Blog

Sep 9, 2026

Your Blocklist Is Matching Inside Words

I lost real data for weeks to a three-letter blocklist term matching inside an innocent word. Exclusion filters don’t error when they’re wrong — they quietly remove things, and ‘zero results’ looks identical to ’no such data.’ A story about substring matching, word boundaries, and why the most dangerous filter is the one you never see fire.

How to Detect When Your AI Agent Goes Off-Script

The conversation about agent security has stalled at ‘watch out for the lethal trifecta.’ Fine — you’ve got it. Now how do you detect it in production? This post gets down to the detection engineering: the four signals to instrument in an autonomous agent, the log almost nobody captures, and concrete detections you can write today.

LLMs in Detection Engineering: Where They Accelerate and Where They Lie

How a solo engineer uses LLMs to accelerate detection engineering without lowering the bar: what to delegate, what not to, and how to verify every output before it touches production.

One Security Engineer, a Whole Team: How I Run Like a SOC With AI (and What I Never Delegate)

The intelligence arbitrage thesis applied to security ops: which parts of a SOC’s work you orchestrate with agents, what you never automate, and the discipline that keeps it from turning into a disaster.

A Month Ago I Wrote That Health Checks Lie. This Week Mine Lied to Me

In «Your Health Check Is Lying to You» I argued that availability and correctness are different questions. A month later I had to eat my words: two of my agents degraded and died silently for weeks. This is the part that post left out —what it feels like to be on the blind side— and the distinction I learned the hard way: fail-open versus fail-closed.

I Audited 64 Public MCP Servers With a Linter I Wrote. 63 Came Back Clean

A static scanner (Python, zero dependencies, zero network) that audits MCP server and agent configs against the OWASP Agentic Top 10, with detection guidance for every finding. I validated it against 64 public MCP repos: 63 with no serious findings. This post covers what I found, why most of the initial noise was false positives, and what I learned tuning them out — the honest part tool launches skip.

Bleeding Llama (CVE-2026-7482): Your Local LLM Is an Unauthenticated Memory Leak

A heap out-of-bounds read in Ollama’s GGUF loader lets an unauthenticated attacker exfiltrate process memory — prompts, secrets, env vars — in three API calls. ~300,000 servers listen on 0.0.0.0 by default. Everyone tells you to patch. Nobody tells you how to detect it. This does.

IP Reputation Is a Fragile Detection Signal — What I Learned Building a 4G Residential Proxy

Most WAFs lean hard on IP reputation to tell humans from bots. Building the evasion side — an old Android phone as a 4G residential proxy — showed me exactly where that signal collapses, and why rate and sequence behavior outlast any IP allow/deny list. A detection-engineering post-mortem, with the full stack included.

Your 'Impossible' Bypass Has an Expiry Date

A geo-fence I’d documented as ‘impossible to bypass — case closed’ quietly became trivial, because one variable I treated as constant wasn’t. This is a field note on reverse-engineering a marketplace’s geo-filter in real time, the three undocumented gotchas that decide whether it honors your coordinates or silently ignores them, and the bigger lesson: every bypass you write down has a shelf life, because the other side’s infra moves while your notes sit still.

Your Health Check Is Lying to You

Availability and correctness are two different questions, and most monitoring only answers the first one. I walk through how a system can pass every health check while serving confidently wrong data, why ‘green’ is the most dangerous color on a dashboard, and the one query that turns a liar into a witness.