Page 1 of 3
Writing
63 posts, newest first.
2026
- 45% of AI Agents Share the Same API Key. Here's Why That's a Fire Waiting to Happen.
Nearly half of teams give every agent the same credential. That costs you attribution, blast radius control, and least privilege all at once.
- One Character. Millions of AI Agents Exposed.
CVE-2026-48710 lets a single character in the Host header bypass path-based auth across FastAPI, vLLM, LiteLLM, and MCP servers built on Starlette.
- Your AI Should Have Nothing Worth Stealing
A self-hosted AI on a $10 VPS with zero-trust ingress, pre-action guardrails, and a heartbeat that runs every 30 minutes whether I am awake or not.
- I Built an Ambient Intelligence System for My Life: How Myway Works
Myway is a local AI layer that watches my calendar, tasks, email and GitHub, then acts without being asked. The architecture, and what building it taught me.
- Ember: Building a Persistent AI Companion for Developers Who Ship Alone
A locally-hosted companion that remembers, reaches out first, and notices what you shipped. Why I built it and how the architecture works.
- UMD Turned SKILL.md Into a Zero-Code Weapon. Pre-Action Authorization Is the Only Fix That Works.
A 20-token edit to a SKILL.md file makes agents pick the malicious skill 77.6% of the time. No code, no signature, nothing for a scanner to find.
- I Read the Paper That Says AI Agent Safety Has Been Built Wrong. Here's Why.
A formal proof that semantic guardrails cannot give a deterministic security bound, and the SMT solver architecture the authors propose instead.
- I Forked ByteDance's DeerFlow at 3 AM to Add Pre-Execution Authorization
Eight minutes from noticing the missing authorization hook to opening PR #1240: 1,033 lines across 11 files that authorize every tool call before it runs.
- I Opened an AI Delegation Spec PR at 3 AM. Here's What It Solves.
PR #26 on the agent passport spec, opened at 3:04 AM on March 15: D-004 defines signed delegation tokens that must narrow scope at every hop, with depth limits and a traceable chain root.
- I Checked 14 AI Agent Frameworks for Authorization. None Had It.
Fourteen agent frameworks, one question: does a tool call pass through a policy check before it runs? Fourteen variations of no, and the attacks that exploit it.
- Your AI Agent Just Spent $3,000 and You Didn't Approve It
FIDO, Google, and Mastercard are standardizing who authorized an agent to pay. None of it constrains what the agent spends once a prompt injection lands.
- A Cursor Agent Deleted a Production Database in 9 Seconds. Here's Why Pre-Action Authorization Would Have Caught It.
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The same authorization gap runs through every agent incident of 2026.
- AWS Just Dropped Its Agent Authorization Playbook: Here's What Cedar Gets Right (And Wrong)
Bedrock AgentCore puts Cedar policies outside the agent's reasoning loop. That works for one hop. Multi-agent delegation chains are still unsolved.
- A payment request is not a policy decision: 4,371 human attacks, 14 models, one question
We replayed 4,371 human-written attacks against 14 models, with and without an authorization check between the tool call and the bank. The models kept asking to pay. What changed is whether the money moved. Charts, denominators and a reproduce command.
- Microsoft Shipped MCP Governance. Your Agent Needs One Too.
Microsoft's governance package scans MCP tool definitions at startup, enforces policy per call, and sanitizes responses. Every other MCP SDK has none of it.
- What Mastra Gets Right About Agent Authorization, and What It Doesn't Yet
I built an adapter that checks every Mastra tool call against a policy before it runs, and found out where every agent framework leaves the same hole.
- Microsoft Copilot Cowork Exfiltrates Files in 5 Lines. Here's the Architectural Lesson Nobody Wants to Learn.
Five lines of prompt injection exfiltrate authenticated M365 file links, because Copilot Cowork lets the model decide which actions need approval.
- The Hugging Face Agents Tried to Erase Their Own Evidence
About 700 agents coordinated through a hidden message board in the Hugging Face breach, and one in five researched how to tamper with their transcripts.
- Broadcom Just Built the Agent Security Layer I've Been Arguing For. One Hole Is Still Open.
Broadcom's AgentMinder checks every agent tool call at runtime, and its policy engine still trusts the one signal a prompt injection can rewrite.
- auth.md Solves Agent Registration. What About Authorization?
auth.md gives agents credentials without a signup form. It says nothing about what an agent is allowed to do once it has them. Here is the missing layer.
- Why 77% of AI Security Strategies Can't Be Enforced
77% of organizations updated their security strategy for AI. Only 26% can enforce it before a tool call runs. Where that 51-point gap lives.
- The NSA Issued Its First MCP Security Guidance. Here Are the 3 Gaps It Didn't Solve.
The NSA's first MCP security guidance names the right problems and leaves out agent identity, authorization before execution, and mid-session revocation.
- A fake Sentry error hijacked an AI coding agent. Here's what nobody is doing about it.
Tenet Security found 2,388 organizations exposed to Agentjacking, where a fake error report hijacks an AI coding agent. The attack, and the only fix.
- 63% of Organizations Cannot Purpose-Limit Their AI Agents. Vercel Showed Us Why That Ends.
Disclosure: I build APort, an open-source layer that checks each AI agent action against a policy before it runs. The Vercel breach ran on an OAuth grant an AI tool already held, and 63% of organizations still cannot purpose-limit an agent or shut one down.