Security in working systems.
Documented failures, constructive defenses and careful readings of the evidence. Each piece starts from one question: what can go wrong when this agent gets access, and what should change before you trust it?
Latest · Examine the defense
Done is not a receipt
A task can finish and still leave an unknown effect, an unsettled charge or an unowned server. A reproducible harness lab and practical contracts for deciding what happens next.
Contract fixtures + Docker labOctober 1, 20266 min read
What the agent said is not what the process did
A command hook blocked a direct write and missed three equivalent forms. A read-only mount stopped their effects. What one small lab shows about monitoring and enforcing an agent's authority.
Filesystem lab · 8 casesOctober 1, 20267 min read
Did the defense work—or did the agent stop doing the job?
A prompt-injection detector cut attack success from 48% to 8% in AgentDojo's published runs—and cut runs where the task succeeded and the attack failed from 30% to 19%. What 2,178 run records show about judging a defense.
Reanalysis · 2,178 runsSeptember 25, 20267 min read
Your agent can have permission to do the wrong thing
Which boundary separates valid access from authorized disclosure? A reported GitHub MCP case and four layers of authority.
Source analysisSeptember 16, 20268 min read
What does your agent's sandbox actually contain?
Read access, write access and remote authority are different boundaries. A constructive review of what a sandbox can—and cannot—establish.
Source analysis + pilot · 1 client observedSeptember 16, 202611 min read
Private context, public output: where should the release decision live?
An agent reads a private change record to write a public SDK note. Three designs for the private-to-public boundary, and why a reviewed artifact with a constrained publisher is the place to start.
Worked example · fictionalOctober 22, 20268 min read
What exactly did you approve?
A reviewer edits an agent's tool call. The tool gets the replacement; the transcript keeps the original. Which record shows what was authorized, what changed and what actually happened?
Pinned code · tests run + dispatch captureOctober 22, 202611 min read
When memory becomes an instruction
A fact learned from a document is useful in the next session. A permission claim in the same document is not an authorization. How to let memory carry the first without the second.
Pinned code · request capture + local model runsOctober 22, 202611 min read
When the tool changes, what happens to your approval?
A tool name can stay the same while its description, its handler or its credentials change. Which changes invalidate an approval, and where can a system detect them before they matter?
Pinned code · 3 clients observedOctober 22, 202611 min read
Retrieval is not permission
An agent can cite the right internal document and still hand it to the wrong reader. Follow the audience from source to index, cache, citation and action, using Microsoft's pinned Azure search demo.
Pinned code · scripted pilot, 10 of 15 cases runOctober 22, 202610 min read
How much autonomy does this job need?
An agent can investigate freely inside a narrow boundary. A worked supplier-research example shows how to allocate decisions, define completion and make an approval worth giving.
Analysis · worked exampleOctober 22, 20268 min read
Build a research assistant whose work you can use
A fictional documentation-search decision shows how to brief a research agent so its result can be checked: traceable claims, named uncertainty, a reversal condition and a stopping rule.
Analysis · fictional worked exampleOctober 22, 20269 min read
The cheapest agent can be the most expensive workflow
A ten-cent model call can leave an expensive job for its reviewer. A hypothetical cost model compares workflows on the cost of an accepted outcome, including setup, maintenance and break-even volume.
Analysis · hypothetical cost modelOctober 22, 20268 min read
What does an agent need to remember?
A handoff must preserve current instructions, supporting evidence, completed work and unresolved state, so a changed requirement reopens the conclusion instead of surviving it.
Analysis · fictional continuationOctober 22, 20269 min read
Your coding agent's reviewer needs evidence
A coding agent and its reviewer agree a date filter is correct; both miss the midnight boundary. What to ask a reviewer, what a usable review packet contains and why agreement alone is not evidence.
Analysis · fictional review packetOctober 22, 20268 min read
When more agents are worth it
Parallel work can buy useful capacity when its returns fit together. Compare independent research branches with a software change whose shared contract must come first.
Analysis · illustrative schedulesOctober 22, 20268 min read