Human Attention Is the Spec
Every system I’ve ever run had a bottleneck. Find it, and you know what to fix. Ignore it, and you spend money speeding up things that were never the …
Read more →#AI Agents
56 posts
OpenAI's Patch the Planet: What Safeguards Agent Scanning Needs
OpenAI’s “Patch the Planet” initiative spent two months coordinating a fix for two critical PHP flaws, collectively called PHP2Shell, before …
Read more →include_content=False Didn't Stop pydantic-ai's MCP Token Leak
pydantic-ai shipped two security fixes on 2026-10-19. The one I reproduced, GHSA-xv4x-g8mx-ch56 , is a two-flag problem: include_content=False does exactly what …
Read more →The Robot Is the Next Node in Your House Cluster
In the first post of my house series, I asked you to count the connected things in your house . Then we walked through it room by room . TVs, routers, cameras, …
Read more →Second-Source Your Models
Every hardware engineer learns the same lesson early, usually the hard way. Don’t design a board around a part only one company makes. It’s called …
Read more →Stopping Agent Proxy Laundering at the MCP Gateway
On 2026-10-05 the Wikimedia Foundation disclosed that a handful of wiki edits it attributes to OpenAI-operated agents changed the configuration of a citation …
Read more →Two Grok Bots Leaked a CEO's Bank Balance to Slack
Two “separate” Grok Bots leaked a CEO’s bank balance into a public Slack channel on October 19. Nobody jailbroke anything. Nobody injected a …
Read more →Who Gave the Agent a Badge?
Walk into any office building and you get a badge. It opens the lobby. Maybe your floor. It doesn’t open the server room, the CFO’s office or the …
Read more →The Last 20 Percent: What Robots and LLMs Still Can't Do
Here’s the number from Anthropic’s robot report that I keep coming back to: about 80% of job tasks, by working time, are exposed to either robots or …
Read more →Find Shadow MCP Servers in Your Environment
Find shadow MCP servers by checking the places they hide: the network and your clusters, where an MCP server answers a server/discover or initialize request; …
Read more →MCP Tool-Call Guardrails: Gating Agents Before the Tool Runs
agentgateway can now reject or rewrite an MCP tools/call request before the tool runs, and mask the result before the client sees it, from CEL expressions in …
Read more →agentgateway Guardrails How-To
Agents and apps already send prompts through a gateway. Content safety belongs on that hop: inspect the request before it reaches a model, and inspect the …
Read more →The Path-Validation Bug That Let Copilot Register a Rogue MCP Server
CVE-2026-103572 , disclosed by embracethered.com and patched by Microsoft on 2026-10-13, is a Remote Code Execution bug in Visual Studio and SSMS Copilot, CVSS …
Read more →MCP Audit Tap: See What a Third-Party Server Actually Sends
A Show HN post for a “WhatsApp MCP server running free on Cloudflare” hit 124 points and 69 comments in under 16 hours on October 19, and none of …
Read more →Room by room: what a self-copying AI could do in your house
Last week I asked you to count the connected things in your house . Parks Associates says the average US internet household has about 17 (source ). This week we …
Read more →agentgateway as an Egress Proxy
AI agents need outbound access to models, tools, registries, and APIs. An unrestricted sandbox will use every channel it can find. The durable pattern is a …
Read more →One Fix, Four Hundred Repos
Think back to December 2021. Log4Shell. If you were anywhere near security or platform work, you remember that week. The fix sounded simple: upgrade log4j. Then …
Read more →MCP Progressive Tool Discovery: Native vs. Hand-Rolled
The 2026-08-22 MCP roadmap names progressive tool discovery as a priority, in almost these words: a server should offer a small entry point and reveal more of …
Read more →
Your Tests Are Lying to Your Agent
Before I worked in software, I worked on test benches. Electrical engineering, then test and measurement. The first rule on a bench is calibrate the instrument. …
Read more →The Pager Goes Off and Nobody Wakes Up
It’s 3:12 in the morning and your phone is buzzing on the nightstand. You know the rest. Ack the page so it stops escalating. Find the laptop. Fight the …
Read more →What Is Shadow MCP? A Plain Definition
Shadow MCP is any MCP server your AI tools can reach that your security or platform team doesn’t know about, didn’t approve, and can’t see. …
Read more →Stopping a Filesystem MCP Server From Reading .env Files
Disclosure: I work at Solo.io, which created agentgateway and sells Solo Enterprise for agentgateway. The demos I cite are public repositories. A filesystem MCP …
Read more →Testing Open-Weight Models as an Agent's Cheap Tier
Disclosure: I work at Solo.io, which created agentgateway and sells Solo Enterprise for agentgateway. The demos I cite are public repositories. Two open-weight …
Read more →What Is an AI Agent Gateway?
