~/blog/tag/security
Security
On security, privacy and building safe systems.
What I write about here
Security on this site shows up in two flavours. There is the new kind, where the risk surface is shaped by AI and agents, and there is the old kind, where the question is who owns your data and your infrastructure.
The AI-shaped kind is what most of the recent posts cover. Agents that act on production, prompt injection in tools you forgot were exposed, and the slower problem of security debt accumulating quietly in AI-generated code that nobody has the appetite to audit. One in four of those commits is somebody else's problem now.
The older kind has not gone away. You still need to know where your data lives, who has access to it, and what happens when the SaaS you are leaning on changes its mind about your tier. The self-hosting posts are not nostalgia. They are about control, which is the thing security ultimately rests on.
Both lenses ask the same question. What does a competent attacker do with what you built today, six months from now, when you have stopped paying close attention? Most of the posts under this tag are some version of that.
The AI-shaped half of that story now has a fixed route: the MCP and security guide.
best entry points
- Prompt injection defense for developers who ship agents
The defence that holds. Not the demo with the poisoned web page, but the attack surface of your own setup.
- Nobody was driving: the first breach run by an agent, not a person
The first intrusion an agent carried out on its own. Four pivots, one hour, nobody at the wheel.
- Claude Code permissions: the guide I wish the docs were
What an agent may do, as one model: modes, allow and deny rules, hooks and the sandbox. The guide I was missing.
Read-only database access for Claude: the role, the flag and Azure without passwords
Every SQL MCP server promises a read-only mode, and fourteen of them turned out to have a way around it. I ran the bypasses against a read-only role on Postgres and SQL Server, then looked at what passwordless Azure sign-in does to the same setup.
read- 14checkouts with dependency instructions
Your dependencies ship a CLAUDE.md, and Claude Code reads it
I audited every instruction file that could steer Claude Code across 40 repositories on my machine. In 14 of them, the files nobody would think to check were written by package maintainers, sitting in node_modules and vendor, and Claude Code loads them the moment it reads a file next to them.
The patch is the exploit now
PHP pre-announced a critical security release, and a proof of concept claiming remote code execution was online before the fix. In the same week Firefox started hiding its security tests and curl started publishing its minor bugs. Both are answers to the same thing: a patch now explains its own bug to anyone with a model.
- 14.5%agent calls blocked
Claude Code auto mode: why your Agent allow rule does nothing
In a month of one repository, the Claude Code auto mode classifier blocked 86 of 594 subagent launches, mostly ordinary code reviews. Adding Agent to the allowlist changed nothing, because auto mode drops that rule on entry. Retrying the identical prompt went through 24 times out of 26.
Your upload validator passed. Your server still got owned.
Bricksforge checked that an upload was an image, then trusted the browser to decide where its contents ended up. The lesson is in the handoff: a correct check can protect the wrong part of your workflow.
Nobody's agent went rogue
The FTC chair says AI agents are tools, and the developer who gave the instruction is liable. He is right about the tool and wrong about the instruction. The traces of the Hugging Face attack show an agent doing a great deal more than the task asked.
You installed OpenAI's tracker yourself
On shops that run OpenAI's ads pixel, your browser sends along a cookie tied to your ChatGPT account. The pixel is there because a developer pasted a snippet into a head tag, and the consent flag in the docs fires too late to stop it.
Plugin4Shell: a pinned plugin is only pinned if something checks where it landed
Air showed that Claude Code, Codex, Copilot and Gemini CLI all asked git for the commit a marketplace pinned without checking that they got it. I reproduced it in git, watched Claude Code refuse it, and found the same hole in my own CI runner.
- 63%servers in lowest risk band
MCP server security scores are review prompts, not verdicts
An MCP server security score looks like a verdict. Measured across 74,101 servers, most of what a scanner tells you is a heuristic, and the state it almost never shows you is that nobody read the source.
Slopsquatting: checking that the package exists is not a defence
The standard advice against AI-hallucinated packages is to verify the package exists before installing. I checked four names from the latest research against PyPI. All four resolve. The registry answers the wrong question, in both directions.