Posts

AI-scale discovery did not break patching. It broke triage. Prioritisation frameworks rank vulnerabilities so you can act on some and defer others, and on a Windows cumulative update that ranking buys you nothing — you take the applicable contents whole or you take none of them. The September 2026 release and the RDS regression it carried are the same event seen from both ends. What follows: why the three default responses are all bad, why conventional validation was never going to catch this class of regression, and what changes when rollout, compensating controls and validation stop being things humans do by hand once a month.

If your SOC runs a SIEM, a SOAR, a vulnerability scanner and an EDR from four different vendors, the gap between them is not a plumbing problem — it is a decision and authorisation problem, and no vendor has an incentive to solve it for you. The design, up front: a language model to read the unnormalised residue between those tools, a deterministic floor it may raise but never lower, an allowlist that authorises rather than describes, an action budget capping how much of the estate can be affected at once, and the containment credential held where the model cannot reach it. Ends on the 03:00 question — do you let it act alone — and on the fact that most organisations already answered by accident.

A repo config that runs code on open is twenty years old — tasks.json, npm postinstall, git hooks. We built the countermeasures too: Workspace Trust, git not shipping hooks on clone, direnv re-blocking on any change. The AI editors regressed on all of it, then added the new part: the config now writes itself from untrusted input, executes before any classifier or prompt gets a vote, and lands with your account’s access to everything you’ve authenticated. Closes with an operator’s appendix: how to lock it down, and where the file hides. Part three of a series, on the device.

UAC, sudo, and macOS auth gate vertical escalation — user to root. A coding agent’s blast radius is horizontal: the full reach of an already-authenticated user, which almost nothing mediates once you’ve signed in. We learned the everyone-is-Administrator lesson in 2007. The agent put us back in 2004, and this time the malware says please. Part two of a series, on the device.

Every hop an agent makes has to answer two questions: whose authority is being exercised, and which agent exercised it? Lose either and your role model, your audit trail, and your incident response are fiction. Part one of a series, from the web tier down to Active Directory.

When npx skills add ships an agent capability the same way npm install ships a library, a large part of governance stops looking novel and starts looking like supply chain. The muscle to handle this exists. The OS just started cooperating. The missing pieces are a real capability manifest and stateful execution policy — and someone needs to ship them.

Notes on actually running models locally on an M4 Max: omlx as the server, Qwen3.6-35B-A3B and GLM-4.7-Flash for agent work, gpt-oss-120b for writing. Why pointing Claude Code at localhost is fine for offline ergonomics and wrong as a perimeter.

The third time this year I have written down the same epistemic mistake. Auto-accept loops in agentic IDEs trust a classifier to be a control. Real bypasses already exist. The sufficiently motivated attacker problem is now sitting on your laptop, deciding which files to edit while you make coffee.

Detection asks ‘is this input adversarial?’ Identity asks ‘what is this principal allowed to do, on whose behalf, right now?’ The first is probabilistic and bypassable. The second is enforceable and auditable.

Defenders can deliberately plant content in their environments that triggers the refusal vectors of attacker-controlled agents. Against the median lazy adversary it works. Against a determined one with an abliterated model it doesn’t. Either way, it is a sensor — not a control.