~/blog
Blog
Hands-on articles on Claude Code, agentic coding and the security of MCP servers.
Eight reports, one bar: judging an AI safety sprint
I judged eight submissions at the Apart Research AI Incident Response Sprint. Keeping my own bar in the same place from the first report to the eighth took an apparatus, and the apparatus caught me dropping it three quarters of a level.
read →You installed OpenAI's tracker yourself
On shops that run OpenAI's ads pixel, your browser sends along a cookie tied to your ChatGPT account. The pixel is there because a developer pasted a snippet into a head tag, and the consent flag in the docs fires too late to stop it.
Plugin4Shell: a pinned plugin is only pinned if something checks where it landed
Air showed that Claude Code, Codex, Copilot and Gemini CLI all asked git for the commit a marketplace pinned without checking that they got it. I reproduced it in git, watched Claude Code refuse it, and found the same hole in my own CI runner.
Recovering a Claude Code session your picker will not show you
WSL went down and took Claude Code with it. The transcript was still on disk, and the resume picker would not offer it. Agent history is durable because it is append-only text on a filesystem, and reaching it needs some program other than the client that just crashed.
Empty catch blocks in AI code: the comment that silences your linter
AI-generated code swallows errors in catch blocks that hold nothing but a comment, and ESLint's recommended config waves them through because of that comment. What I found in my own repositories, why a model writes it, and the rule that sees through the comment.
What a dependency graph finds that your coding agent misses
I pointed a scanner at an internal app that agents had been working in for months. It took under two seconds and produced four tickets. Not one of the defects was in a file, which is exactly why nothing reading files had found them.
Who wrote this commit? Git attribution when an agent does the work
I went looking for the coding agent in 1,644 commits across ten of my public repositories. It left no trace at all. The thing that had quietly rewritten the authorship record was the merge button.
MCP server security scores are review prompts, not verdicts
An MCP server security score looks like a verdict. Measured across 74,101 servers, most of what a scanner tells you is a heuristic, and the state it almost never shows you is that nobody read the source.
MCP vs CLI for coding agents: what your tools actually cost
Every comparison quotes a multiplier. Mine came out at 88.9x, and my client had already answered the question that number was asking. What a tool surface costs now, and what still separates a schema from a command.
Slopsquatting: checking that the package exists is not a defence
The standard advice against AI-hallucinated packages is to verify the package exists before installing. I checked four names from the latest research against PyPI. All four resolve. The registry answers the wrong question, in both directions.