Runtime security and compliance for the AI agent era.
I use coding agents every day. Having an agent write a fix and run the tests is useful. Having it run a shell with access to credentials is also a security decision, whether I’m thinking about it at the time or not.
Read article →
Anthropic just did something nobody expected. They built a model so good at finding security vulnerabilities that they're scared to release it publicly.
Read article →
Two days ago we put a paste box on the open internet. Type a shell command, hit Evaluate, get a verdict — , , or . Same on a second tab for MCP tool calls: tool name, JSON-style args, evaluate, verdict.
Read article →
A real bypass, a new analyzer layer, and the design pattern behind it.
Read article →
When the agent knows it's being watched — detecting eval-aware code patterns before they ship.
Read article →
Last week I sat down to write a single rule — block an AI agent from reading , the 1Password CLI v2 session cache. A junior security person would look at the ticket and think: "one file, one regex, an afternoon."
Read article →
AI coding agents are rewriting software faster than any human team could. Cursor, Windsurf, Claude Code, Gemini CLI — they ship features in minutes. But they also run shell commands, call MCP tools, and modify files with the same speed…
Read article →
I've been building software for over 20 years. And I'll be honest — when the term "AI agent" started flooding my LinkedIn feed in 2023, I rolled my eyes. It felt like a rebranding of chatbots with better PR. Little could I have predicted…
Read article →
I run an AI security company. I'm supposed to tell you AI risk is manageable — that with the right governance framework and a good dashboard, you'll sleep fine.
Read article →
The fastest way to wipe your laptop in 2026 is to ask an AI to refactor your repo. Not because the model is malicious, but because a single prompt injection, a poisoned MCP server, or a hallucinated shell command is all it takes to put one…
Read article →