7 min read
Invisible From the Layer Above
Seven defects surfaced in one migration. None of them crashed, none failed a test, and none turned a dashboard red. A broken control and a working control send the same signal: silence.
Tagged: appsec
14 posts tagged with “appsec”
7 min read
The Refusal Was the Exploit Path
An agent refused to run the attacker's binary, then wrote its own decoder and ran the payload anyway. Three incidents and one of our own show the same thing: a constraint you hand an agent is a preference it can route around.
6 min read
Nobody Can Tell You Who Wrote the Bug
A tidy-up PR removed a safety pattern from a Snowflake workflow. Five days later an autonomous agent had a Jira token. The headlines said an AI wrote the bug; the commit history cannot actually tell you who did, and that is the more serious problem.
7 min read
You Trusted the Folder. The File Changed.
Five CVEs across four vendors in thirteen months, all the same bug: your coding agent trusts a directory, then executes a file that can change underneath it. Here is the pattern, and the one line in Claude Code's restricted mode that actually fixes it.
4 min read
SKILL.md Is the New package.json — Treat Your Skill Library Like the Supply Chain It Is
Agent skills are unsigned, executable third-party code — a supply chain most teams install on vibes. How to govern your skill library like one.
5 min read
Finding Bugs Got Cheap — Trusting the Fix Is the New Hard Part
Anthropic just open-sourced its AI "defender's loop." The real lesson isn't about C code — it's that the bottleneck moved from finding vulnerabilities to trusting what your agents tell you, and that's a governance problem you own.
7 min read
Why We Failed Our Agent-Readiness Audit on Purpose
An automated audit gave us nine recommendations for being 'agent-ready.' We shipped three and deliberately failed the other six — because a security firm's agent-readiness is measured by signal honesty, not checkbox coverage.
10 min read
The AppSec Acceleration: Why Your Security Tools Can't See Agent Vulnerabilities
Traditional SAST, DAST, and SCA tools were built for request-response architectures. Agent-first systems have vulnerability classes these tools were never designed to detect — and independent research just confirmed it.
15 min read
Specification as Attack Surface: Why Ambiguity Is a Vulnerability in Agent-First Architectures
Ambiguous specifications aren't just a project management problem anymore. In agent-first architectures, every gap in a spec is a potential security boundary violation — and the agent won't tell you it's guessing.
11 min read
The OWASP Top 10 for Agentic AI Is Here — What It Means for Your Deployment
OWASP released its first Top 10 for Agentic Applications. Here's what each risk means, why traditional AppSec frameworks fall short, and how to start securing your AI agents today.
10 min read
How We Work: Security Engagements
What a security engagement with Atypical Tech actually looks like — from the first call to the final deliverable. No mystery, no overhead, no surprises.
15 min read
The Interface Security Imperative
Every tool an agent can call is an attack surface. In agent-first architectures, the integration layer is the primary security boundary — and most teams aren't treating it that way.
7 min read
Safe Autonomy for AppSec: Where AI Agents Actually Help
How the Safe Autonomy framework applies to vulnerability triage, alert correlation, compliance evidence, and security testing. AI agents can multiply your security team—if you build the right guardrails.
7 min read
Security Architecture for Startups: What Actually Matters
Right-sized security for seed-to-Series-B. What actually matters, what can wait, and the mental model that scales.