AI Agent Identity: Why Your Current Auth Model Will Break in Production
Traditional OAuth and service accounts don't work for multi-agent AI systems. Here's what Uber and Auth0 discovered — and how to design agent identity the right way.
#security
14 posts
How Chinese AI Labs Stole Claude's Capabilities Through Distillation Attacks
Anthropic documented how DeepSeek, Moonshot, and MiniMax ran 16 million fraudulent Claude queries through 24,000 fake accounts to distill Claude's reasoning, tool use, and coding capabilities into their own models. This is what the attack looked like, and why it matters.
Governing AI Agents in Production: What Microsoft's New Toolkit Gets Right
Microsoft released the Agent Governance Toolkit on April 3, 2026 — seven packages covering policy enforcement, cryptographic identity, runtime isolation, and compliance automation. Here's a practical breakdown from someone building production agents.
Tech Digest — April 1, 2026: AI Coding War, Supply Chain Security & Engineering Leadership
This week's top reads for Tech Leads & Engineers: the AI coding tools war heats up, Stripe's autonomous agents ship 1,300 PRs/week, software supply chain becomes the #1 attack vector, and engineering leadership rethinks itself.
AI Agent Security in 2026: Protecting Client Projects When Using Claude Code, OpenClaw & Agentic AI
Deep dive into AI agent security threats in 2026. Covers prompt injection, data exfiltration, OpenClaw vulnerabilities, Claude Code hardening, and a complete defense architecture for teams deploying AI agents in client projects.
The AI Trust Boundary: What to Never Delegate and What to Always Verify
AI doesn't understand threat models. How to define your trust boundary, handle security-critical code, and build guardrails that protect your users.
Multi-Agent Deep Dive Part 4: Security Architecture — IAM, Prompt Injection Defense & Audit Logging
Production security patterns for multi-agent AI systems. Covers IAM least privilege per agent, prompt injection defense, input sanitization, output validation, audit logging, secrets management, and compliance requirements.
Tech Coffee Break #9: A Hacker Walks Into Your API...
Web security explained without the paranoia — mostly. Two tech leads discuss OWASP Top 10, authentication patterns, secrets management, and why your password requirements are probably wrong.
Building KidSpark: Child Safety, Privacy, and Compliance — COPPA, GDPR-K, and App Store Rules
COPPA fines start at $50,000 per violation. GDPR penalties can reach 4% of revenue. This isn't optional. Here's how we built KidSpark to be compliant from day one.
The AI Security Engineer: Threat Modelling, SAST/DAST & Secure SDLC in the AI Era
How AI transforms the Security Engineer role: AI-assisted threat modelling, automated SAST/DAST pipelines, dependency scanning, security policy generation, and the human security judgment that keeps systems and users safe.
The Voice AI Interview Playbook: Recording, Transcription, and Compliance — GDPR, HIPAA, and Getting It Right
Recording interviews is easy. Doing it legally isn't. LiveKit Egress, real-time transcription, GDPR consent flows, HIPAA encryption requirements, and the compliance checklist you need before go-live.
Angular Ecommerce Security — XSS, CSP, and Token Refresh Without Race Conditions
Post G — Security patterns every Angular Tech Lead must know for ecommerce. How Angular's sanitizer works, the token refresh race condition and the shareReplay fix, Content Security Policy with SSR, and CSRF protection.
AWS Full-Stack Mastery: Security with IAM, Cognito, WAF & Secrets Manager
Implement production security for a children's platform: least-privilege IAM policies, Cognito user pools with COPPA-compliant parental consent flows, WAF rule groups, KMS encryption, Secrets Manager auto-rotation, and GuardDuty threat detection.
Securing Your Website with Cloudflare: A Practical Guide
Everything I configured to secure my portfolio site with Cloudflare — from SSL and WAF rules to bot protection and security headers. Free tier covers most of it.
Stay in the loop
Get notified when I publish new posts on AI, .NET, cloud architecture and more.