blog

Six things worth reading before you deploy an agent

Long-form research on what AI coding agents actually do on a machine, and how to secure them. Fewer posts, kept current.

Latest

What is AI agent runtime security? The definition, the three layers, and how to evaluate it

AI agent runtime security is the control layer that watches what an AI agent actually does while it runs: the tool calls it declares, the processes and files it touches, the connections it opens. Here is the definition, the three layers, why it is a new category, how it stacks with AI firewalls, gateways, EDR and red-teaming, and the five questions to ask any vendor.

May 24, 20268 min readUpdated Sep 11, 2026

Behavioral security for AI agents: what the agent declared vs what the OS recorded

Behavioral security for AI agents scores what an agent actually does at the OS level, as a sequence, against what it declared it was doing. Four sourced incidents where every single step was permitted and the sequence was still a breach, how the two-layer approach catches that, and where it sits next to prompt filters, gateways, and EDR.

Apr 30, 202610 min readUpdated Sep 11, 2026

Claude Code security: the permission model, the advisories that got around it, and a hardened settings.json

Claude Code asks before it acts, and that is the best default in the category. It is also a process running as your user with a shell, a network stack, and a config directory a cloned repo can write to. Thirty published advisories show where the prompt was not the boundary, and what to configure so it is not your only one.

Apr 30, 20268 min readUpdated Sep 11, 2026

Cursor security risks: the defaults, the CVEs, and what to lock down

Cursor's agent edits files without asking, a classifier model now approves its shell commands, and for most of 2025 its MCP config trusted a name instead of a program. The verified risks, with primary sources, and what to configure before Monday.

Apr 30, 20268 min readUpdated Sep 11, 2026

The MCP security checklist: ten checks before you trust an MCP server

An MCP server runs with your shell, your keys, and your files, and its tool descriptions are read by the model, not by you. Ten checks to run before you connect one, each with the command that does the work.

Apr 30, 202610 min readUpdated Sep 11, 2026

The AI agent threat model: five attack classes and the layer that catches each

An AI agent cannot tell which of its inputs is allowed to give orders. That is the whole threat model. Here it is as a map: five attack classes, one verified incident for each, and the layer where each one became visible, on the device or inside the vendor's cloud.

Apr 9, 20268 min readUpdated Sep 11, 2026