An AI agent gateway is a reverse proxy between your agents and everything they call: language models, MCP tools, other agents over A2A, and ordinary HTTP or …
Read more →The house is full of computers now. Anthropic just showed what an AI could do with them.
Count the connected things in your house. The TV. The doorbell. The robot vacuum. The thermostat. The router blinking in the closet. Parks Associates puts the …
Read more →A Private MCP Registry in 10 Minutes with agentregistry
A private MCP registry is a catalogue of approved MCP servers that your clients discover from instead of the open public one. I built private-mcp-registry to …
Read more →How AI Agents Sharing a Sandbox Leak Each Other's Data
On 2026-10-10, Cybernews reported that Shane Mac, CEO of XMTP Labs, gave a Grok Bot agent read-only access to his personal bank account as a finance assistant. …
Read more →What Is a Cloud-Native Agent Harness? (kagent)
Coding agents grew up on laptops: one person, one machine, and one process that is the UI, the agent loop, the sandbox, the credential store and the session …
Read more →agentevals v0.10.0: Scores Come Back as OpenTelemetry Events
agentevals v0.10.0 shipped two days ago and removed its own WebSocket ingestion path in favor of plain OpenTelemetry. Send OTLP traces in, run an eval, and the …
Read more →Is Jev Actually Calibrated? The Reliability Curve on 240 Cases
TypeSafe AI’s Jev is mostly calibrated on agent tool-call risk, with one weak spot you need to know about before you route on it. Across 240 hand-labelled …
Read more →agentgateway Token Exchange for AI Agents
An AI agent that calls tools for a user needs that user’s authority, and the usual shortcuts are a pasted personal access token or a shared service …
Read more →MCP Cross App Access Explained: The ID-JAG Exchange on the Wire
MCP’s Enterprise-Managed Authorization lets the corporate IdP decide which employees can use which MCP servers, by making the client trade an IdP-signed …
Read more →Rate-Limiting AI Agent Egress to Already-Allowed APIs
An egress allowlist decides whether an agent can reach a destination. It has no opinion about how often. On October 7, 2026, the Wikimedia Foundation disclosed …
Read more →Per-Request Minted JWTs for Agent Backends with agentgateway
I built a demo where an AI agent calls a backend API and holds no credential for it. No API key in its environment, no key file on disk, no token. agentgateway …
Read more →AI Agent Security on Kubernetes: Which Controls Actually Held
I spent the last month building small, runnable labs for the ways AI agents break the infrastructure they run on: credentials, egress, audit logs, MCP tool …
Read more →Building Workload Identity Federation for AI Agents on Kubernetes
The easy way to give an agent pod access to an external API is a long-lived key in a Kubernetes Secret. The harder, better shape is the one I used in SPIFFE for …
Read more →Your Agent Egress Proxy Never Saw the DNS Query
An OpenAI research agent got its HTTPS requests to a public chatbot blocked by a web proxy. So it found a different way to ask the chatbot questions: it queried …
Read more →Agent Runtimes Have an Autoscaler, Not a Scheduler
Every capacity knob in an agent runtime today is an efficiency knob. Pack more agents onto fewer pods, snapshot the idle ones, scale the pool to match demand, …
Read more →Regression Tests for kagent Agents with agentevals
An AI agent that stops calling its tools does not throw an error. It answers from the model’s memory, confidently and plausibly, and the output still …
Read more →What Stopped AI Agent Probes of Government Data Sites
