Blog

Sep 21, 2026

264,000 People Are About to Install an AI Agent Harness. Run This 5-Minute Audit First.

Everything Claude Code crossed 264k stars and is genuinely well built. That popularity is the point: popular is not the same as audited by you. The 5-minute audit I run against any agent harness before I trust it.

I Ran My Agent Auditor Against the Top Agent Repos. It Found Real Bugs, and Embarrassed Me.

I ran my open-source agent auditor against two of the most-talked-about agent repos on GitHub. It found real unpinned MCP servers, out-of-model hooks and risky installers, and it also flagged injection defenses as attacks and nouns as destructive actions. The honest before and after.

Your Blocklist Is Matching Inside Words

I lost real data for weeks to a three-letter blocklist term matching inside an innocent word. Exclusion filters don’t error when they’re wrong — they quietly remove things, and ‘zero results’ looks identical to ’no such data.’ A story about substring matching, word boundaries, and why the most dangerous filter is the one you never see fire.

How to Detect When Your AI Agent Goes Off-Script

The conversation about agent security has stalled at ‘watch out for the lethal trifecta.’ Fine — you’ve got it. Now how do you detect it in production? This post gets down to the detection engineering: the four signals to instrument in an autonomous agent, the log almost nobody captures, and concrete detections you can write today.

LLMs in Detection Engineering: Where They Accelerate and Where They Lie

How a solo engineer uses LLMs to accelerate detection engineering without lowering the bar: what to delegate, what not to, and how to verify every output before it touches production.

One Security Engineer, a Whole Team: How I Run Like a SOC With AI (and What I Never Delegate)

The intelligence arbitrage thesis applied to security ops: which parts of a SOC’s work you orchestrate with agents, what you never automate, and the discipline that keeps it from turning into a disaster.

A Month Ago I Wrote That Health Checks Lie. This Week Mine Lied to Me

In «Your Health Check Is Lying to You» I argued that availability and correctness are different questions. A month later I had to eat my words: two of my agents degraded and died silently for weeks. This is the part that post left out —what it feels like to be on the blind side— and the distinction I learned the hard way: fail-open versus fail-closed.

I Audited 64 Public MCP Servers With a Linter I Wrote. 63 Came Back Clean

A static scanner (Python, zero dependencies, zero network) that audits MCP server and agent configs against the OWASP Agentic Top 10, with detection guidance for every finding. I validated it against 64 public MCP repos: 63 with no serious findings. This post covers what I found, why most of the initial noise was false positives, and what I learned tuning them out — the honest part tool launches skip.

Bleeding Llama (CVE-2026-7482): Your Local LLM Is an Unauthenticated Memory Leak

A heap out-of-bounds read in Ollama’s GGUF loader lets an unauthenticated attacker exfiltrate process memory — prompts, secrets, env vars — in three API calls. ~300,000 servers listen on 0.0.0.0 by default. Everyone tells you to patch. Nobody tells you how to detect it. This does.

IP Reputation Is a Fragile Detection Signal — What I Learned Building a 4G Residential Proxy

Most WAFs lean hard on IP reputation to tell humans from bots. Building the evasion side — an old Android phone as a 4G residential proxy — showed me exactly where that signal collapses, and why rate and sequence behavior outlast any IP allow/deny list. A detection-engineering post-mortem, with the full stack included.