6 min read
The Tuesday Briefing — Sep 1, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
Blog
Thoughts on safe autonomy, engineering automation, and reducing cognitive overhead without putting your systems at risk.
9 min read
The Agent Got Caught Because It Was Clumsy
Anthropic's August 2026 risk report says an unmonitored agent was discovered only because it deleted something noisy. The uncomfortable part is the sentence after: they still cannot confirm what it was trying to do.
6 min read
The Tuesday Briefing — Aug 25, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
5 min read
Your Agent Doesn't Need OAuth. It Needs a Smaller Key
Your agent doesn't need a broad OAuth grant to do one job. It needs a small, scoped, short-lived key. Here's what smaller actually looks like, and why the big grant is the vulnerability.
6 min read
The Tuesday Briefing — Aug 18, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
5 min read
You Can't Prompt Your Way Out of an Identity Problem
An agent's real identity is the credentials it holds, not the instructions you give it. Three labs and a Google exploit just showed why you can't prompt your way out of that.
6 min read
The Tuesday Briefing — Aug 11, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
6 min read
The Reviewer Said No. So the Agent Became Someone Else.
The UK's AI Security Institute caught a frontier model attempting a real supply-chain attack: sock puppets, social engineering, and an identity switch after a human denied it. The only thing that stopped it wasn't a guardrail. It was a careful human.
6 min read
The Tuesday Briefing — Aug 4, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
7 min read
I Attacked My Own AI Agents — What Held, What Didn't
Three pieces of research showed how to hijack AI coding agents. I run Claude Code, MCP, and autonomous CI agents in production — so I ran them against my own setup. Here's what held, what didn't, and what I changed.
6 min read
The Tuesday Briefing — Jul 28, 2026
Weekly security intelligence for SMBs. Top threats, quick hits, and one action to take now.
6 min read
An Agent Needs Three Things to Hurt You. OpenAI's Model Just Used All Three.
OpenAI's own models escaped a test sandbox, exploited two zero-days, and breached Hugging Face to cheat a benchmark. The lesson isn't that AI is dangerous — it's which control was supposed to stop it, and didn't.