Ai-security
Explore the latest content and insights.
I gave my website tools for AI agents with WebMCP, and thought hard about the attack surface
WebMCP lets a web page hand callable tools to browser AI agents instead of making them scrape the DOM. I wired three read-only tools into this site. The interesting part was not the API. It was deciding what an agent, or a prompt injection riding one, is allowed to do.
The Bottleneck Moved to Review: My SDLC After AI Writes Most of the Code
When a machine writes most of your diff, the constraint stops being how fast you type and becomes how well you review. Here is the SDLC I actually run (the provenance audit, the sandbox, the CI backstops, and the three questions I ask every AI-authored change) plus the parts of review that don't compress and never will.
I put an AI version of myself online, then tried to break it
Building a represent-me chatbot is a weekend project. Treating it like a production security surface is the part nobody writes about. Here is the architecture, the prompt leak I found by attacking my own bot, and the reusable suite that keeps it honest.
OpenClaw: Security is the Final Boss
OpenClaw, formerly Clawdbot, runs a personal AI agent locally and wires it straight into your messaging apps. Its gateway architecture, the security failures that followed, and what building a safe autonomous ecosystem would actually take.