Blog
The Hidden Cost of Agent Loops — A Security and FinOps Take
Loop engineering is the title of the week. But the engineers promoting it work at the token dispensaries and never see the bill. I break down the loop hype from two angles the hype skips — what it costs, and what it does to your control model — and land on the rule that actually matters: the agent executes decisions, it does not get to make them.
Read more →26% of AI Agent Skills Are Vulnerable. I Audited My Own.
A study of 42,447 agent skills found 26.1% vulnerable and 5.2% likely malicious. I ran my own 29 skills against the SkillSpector taxonomy. They came back clean — but the audit exposed three real gaps in my defense model, and the fix became a new tool.
Read more →AI Can Find 10,000 Vulnerabilities in Weeks. Who's Going to Patch Them?
When AI finds vulnerabilities faster than humans can patch them, the limiting factor stops being detection and becomes verification and remediation. Amdahl’s law applied to security operations: a security engineer’s read on Anthropic’s recursive self-improvement essay.
Read more →The IC Score: An AI-Powered Formula for SOC Alert Triage
A practical breakdown of the IC Score formula: 7 weighted signals, asset criticality multipliers, and decision thresholds that reduced our mean triage time from 15 minutes to under 2 minutes.
Read more →PewDiePie's Odysseus: The Security Take on Running an Agent That Reads Your Email and Executes Code
Odysseus combines command execution, email reading, and web access in a single local agent. It’s a textbook case of the ’lethal trifecta’. ‘It’s local’ protects your privacy, but not from prompt injection. The security take and how to install it right.
Read more →Designing Guardrails for AI Security Agents in Production
AI agents with access to your SIEM, identity provider, and containment actions are privileged processes. Here is how I design guardrails to keep them safe in production.
Read more →14 AI Agents Cleared Our Alert Backlog in 8 Weeks: The Multi-Tier SOC Architecture
A practical architecture guide for building a multi-agent autonomous SOC: 14 specialized agents across 5 tiers, from signal processing to automated containment.
Read more →I Already Built Defenses Against Every Attack in the 'AI Agents of Chaos' Paper
A new research paper documents 11 failure modes in live AI agents: identity spoofing, memory wipes, malicious file propagation, and false task completion. I built defenses against all of them months ago. Here is the mapping.
Read more →My Agentic OS: How I Run 5 Projects Solo with Claude Code
I run 5 projects solo — no team, no VA. Here’s the AI agent architecture that makes it possible: 23 skills, 6 defense layers, parallel sessions, and a single config file that orchestrates everything.
Read more →CVE-2026-42945: The 18-Year-Old NGINX RCE Nobody Caught
An 18-year-old heap buffer overflow in NGINX’s rewrite module enables unauthenticated remote code execution. CVSS 9.2. Public PoC available. Here is how it works and why nobody caught it.
Read more →