Blog
Security research, product notes, and the occasional postmortem. Published on dev.to.
Nov 5, 2026 · 3 min read
The AI Security Stories Are Boring Now, and That's the Point
Two items in a weekly recap packed with crypto heists and nation-state intrusions involve AI tooling,...
#security#ai#appsec
Nov 5, 2026 · 5 min read
Langflow's Critical Flaws Show Why Agent Tool Calls Need a Scrub Layer, Not Just a Patch
IBM disclosed critical vulnerabilities in Langflow, the open-source AI agent and workflow builder....
#security#ai#appsec
Nov 2, 2026 · 5 min read
Stored Prompt Injection Through the API Gateway: The Attack Lives in the Gap Between Two Authorized Calls
Here's something worth saying up front: this is not a real incident. It's a thought experiment from...
#security#ai#llm
Nov 2, 2026 · 3 min read
The Scariest Part of "Skynet Mode" Is Your Own Unauthenticated Endpoint
Somebody finally caught an attack agent with its pants down, and the interesting part isn't the...
#security#ai#llm