~/blog/tag/security
Security
On security, privacy and building safe systems.
What I write about here
Security on this site shows up in two flavours. There is the new kind, where the risk surface is shaped by AI and agents, and there is the old kind, where the question is who owns your data and your infrastructure.
The AI-shaped kind is what most of the recent posts cover. Agents that act on production, prompt injection in tools you forgot were exposed, and the slower problem of security debt accumulating quietly in AI-generated code that nobody has the appetite to audit. One in four of those commits is somebody else's problem now.
The older kind has not gone away. You still need to know where your data lives, who has access to it, and what happens when the SaaS you are leaning on changes its mind about your tier. The self-hosting posts are not nostalgia. They are about control, which is the thing security ultimately rests on.
Both lenses ask the same question. What does a competent attacker do with what you built today, six months from now, when you have stopped paying close attention? Most of the posts under this tag are some version of that.
The AI-shaped half of that story now has a fixed route: the MCP and security guide.
best entry points
- Prompt injection defense for developers who ship agents
The defence that holds. Not the demo with the poisoned web page, but the attack surface of your own setup.
- Nobody was driving: the first breach run by an agent, not a person
The first intrusion an agent carried out on its own. Four pivots, one hour, nobody at the wheel.
- Claude Code permissions: the guide I wish the docs were
What an agent may do, as one model: modes, allow and deny rules, hooks and the sandbox. The guide I was missing.
Plugin4Shell: a pinned plugin is only pinned if something checks where it landed
Air showed that Claude Code, Codex, Copilot and Gemini CLI all asked git for the commit a marketplace pinned without checking that they got it. I reproduced it in git, watched Claude Code refuse it, and found the same hole in my own CI runner.
read →MCP server security scores are review prompts, not verdicts
An MCP server security score looks like a verdict. Measured across 74,101 servers, most of what a scanner tells you is a heuristic, and the state it almost never shows you is that nobody read the source.
Slopsquatting: checking that the package exists is not a defence
The standard advice against AI-hallucinated packages is to verify the package exists before installing. I checked four names from the latest research against PyPI. All four resolve. The registry answers the wrong question, in both directions.
CI runner security when an agent writes your workflow
Self-hosting your forge and your runner is a defensible call in 2026. Nobody writes the CI runner security guide for the platform you moved to, and an agent permission model built around a dialog does not survive the trip into a pipeline.
Claude Code credential masking: keep secrets out of your sandbox
How to configure Claude Code sandbox credential masking so your agent shell holds a sentinel instead of your real token: env vars, JWT claims, AWS re-signing, and the three things this control does not buy you.
Audit logging for AI agents: what Claude Code records and what deserves a human
Your coding agent already writes a detailed audit log to your own disk. Your company's compliance feed does not contain it, OpenTelemetry redacts it by default, and the hard part is still deciding who reads any of it.
The agents left notes for each other
OpenAI's Black Hat timeline of the Hugging Face incident: the message board the agents coordinated through was an internal package registry, and deleting it bought four days.
AI agent incident response: what to do when your coding agent goes wrong
A five-phase runbook for the hour after a coding agent breaks something: freeze the session, reconstruct from the transcript, work out the blast radius, rotate, and fix the permission that allowed it.
Every agent sandbox has the hole that makes it useful
Two agent sandbox escapes in one week, from OpenAI and from Claude Cowork. Both went up a privilege level inside a box that already held the prize, without ever crossing the wall.
MCP server authentication: OAuth, scopes and rate limits
You built an MCP server. The tutorial ended where security starts. How to add OAuth, scoped tokens and rate limits to your own server, with TypeScript and Laravel examples, so it does not join the 12,500 open ones.