独立博客档案 东京
TR Notes
www.xiaohei.coTR Notes 是红队从业者的中英双语笔记站，主题包括 AI/Agent 安全、MCP 信任边界、Embedding 反演、以及 AWS/Azure/GCP/Entra 云身份。
- 收录文章
- 13 篇文字被发现
- 文章访问
- 33 次从这里出发阅读
- 博客访问
- 2 次前往作者站点
- 最近更新
- 11.10 2026年
FROM THIS BLOG
最近文章
Staying Alert to AI: What Comes With the Convenience?
AI drug research, dual-use experiments and an MCP security case illustrate the risks that accompany growing capability and convenience, and how dependence can weaken vigilance.
From a Client Network to Embedding Inversion: The Full Engagement and AI Errors
A complete sanitized account of an authorized client engagement, from initial access, a misleading RAG stack, and deployment remnants to local and domain privileges, SSH identity matching, v...
From MCP Configuration to Server-Side Execution: A Trust-Boundary Case Study
An API that omits secrets, artifacts without runtime configuration, and an unreachable database led to a closer look at MCP stdio process-launch privileges. A case study in eliminating paths...
Everyone Is a Red Teamer: Four Years of AI Red Teaming
*Collapsing barriers, dual loss of control, and the return of discipline*
Google Cloud Identity, Resource Hierarchy, and Billing
This article reviews consumer and managed identities, the Google Cloud organization-folder-project hierarchy, service-account credentials, and the relationship between Cloud Billing accounts...
Google Workspace Identity Management and Apple Federation
This article reviews Workspace domain and directory boundaries, organizational units, administrator roles, 2-Step Verification, federation, API controls, domain-wide delegation, unmanaged ac...
Gemini in Google Workspace: Data Access Boundaries and Security Review
This article distinguishes the Gemini app, Workspace-integrated features, and Gemini Enterprise; reviews their data-access and administrative boundaries; and uses the publicly disclosed, pat...
Multicloud Network Control Planes: Routing and Security Operations Across OCI, GCP, Azure, and AWS
Using a hypothetical OCI, Google Cloud, Azure, and AWS deployment, this article reviews interconnects, routing control planes, Kubernetes networking, private endpoints, and multicloud securi...
AWS Identity and Billing Boundaries: Root, Management Accounts, and Cross-Account Trust
AWS concentrates identity, credentials, trust, and billing around the account boundary. This article reviews the root user, the management account's payer role, credential lifetimes, and cro...
Can Encrypted Thinking Be Revived? An Azure Reasoning-State Replay Experiment
Starting with a cache hypothesis, I tested cross-session replay, cross-model reuse, and usage differences in Azure encrypted reasoning—and reconsidered the boundaries between state, caching,...
Microsoft Cloud Identity and Hybrid Authentication: Tenants, Subscriptions, and Kerberos
This article examines Microsoft Entra tenant, Azure subscription, and billing boundaries; role systems and workload identities; and the hybrid authentication paths connecting on-premises Act...
Microsoft 365, Copilot, and the Security Control Plane
This article reviews Microsoft 365's layered authorization model, its boundaries with Azure, workload access paths, Microsoft Graph application permissions, Copilot data access, and the cont...