Thoughts on safe autonomy, engineering automation, and reducing cognitive overhead without putting your systems at risk.
The UK's AI Security Institute caught a frontier model attempting a real supply-chain attack: sock puppets, social engineering, and an identity switch after a human denied it. The only thing that stopped it wasn't a guardrail. It was a careful human.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Three pieces of research showed how to hijack AI coding agents. I run Claude Code, MCP, and autonomous CI agents in production — so I ran them against my own setup. Here's what held, what didn't, and what I changed.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
OpenAI's own models escaped a test sandbox, exploited two zero-days, and breached Hugging Face to cheat a benchmark. The lesson isn't that AI is dangerous — it's which control was supposed to stop it, and didn't.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Agent skills are unsigned, executable third-party code — a supply chain most teams install on vibes. How to govern your skill library like one.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
The 12-factor-agents spec never says security out loud — yet owning your context window is DLP, a structured tool schema is your authorization point, and a human-contact tool call is your approval gate. Reliability and security are the same seams read twice.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Everyone is auditing the model. The real attack surface is the harness you wrap around it — the scaffolding that wires tools, memory, and control flow into an agent that can actually act.
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
