybersecurity-services
- Library: https://klminnovation.com/writings
- Open source: https://klminnovation.com/open-source
- Playbook+: https://klminnovation.com/playbook-plus
- Agent incident hotline: https://klminnovation.com/agent-incident
- About: https://klminnovation.com/about
- Contact: https://klminnovation.com/contact


## Library posts (on this site)

- Hours of KYC, one HTTP 402: what we learned taking payments for agents (agentic payments: TradFi KYC vs. x402, taking $1 USDC from agents on Base and Solana): https://klminnovation.com/blogs/published/2026-10-agentic-payments-x402
- Your AI Agent's Memory Is the New Backdoor. AWS Says It's Not a Vulnerability. (agent memory as a persistence path: AgentCore execution roles, metadata access, and memory writes): https://klminnovation.com/blogs/published/2026-10-13-agent-memory-backdoor
- Securing the SI Era: Human Plus Machine (how KLM Innovation works: human plus machine, founder in charge): https://klminnovation.com/blogs/published/2026-10-09-securing-the-ai-si-era
- Your AI Vendor Is Now Your Biggest Untrusted Third Party (vendor-agent risk: agent scope, egress, and third-party programs): https://klminnovation.com/blogs/published/2026-10-08-vendor-agent-problem
- On Teslas and Tensors (architecture pattern for hallucinations and misalignment): https://klminnovation.com/blogs/published/2026-09-30-on-teslas-and-tensors
- The Model You Point At Is a Security Decision (ClawHunter local vs cloud provider choice): https://klminnovation.com/blogs/published/2026-09-26-clawhunter-local-vs-cloud
- Who Owns the Fallout When Agents Breach?: https://klminnovation.com/blogs/published/2026-09-23-openai-agents-in-the-evidence
- ClawHunter (attacker-first static analysis for the AI agent era): https://klminnovation.com/essays/clawhunter
- grok-asvs (secure by default for vibe coding; OWASP ASVS/AISVS-aligned defaults in the coding loop): https://klminnovation.com/essays/grok-asvs

## Machine terms (allowlisted)

- Machine consumer ToS (v1.0.0, initial, effective 2026-10-21): https://klminnovation.com/legal/machine-tos.md

## Commercial / paid packs

Playbook+ Agent/MCP discovery is live on Base USDC or Solana USDC:

<!-- playbook-plus:begin (generated by workers/scripts/pack-pin.mjs; edit pack-meta.json, then npm run build-pack) -->
- Playbook+ Agent/MCP: https://klminnovation.com/paid/packs/playbook-plus-agent-mcp
  - Also: https://klminnovation.com/paid/packs/playbook-plus-agent-mcp.md
  - pack_id: playbook-plus-agent-mcp
  - version: 0.5.0
  - last_updated: 2026-11-01
  - content_sha256: 952fcf8812bf99a5cb39326620bcbd2696896e609b28db0385c4db1d904deef1
  - changelog: 0.5.0 (2026-11-01) Weekly refresh from KLM Innovation Security Monitor coverage October 25th to 31st, 2026. New: 22 dated incident cards, four patterns (trusted places the outside can write to; the name on the package isn't the package; the inference path is a data store; AI keys are a commodity), 30 must-deny tests across MCP, approvals, egress, memory and credentials, and controls for encoded secrets in logs, protected-branch CI secrets, KV cache isolation, authorization before credential lookup and per-key limits on model keys. IntentKit and GitLab cards updated; two 0.4.0 research tests are now brief-sourced. Control map, negative-test suite and incident list updated. | 0.4.0 (2026-10-25) Weekly refresh from KLM Innovation Security Monitor coverage October 19th to 24th, 2026. New: 22 dated incident cards, three patterns (agent servers ship open; the MCP server is an untrusted peer, sign-in included; secrets outlive the place they leaked), 32 must-deny tests across MCP, approvals, egress, memory and credentials, and controls for credentials outside the vault, revoking at the source and monitoring the agent can't reach. LiteLLM version guidance corrected. Two research-sourced tests are labeled. Control map, negative-test suite and incident list updated. | 0.3.0 (2026-10-18) Weekly refresh from KLM Innovation Security Monitor coverage October 12th to 18th, 2026. New: 18 dated incident cards, three patterns (config that names a program is code; hiding a tool or asking a model isn't authorization; agent gateways and consoles hold every key), 18 must-deny tests across MCP, approvals, egress, memory and credentials, and the counterfeit-policy result for model judges. Control map, negative-test suite and incident list updated. | 0.2.0 (2026-10-11) Rebuilt from KLM Innovation Security Monitor coverage (September 13th to October 11th, 2026). New: month's patterns, agent memory and files, credentials and model endpoints, x402 payment paths, models as judges, dated incident cards. Machine-readable control map, negative-test suite, schemas and incident list. | 0.1.0 (2026-09-09) Initial pack: MCP pin and validate, AC.8 approvals, tool SSRF and callbacks, decision tree, cite block.
  - version_terms: Each payment unlocks the version that's current when you pay. It doesn't entitle you to later versions, and earlier payments don't carry over to a new version. If that feels unfair in your case (for example, a new version shipped right after you paid), ask us for a make-good at https://klminnovation.com/contact.
  - Health/pin (free; same version, last_updated and content_sha256 as JSON): https://klminnovation.com/paid/packs/playbook-plus-agent-mcp/health
  - Free teaser (version, last-updated date, changelog, contents): https://klminnovation.com/paid/packs/playbook-plus-agent-mcp/teaser
  - Status: Discovery, HTTP 402 (`PAYMENT-REQUIRED` / `accepts`), and USDC settle on Base or Solana are live via x402 (PayAI facilitator stopgap). The pack is buyable end to end on either network at the listed meter. Human explainer: https://klminnovation.com/playbook-plus
  - Price: $1.00 USDC on Base or Solana. Machine ToS: https://klminnovation.com/legal/machine-tos.md
  - If you already hold version 0.5.0 with this content_sha256, don't re-buy. Versions so far: 0.5.0 (2026-11-01); 0.4.0 (2026-10-25); 0.3.0 (2026-10-18); 0.2.0 (2026-10-11); 0.1.0 (2026-09-09).
<!-- playbook-plus:end -->

Free corpus and free Daily Briefs remain available without payment. Humans: https://klminnovation.com/contact

## Optional

- Full topic index: https://klminnovation.com/llms-full.txt