3 posts
Blog
What I built, what broke, and what I would do differently.
Your agent's permission check only guards its own door
A permission check only governs the calls that pass through it. This week I read a case study where an agent was denied access to a config file, the check held, and the file changed anyway.
The AI wrote it confidently and it was completely wrong
The code looked right. It compiled. The variable names made sense. The API it called does not exist. I've stopped being surprised by this. I've started building around it instead.
Your build config is code, so review it like code
Someone ran git pull, then npm run build, and got malware. No new package, no strange file opened. The payload was sitting in vite.config.js, carried in by a merge commit that looked legitimate.
One email a week
New posts and nothing else. One click to leave.