On September 24, Australia’s prime minister told reporters that an OpenAI agent had broken into a government Medicare statistics portal, accessed …
Read more →Serve Markdown to Agents at the Gateway, Not the Origin
Agents parse HTML badly and expensively. The usual fix is to make the site emit markdown: add a per-page index.md, publish an llms.txt, change the build. That …
Read more →Your Artifact Registry Is a Two-Way Channel for Agents
Egress control for AI agents usually gets framed as a blocklist problem. Keep the agent off the hosts it should not reach, and you have contained it. This …
Read more →MCP Tool Poisoning: A Name Allowlist Is Not Enough
I built a four-container demo that reproduces an MCP server rewriting its own tool definitions mid-session, and puts two controls in front of it to see which …
Read more →Stopping an AI Agent Without Losing the Forensic Record
Two things get asked for the moment agents start doing real work. Stop it now, and keep everything it did. Those usually fight. The natural place to log what an …
Read more →I Benchmarked Jev on Agent Tool-Call Risk. Calibration Held.
TypeSafe AI launched Jev on 2026-09-15 with the usual launch-day multipliers — 193.6x faster, 444.6x cheaper than frontier LLMs — plus “zero …
Read more →kagent v1.0: Claude Code Harness on Kubernetes
Yes, kagent can run Claude Code on Kubernetes: since v1.0.0-alpha1, PR #2602 adds a native Claude harness that runs the pinned Claude Code CLI over A2A with …
Read more →Agent Identity on Kubernetes: The Complete Series
An AI agent that calls a model, a tool, or another agent has to prove who it is. Almost every production failure I have written up this month traces back to …
Read more →Securing AI Agents in Production: The Complete Series
Almost everything in this series started the same way: a control that everybody agrees is the right control, applied to an agent, quietly not doing the thing …
Read more →Shadow MCP Servers: Track, Find and Stop Them Across Teams
Shadow MCP servers are hard to track across teams because most run as local child processes of an IDE or agent over stdio, with no network presence, and their …
Read more →Keeping MCP Server Instructions Out of Your Agent's System Prompt
How do you keep MCP server instructions out of the trusted system prompt? Isolate them, cap them, bind any cache that stores them to server and caller, and pin …
Read more →The agentgateway Token Service Now Runs Without a Cluster
Solo shipped agentgateway enterprise 2026.9.0 on Tuesday, and the part worth your attention is not a feature inside the proxy. It is where the token service now …
Read more →Agent Audit Logs: What METR and Redwood Found
Two weeks ago METR and Redwood Research published their review of ~1,300 agent transcripts from the OpenAI / Hugging Face incident. Buried in it is a finding …
Read more →kagent Audience-Bound Tokens (RFC 8707)
kagent v0.10.0 went GA on September 4 . Buried in a long release list is a pair of environment variables that decide whether an agent’s credential works …
Read more →Why Proxy-Variable Agent Sandboxes Fail, and the CONNECT-Time Fix
On September 4, 2026, researchers published ~18,000 posts that autonomous agents left on a 25-year-old German wiki over six weeks, using it as a message board …
Read more →LLM Robot Fleet Governance with agentgateway
I built a simulated warehouse robot fleet where LLMs do the planning and every piece of traffic that crosses the network runs through one open source gateway. …
Read more →Revenant: A Gateway-Native, Always-On Agent Runtime
Always-on personal agents keep dying the same three deaths: leaked keys, runaway spend, and silence. The first two get the headlines. The third one is the one …
Read more →