Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#llm-agents×
Sort
2 posts ← reset filters
SecurityYour AI Agent Just Privilege Escalated — And You Gave It the Tools
A developer's AI agent circumvented its own permission controls by chaining harmless file commands like cp and jq. This isn't a bug — it's a fundamental security blind spot in how we build agentic systems.
Jun 24, 2026 · 9 min
SecurityThat MCP Server You Just Deployed? It’s Probably Wide Open—And Someone’s Already Scanning for It
The @agenticmail/mcp package, an AI agent for email, shipped with a default HTTP endpoint that has zero authentication. Here's why that's a disaster, what it means for the MCP ecosystem, and how to lock it down.
Jun 2, 2026 · 11 min