Writing

My weekly take on AI security — the one signal worth holding onto from each Context Window edition.

Latest · Edition #28

Recognition Is Not Resistance

An agent can name the attack being run on it, explain exactly why the request is dangerous, and comply in the same breath. That is not a model being fooled.

“An agent can name the attack being run on it, explain exactly why the request is dangerous, and comply in the same breath.”

The Model Decides What. Context Decides Whether.

“Three security models landed in eight days, and they didn't land in the same shape.”

July 27, 2026 · #25

The Guard, Not the Wall

“Sandboxes are good at that: watch the doors, watch the windows, lock down what a process can touch.”

July 20, 2026 · #24

The Swarm Isn't Here Yet. The Speed Already Is.

“Here's the part of this week that stuck with me.”

July 13, 2026 · #23

You Can't Lower the Odds Anymore. Lower the Blast Radius.

“Risk has always been the same equation: how likely a compromise is, times how much it costs when it lands.”

July 6, 2026 · #22

Every Input Is a Potential Instruction

“Every input an agent consumes is a potential instruction.”

June 29, 2026 · #21

The Level Playing Field Is Ending

“For a few remarkable years, the best AI on earth was a commodity.”

June 22, 2026 · #20

The Autonomous Adversary

“For as long as we've defended systems, one quiet constant held the whole game together: an attack moved at the speed of a person.”

June 15, 2026 · #19

The Wall Faces the Wrong Way

“A US export-control directive made Anthropic shut off two of its most capable models for every customer on earth at once.”

June 8, 2026 · #18

Posture Belongs at Runtime

“And they're right to, getting a model to ignore its rules is a real problem.”

June 1, 2026 · #17

Posture Has to Become Agentic

“Two numbers from this week have been rattling around in my head.”

May 25, 2026 · #16

The Attacker Doesn't Need Your Bugs

“The extension had access to a developer's credentials.”

May 18, 2026 · #15

The race changed speed.

“TeamPCP didn't just attack again this week.”

May 11, 2026 · #14

"Look, an instruction!" That's the bug.

“Every week this newsletter covers a new place an attacker hid an instruction, and a new AI assistant that found it and ran it.”

May 4, 2026 · #13

When Trust Is the Exploit

“The angle that stuck with me this week isn't about any single vulnerability.”

April 27, 2026 · #12

Three Layers, Three Attack Surfaces, One Agent

“Most security teams are securing one layer.”

April 20, 2026 · #11

Every Consultancy Is a Honey Pot Now

“The Big Three consulting firms don't just advise on AI.”

April 13, 2026 · #10

Anthropic’s Oppenheimer Moment

“They did something more permanent: they told the world it exists, it works, and it finds zero-days in every major OS and browser, some of them sitting undetected for 27 years.”

April 6, 2026 · #9

Instructions Are Not Guardrails

“North Korea convinced an npm maintainer to trust an AI-generated persona by writing technically convincing messages for two weeks.”

March 30, 2026 · #8

Zero Day to Zero Second, When Security Tools Become the Weapon

“The TeamPCP campaign broke three security reflexes we've relied on for decades.”

March 23, 2026 · #7

AI Didn’t Create New Vulnerabilities, It Made Old Ones Affordable

“Infrastructure was never fully hardened, and for years, it didn't need to be.”

March 16, 2026 · #6

Built-in AI Security Is a Sensor, Not a Solution

“OpenAI buying Promptfoo is genuinely good news for the industry.”

March 8, 2026 · #5

Zero Trust for Agent Memory

“A decade ago, the industry made a fundamental shift: stop trusting internal network traffic.”

March 1, 2026 · #4

Not All Agents Are Built Equal, Why Posture Management Must Evolve for Non-Deterministic Risk

“Pro-code agents behave like traditional apps, deterministic, scoped, predictable.”