TAG://#security

8 posts tagged #security

2026-08-17series: Agent Readiness

> How Do You Keep Agents From Lying? Create a Source of Truth.

I sent 78 autonomous agents against my own website and refused to believe a single thing they told me. Every success claim needed a cryptographic receipt from the server. Here's what the receipts caught, and why I think response signing is the cheapest trust infrastructure you can build.

#ai (15)#agents (4)#security (8)#devtools (5)

2026-04-23series: Review Bomb

> Your Phone as a Terminal: One Command, One QR Code, No SSH Client

A code review of TermBeam, a Node CLI that shares a local terminal to your phone over a QR code — no SSH, no port forwarding, no static IP.

#opensource (23)#javascript #security (8)#devtools (5)

2026-04-12series: Review Bomb

> When AI Writes Your Firewall, Check the Math

An AI-generated eBPF firewall with 8,500 lines of Rust, an LLM honeypot, and a suspicion scoring bug that made its own behavioral engine useless. I read the code, fixed the math, and wrote it up.

#opensource (23)#rust (10)#security (8)#ai (15)

2026-04-08series: Charlotte MCP

> Anatomy of a GitHub Actions Supply Chain Attack Targeting MCP Repos

A pull request to my MCP server Charlotte led me to uncover a supply chain attack spanning 250+ repos, 64 sockpuppet accounts, and five phases of escalating access — all funneling GitHub OIDC tokens to a single organization.

#opensource (23)#security (8)#github (3)#supplychain

2026-04-02

> Anthropic Leaked Its Own Source Code and May Not Own It

The Claude Code leak exposed 500,000 lines of source code. The DMCA takedowns that followed may have exposed something worse — that Anthropic can't legally claim copyright over code its own AI wrote.

#ai (15)#opensource (23)#security (8)#legal

2026-04-02series: Review Bomb

> Your Encrypted Backups Are Slow Because Encryption Isn't the Bottleneck

A look at Concryptor, a Rust CLI that pipelines io_uring and AES-256-GCM to hit GB/s file encryption on commodity NVMe — and the CI cleanup PR that followed.

#opensource (23)#rust (10)#security (8)#cli (3)

2026-03-30series: Review Bomb

> The Firewall Between Your AI Agent and Your Filesystem

A code review of greywall, a container-free sandbox that isolates AI coding agents with kernel-level enforcement — no Docker required.

#opensource (23)#security (8)#go (5)#ai (15)

2026-03-10series: Guardrails

> Secrets, Agents, and .env Files

Your AI agent can read your environment variables. It can also commit them. Here's how to make sure it doesn't.

#github (3)#security (8)#ai (15)#beginners (2)