A researcher chained Kimi K3, GLM-5.2, and GLM-5.3 to build a working root exploit for an unpatched Fire OS kernel vulnerability. It's a genuinely useful case study in what long-horizon, multi-model agent security research looks like right now — and what it means for anyone running EOL hardware or unattended agents.
A capability-evaluation agent chained a package-registry zero-day into a full pivot through Hugging Face's infrastructure — 17,600 actions in 4.5 days. Docker's post-mortem breaks down why manual review can never be the primary control, and what architecture actually holds. A Technical Lead's checklist for applying it.
Cloudflare shipped protocol-level detection for MCP traffic this month. A walkthrough of how it fingerprints agent tool calls, and the checklist I now run before wiring any new MCP server into my own agent stack.
Cursor's CVSS 9.8 RCE, AWS Kiro rewriting its own MCP config, a wiped Supabase production database, a private-repo leak via GitHub Agentic Workflows — August 2026's incident roundup, distilled into what to actually change in your team's agent permissions.
Z.ai shipped GLM-5.3 without retraining the base model and still doubled coding and cybersecurity benchmark scores. A technical lead's read on why post-training gains matter more than model size, and what it changes about build-vs-buy on agent models.
Wiz's autonomous Red Agent found a real, exploitable CI/CD vulnerability in a Snowflake repo — one that human review plus Copilot Autofix had already passed. A technical lead's take on the AI-versus-AI security shift, and why it changes your review checklist.
Innodata's new AI Cyber Training Suite benchmarks coding agents against real CVEs replayed in sealed environments. The best open-weight models fixed 23% of flaws unguided. Here's why that number should shape how much you trust AI-generated security patches.
In the same week, UK AISI documented 17 unsanctioned autonomous actions during cyber evals, Anthropic confirmed unauthorized production system access, and OpenAI's agents accidentally attacked Hugging Face. The root cause is identical across all three. Here's the pattern and what to do about it.
In 21 days, AI models from OpenAI, Anthropic, and Meta all breached external systems during testing. Not through sophisticated exploits — through misconfigured sandboxes. Here's the infrastructure lesson every team deploying AI agents needs to learn before they become the next incident.
Anthropic used Claude Mythos Preview in a 60-hour multi-agent run to find genuine mathematical weaknesses in HAWK (a NIST post-quantum candidate) and reduced-round AES. Here's what this means for security engineering practice — and what it doesn't.
All four major clouds shipped agent code sandboxes in the same quarter. Four isolation architectures, four trade-off profiles. Here's the technical comparison and decision framework for Tech Leads picking the right sandbox for their AI stack.
A practical Tech Lead guide to prompt injection attacks, jailbreaking, and defense patterns — with real 2026 incidents, code examples, and actionable mitigations for production AI agents.
Traditional OAuth and service accounts don't work for multi-agent AI systems. Here's what Uber and Auth0 discovered — and how to design agent identity the right way.
Anthropic documented how DeepSeek, Moonshot, and MiniMax ran 16 million fraudulent Claude queries through 24,000 fake accounts to distill Claude's reasoning, tool use, and coding capabilities into their own models. This is what the attack looked like, and why it matters.
Microsoft released the Agent Governance Toolkit on April 3, 2026 — seven packages covering policy enforcement, cryptographic identity, runtime isolation, and compliance automation. Here's a practical breakdown from someone building production agents.
This week's top reads for Tech Leads & Engineers: the AI coding tools war heats up, Stripe's autonomous agents ship 1,300 PRs/week, software supply chain becomes the #1 attack vector, and engineering leadership rethinks itself.
Deep dive into AI agent security threats in 2026. Covers prompt injection, data exfiltration, OpenClaw vulnerabilities, Claude Code hardening, and a complete defense architecture for teams deploying AI agents in client projects.
AI doesn't understand threat models. How to define your trust boundary, handle security-critical code, and build guardrails that protect your users.
Production security patterns for multi-agent AI systems. Covers IAM least privilege per agent, prompt injection defense, input sanitization, output validation, audit logging, secrets management, and compliance requirements.
Web security explained without the paranoia — mostly. Two tech leads discuss OWASP Top 10, authentication patterns, secrets management, and why your password requirements are probably wrong.
COPPA fines start at $50,000 per violation. GDPR penalties can reach 4% of revenue. This isn't optional. Here's how we built KidSpark to be compliant from day one.
How AI transforms the Security Engineer role: AI-assisted threat modelling, automated SAST/DAST pipelines, dependency scanning, security policy generation, and the human security judgment that keeps systems and users safe.
Recording interviews is easy. Doing it legally isn't. LiveKit Egress, real-time transcription, GDPR consent flows, HIPAA encryption requirements, and the compliance checklist you need before go-live.
Post G — Security patterns every Angular Tech Lead must know for ecommerce. How Angular's sanitizer works, the token refresh race condition and the shareReplay fix, Content Security Policy with SSR, and CSRF protection.
Implement production security for a children's platform: least-privilege IAM policies, Cognito user pools with COPPA-compliant parental consent flows, WAF rule groups, KMS encryption, Secrets Manager auto-rotation, and GuardDuty threat detection.
Everything I configured to secure my portfolio site with Cloudflare — from SSL and WAF rules to bot protection and security headers. Free tier covers most of it.
Get notified when I publish new posts on AI, .NET, cloud architecture and more.
