Tag / The engineering notebook
AI Security
6 articles and notes on this topic.
October 2026 in Security: Attackers Went for the Keys, and AI Outpaced Our Patching
October 2026 showed two shifts at once: attackers went after the places where credentials pile up, and AI started finding bugs faster than most teams deploy fixes. Here is what Binance, LiteLLM, Railway, ConnectWise, PHP2Shell and Node2Shell teach, and the changes developers and IT leaders should make now.
Version One Is Cheap Now. What ArtCraft's AI-Built Clones Teach Software Engineers
In two weeks, one small team used coding agents to publish open-source reimplementations of Photoshop, Premiere, Acrobat, Word and Excel. I read the repositories to see how they were built, how far along they really are, and what commercial users still depend on. My conclusion: version one of software is becoming cheap, and the valuable work moves to fit, verification, support and risk.
I gave my website tools for AI agents with WebMCP, and thought hard about the attack surface
WebMCP lets a web page hand callable tools to browser AI agents instead of making them scrape the DOM. I wired three read-only tools into this site. The interesting part was not the API. It was deciding what an agent, or a prompt injection riding one, is allowed to do.
The Bottleneck Moved to Review: My SDLC After AI Writes Most of the Code
When a machine writes most of your diff, the constraint stops being how fast you type and becomes how well you review. Here is the SDLC I actually run (the provenance audit, the sandbox, the CI backstops, and the three questions I ask every AI-authored change) plus the parts of review that don't compress and never will.
I put an AI version of myself online, then tried to break it
Building a represent-me chatbot is a weekend project. Treating it like a production security surface is the part nobody writes about. Here is the architecture, the prompt leak I found by attacking my own bot, and the reusable suite that keeps it honest.
OpenClaw: Security is the Final Boss
OpenClaw, formerly Clawdbot, runs a personal AI agent locally and wires it straight into your messaging apps. Its gateway architecture, the security failures that followed, and what building a safe autonomous ecosystem would actually take.