An AI Attack Framework Got Into WorkOS's Sales Tool. It Held Customers' Slack Excerpts
WorkOS says an AI-assisted attack framework reached a sales app holding CRM contacts, call notes and Slack excerpts. It says production wasn't touched.
Tutorials
What a week of building a kid-safety guard on a laptop GPU taught me about measuring small models
This is a submission for the MLH x DEV Writing Challenge What I Built Night Guard is an...
ShengChang: Import a Novel Chapter, Get a Mixed Radio-Drama Episode
ShengChang is an MIT-licensed, local-first workbench that turns a novel chapter into a multi-voice radio-drama episode: line breakdown, dire
Upgrade a Major Dependency With a Coding Agent: Changelog First, Then the Failing Tests
openai-node 7.0.0 lists one breaking change. A later minor says code may no longer compile. Give your agent the changelog and the failures, not 'upgrade'.
Simulate Your Cloud Architecture with an MCP Server Before You Deploy
Most capacity questions I get asked boil down to "what happens if traffic triples?" Usually the...
How to stop prompt injections and AI hallucinations at the OS level (CBS v1.6.2 release)
Disclosure: I am the author of Cyber-Butler-Security (CBS). If you run AI Agents (like DeepSeek...
Building an Authorization Gateway for AI Agents: A Practical Architecture
AI agents are increasingly capable of interacting with external APIs and enterprise systems. But...
Is your reviewer agent ever actually called? Counting it from session logs
Originally published at morgan-vale.blogspot.com. Is your reviewer agent ever actually...
My 'Second Backend' Existed Only in the README
The release gate said "two OTel backends proven." The check proving it ended in || true. It had been...
How I built a music companion that plays in your own culture
Live demo: reach-6o5x.onrender.com (press Guided tour, top right) · Code:...
The New York Times Sues Brave Over Alleged Scraping and AI Content Sales
The New York Times has filed a copyright infringement lawsuit against Brave Software, alleging that...
Fine-tuning a 322M Model for Coding Agent Safety: What 3 Runs and 2 Failures Taught Me
laya-guard sits between a coding agent and your shell. Every command Claude Code (or Cursor, Codex,...
Gemini CLI's mkdir Failed, the Agent Kept Going, and Each move Overwrote the Last File
Gemini CLI's mkdir failed, the agent kept going, and on Windows each move renamed a file over the last. Reproduce it safely, then make it an undo.
Last week in Agent Security Update 5: The Pentagon Prompts
Last week I spoke at API Days in Melbourne, where I gave a talk on the OWASP Top 10 for Agents and...
Giving AI agents hands without handing over the keys: how we think about safety at TwinMCP
TwinMCP, a hosting platform for MCP servers. This post explains the safety choices we made, including...
DevRel Didn't Die, Its Audience Changed
Most evenings I put my agents to the test. I've been experimenting with a lot of stuff lately, and...
Use it, or lose it 🧠
Fayaz reminds everyone why we should keep doing deep intellectual and creative works.
Warp's Breach Reached Agent Decision Logs. What One Agent Trace Actually Contains
Warp says a vendor breach reached agent decision logs for roughly 1% of users. Here is what one local Claude Code trace holds, checked with jq and grep.
A guardrail that decides at the door lets the intruder walk in later
I report security bugs in AI-agent guardrails, and I keep finding the same shape of bug. This is...
I benchmarked my own agent skill, and today's Claude barely needed it
I wanted to write an agent skill that makes coding agents better at data analysis. The kind of...
UK CMA Requires Google to Provide AI Search Click Data to Publishers
The UK Competition and Markets Authority (CMA) has required Google to give publishers more detailed...
Stop Giving AI Agents More Context Than They Need
Stop Giving AI Agents More Context Than They Need Why oversized prompts, outdated...
Building a Production RAG Pipeline on AWS: Bedrock Knowledge Bases, OpenSearch Serverless, and Terraform
Most RAG tutorials stop at a notebook demo. I built a production pipeline — Bedrock Knowledge Bases, OpenSearch Serverless, S3 ingestion, Lambda query API, and CloudWatch observabi...
Null is not zero: six numbers I read wrong this month
I spent three weeks reading my own numbers wrong, and every mistake had the same shape: the...