Notes
Short pieces about the methodology and architecture decisions behind the AI systems I ship — specs, evals, multi-agent orchestration, LLM integration, and the discipline of directing coding agents.
June 13, 2026
The webpage can give your agent orders
When you give an AI agent a browser and let it read web pages, click buttons, and run commands, you've handed control of it to every page it visits. Researchers have shown agents hijacked by instructions hidden in website text, in pastebin links, even invisibly inside screenshots the agent looks at. It's called indirect prompt injection, and it's the number-one risk on OWASP's list for LLM apps. The agent can't tell your instructions from the page's. Here's why this is so hard to fix, and how to build so a hostile page can't run your agent.
- security
- agents
June 13, 2026
Your agent's plumbing is wide open
The first large-scale scan of remote MCP servers — the connectors that let AI agents reach your tools and data — found that roughly 40% expose their tools with no authentication at all. Censys counted 12,520 internet-reachable MCP services, most of them unauthenticated. A separate sweep of 40,000 server repos produced 67 new CVEs. The agent boom shipped a new layer of plumbing into production faster than anyone secured it, and right now a lot of it is unlocked. Here's the risk in plain terms and what to check today.
- security
- agents
June 12, 2026
The AI deciding what you pay
There's a quiet thing AI made possible that most people don't know is happening: the price you see may have been set just for you, from your own data — your location, your browsing, whether an algorithm thinks you're a stressed new parent who'll pay more. It's called surveillance pricing, and it's different from normal dynamic pricing. Regulators are now moving hard against it — New York makes you disclose it, Maryland banned parts of it, two dozen states have bills. Here's what it is, why it matters to you, and the line every builder should think about.
- business
- security
June 11, 2026
Shadow AI is your real breach
When companies picture an AI security incident, they imagine a rogue model or a compromised agent. The leak actually happening at most companies is far more boring: their own employees pasting confidential data into AI tools nobody approved. 71% of workers have used unapproved AI at work, 57% actively hide it, and one in five organizations has already had a breach tied to it — at about $670,000 a pop. The fix isn't a ban. Bans are why it's hidden in the first place.
- security
- business
June 11, 2026
You can't tell what's real anymore
A new survey found that 85% of people say they can no longer tell real content from AI-generated content — up from 66% a year ago. 84% say 'convincing video evidence' no longer feels like proof. The default assumption the entire internet ran on — what I see is real — just broke for nearly everyone. That's not only a scam problem. It quietly changes what every product has to do: when authenticity can't be assumed, trust stops being free and becomes something you have to build.
- security
- business
June 10, 2026
The risk was never the model. It's the system around it.
The most authoritative AI safety body in the world — a hundred-plus experts chaired by Yoshua Bengio, backed by thirty governments — just landed on a quietly deflating conclusion: the most pressing AI risks come less from the models themselves than from the systems companies build around them. Not the sci-fi misaligned superintelligence; the integrations, the permissions, the business processes a small error propagates through. For builders that's good news, because it means AI safety is mostly a job you can actually do.
- architecture
- security