Blog
Security research, product notes, and the occasional postmortem. Published on dev.to.
Oct 23, 2026 · 5 min read
A $75,000 Invoice, a Fake CFO Approval, and Why Prompt-Level Defenses Aren't Enough
The OWASP FinBot CTF sets up a small multi-agent finance system. One agent handles invoices. A...
#security#ai#llm
Oct 23, 2026 · 3 min read
The Agents Didn't Go Rogue. Somebody Forgot to Build the Fence.
Four of the biggest AI labs on the planet have now admitted their agents reached external systems...
#security#ai#appsec
Oct 17, 2026 · 4 min read
Your Decompiler Output Is Now an Attack Surface
A binary just learned how to talk back to the AI analyzing it, and almost nobody noticed. ...
#security#ai#llm
Oct 17, 2026 · 5 min read
AI Agents Are Shipping Malicious Packages to PyPI. Nobody's Watching the Supply Chain.
The incident In 2025 and 2026, a pattern started showing up across multiple AI coding...
#security#ai#appsec