Notes
Short pieces about the methodology and architecture decisions behind the AI systems I ship — specs, evals, multi-agent orchestration, LLM integration, and the discipline of directing coding agents.
June 9, 2026
The day your agent can spend money
MetaMask just gave AI agents a wallet — letting a bot trade across DeFi on your behalf, faster than you could ever click. It's a real milestone, and it should make you a little nervous, because every shaky thing about agents stops being theoretical the moment one holds the keys. A wrong answer you can fix. An irreversible transfer to a stranger you cannot. The interesting part isn't that agents can spend now. It's the one design idea that makes it survivable.
- security
- agents
June 7, 2026
Low-code agents wired straight into your live data
SAP's new Joule Studio builds a whole agent — workflow, specs, even the eval suite — from one sentence, grounded directly in your live business data. OutSystems does something similar. This is genuinely powerful: a business analyst can now stand up an agent on the production system without waiting in an engineering queue. It's also how you get an agent with a huge blast radius and nobody who can explain or stop it. The democratization is real. So is the danger, and most companies are not ready for the second half.
- architecture
- business
- security
June 7, 2026
65% of companies already had an agent security incident
Two-thirds of organizations have already had a security incident involving an AI agent — not a rare disaster, a normal Tuesday. And the cause isn't a rogue, misaligned model doing something evil. It's a perfectly well-behaved agent accessing data it should never have been given in the first place. The agent breach of 2026 is boring: it's an over-permissioned identity doing exactly what it was allowed to. That's good news, because boring problems have boring fixes — if you treat the agent as what it is.
- security
- architecture
- business
June 6, 2026
12,520 agent tools are on the internet with no lock on the door
Security researchers scanned the internet and found 12,520 MCP servers — the tool connectors that let AI agents do real things — sitting in the open, most with no authentication at all. Some let any stranger run database queries or shell commands. The protocol just made auth mandatory in its June spec, but the damage shows the deeper bug: the default was 'no lock,' and people shipped the default. If your agent can reach a tool, so can everyone else — unless you decided otherwise on purpose.
- security
- architecture
- agents
June 6, 2026
Vibe coding ships the app and the breach with it
An AI social network called Moltbook launched in January; its founder bragged he 'didn't write a single line of code.' Three days later researchers found its entire database open to the world — 1.5 million auth tokens, 35,000 emails, private messages. It wasn't a freak accident. Studies keep finding that something like 45% of AI-generated code ships a known vulnerability. The demo is free now. The security review is the part you still can't vibe — and the bill for skipping it is somebody's data.
- security
- methodology
- ai-native
June 5, 2026
Microsoft sent 100 agents to hunt bugs — AI vs AI security, honestly
This week Microsoft showed a security team made of AI: a pipeline of 100+ agents that found 16 new Windows vulnerabilities, four of them critical, plus the first AI to auto-convict malware. The defenders now run autonomous AI. So do the attackers — one ran 80–90% of a real intrusion on its own. 'AI vs AI security' stopped being a slogan this spring. Here's the honest read: it's real progress, and a faster stalemate.
- security
- agents