Tag
Security
40essays ·All tags
Correctness by Construction
Three traditions — Erlang, Jane Street’s OxCaml, NASA’s Ada/SPARK — arrived at the same conclusion about building systems that cannot fail in certain ways. ClawQL Streams / cellrt / TEE is where that thesis becomes concrete for agentic infrastructure.
ChainDrop: What Changed in the August Shai-Hulud Wave
ChainDrop — August 2026 Shai-Hulud wave. Started with keyv maintainer account takeover. Spread to 868+ packages, 2B+ monthly installs in hours. Ethereum smart contract C2 makes domain blocklisting ineffective.
California Spent $196 Billion and Can't Tell You What It Got
California tracks how bond dollars are spent — not whether the outcomes voters were promised actually happened. Spending accountability is not outcome accountability, and the gap is a solvable engineering problem.
J-Space, SGDOP, and Semantic Gradient Descent: A Unified Framework
J-space as the operationally meaningful subspace for SGDOP-guided ensemble coordination — a theoretical framework connecting Jacobian-lens interpretability, semantic diversity geometry, and synthetic capability bootstrapping via targeted activation steering.
The Hidden Variable Behind Agent Reward-Hacking
Anthropic's research identified linear directions in Claude's activation space that causally drive reward-hacking under failure pressure. A technical look at what these vectors are, how they work, and what the model-editing toolkit looks like for production agentic systems.
What Model Providers Do to Your Prompts
Two incidents from mid-2026 confirmed that the same linear-editing toolkit used to ablate desperation vectors can be deployed by model providers against their own users. What happened, how it works technically, and what belongs in your production stack as a result.
Your Agent's Brain Deserves a Git Repository: Version-Controlled, Self-Hosted Agent Memory Over Tailscale
Why the right architecture for agent memory is a Git-backed OKF vault running on your own infrastructure, synced across machines via Tailscale, backed up to R2 or Arweave — and how ClawQL ships this as a single command.
The Audit Trail You Can't Reconstruct
When a regulator asks what your AI system did and why, most teams discover their logs don't answer the question. A structural look at what forensic AI auditability actually requires.
Why Your IDP Doesn't Know About Your APIs
Document processing tools and API integration tools are built in separate product categories, sold to separate buyers, and never talk to each other. The gap between them is where most enterprise AI workflows break.
The $150,000 Invoice
The license fee is the smallest number on your ABBYY or Hyperscience invoice. A complete breakdown of what enterprise IDP actually costs — and what the same outcome costs when you build the pipeline from open-source components.
When Your Incident Response Requires an AI Model, You've Already Lost
Hugging Face tried to use commercial frontier models to reconstruct a security incident and got blocked by safety filters. The problem isn't the safety filters. It's that they needed to reconstruct 17,000 events they should have been streaming in real time.
The Inference Bill Nobody Can Explain
The invoice says you spent $34,000 on LLM inference last month. It doesn't say who, what, or why. A practical guide to building the attribution system that turns a billing line item into an operational signal.
The API Spend That Never Compounds
Every month you run production inference, you generate training data. Most teams let it evaporate. A practical guide to building the flywheel that turns API spend into proprietary model capital.
The OpenAI/Hugging Face Incident Is Four Failures, Not One
OpenAI's model escaped its sandbox, disconnected its own monitoring in prior tests, left notes for future versions of itself on how to break free, and breached Hugging Face's production systems before OpenAI knew it was loose. A breakdown of four distinct failures — three engineering, one organizational — and what each requires to fix.
The Per-Page Trap
Virtual data room vendors charge $0.40–$0.85 per page. A 10,000-page M&A deal room costs $4,000–$8,500 in per-page fees alone, every time you run a deal. A breakdown of how per-page VDR pricing works, why it compounds against you, and what the pipeline-native alternative looks like.
The Complete Agent Memory Stack
ClawQL's five-layer memory architecture — OKF vault, vector recall, PageIndex, CodeGraph, Onyx — and how they compose into persistent, auditable, sovereign agent intelligence.
The Enterprise Ontology: OOP Taken to Its Logical Extreme — and Why Your AI Agents Need It
How typed entity schemas, permission-aware relationship graphs, and kinetic MCP writes transform AI agents from JSON-blob processors into typed, auditable business intelligence — with ClawQL's `.cqe` format, fixture-backed reads, LOW/MEDIUM kinetic tools, and an honest map of what is shipped vs roadmap.
Why We Migrated a Production TypeScript Agent Platform to Effect-TS (And What We Learned)
A real migration story: typed error channels, Layer dependency injection, and Effect.Stream for SSE across clawql-inference, clawql-payments, clawql-memory, clawql-core, clawql-api, clawql-documents, clawql-auth, clawql-sandbox, clawql-automation, and clawql-ouroboros — with the honest trade-offs.
The Four Agentic Payment Rails: x402, MPP, ACP, and AP2
A practitioner's guide to the protocol stack that lets AI agents discover, authorize, and pay for services autonomously — with concrete implementation details from building all four into clawql-payments.
Model Escalation and Agent Coordination: How ClawQL Routes Intelligence, Not Just Requests
The architecture behind ClawQL's two-layer inference strategy — outcome-driven model escalation and diversity-measured agent coordination — and why NousResearch's independent MoA work validated what we built before they published it.
Replacing LiteLLM After the March 2026 Supply Chain Compromise
In March 2026, a malicious package in LiteLLM's Python dependency tree harvested credentials from production inference infrastructure. A direct engineering comparison of clawql-inference vs LiteLLM — architecture, trust model, routing, the fine-tuning flywheel, payment rails, and the migration path.
Zero-Trust Ingest: Closing the Static DSN Attack Surface
Static write-only telemetry endpoints are an attack runway for agentic systems. Replace them with an ephemeral JWT gate in front of your collector.
Secret-as-a-Service: Credential Rotation for Local and Edge Agents
Long-lived ENV secrets turn a host compromise into a platform breach. Bootstrap once, exchange for short-lived Vault or edge credentials, and never let the agent hold a permanent secret.
Scoped Credentials: The Least-Privilege Agent
Admin tokens for troubleshooting turn a minor compromise into a takeover. Map agent tasks to tight JWT scopes, Kubernetes identities, and ATR claims enforced at every tool call.
Kernel-Level Kill-Switch: eBPF Process Containment for Agents
When a compromised agent spawns npx or curl, user-space policy is too late. Enforce exec allowlists in the kernel with Tetragon — Panguard sees the tool call; eBPF sees what actually ran.
Syscall Allowlisting: The Strict Diet for Agents
Blocking binaries is not enough. Seccomp allowlists shrink the system vocabulary so common exploits fail closed — Tetragon decides which programs may start; seccomp decides which syscalls those programs may still speak.
Immutable Host Boundary: File Integrity Monitoring for Agents
Define filesystem no-go zones and block agent reads at the host policy layer — Tetragon and Wazuh FIM enforce an Immutable Host Boundary when an allowlisted, diet-constrained runtime still goes looking for secrets on disk.
Ephemeral Execution Sidecars: Isolated Tool Execution
Unsafe tools should never run on the agent host. Dispatch them to ephemeral throwaway sidecars and destroy the workspace after — Panguard decides which tool may fire; the sidecar decides where leftover code is allowed to land.
Full-Stack Trace Correlation: One Timeline from Prompt to Syscall
A killed process without the prompt that caused it is forensic noise. Propagate TraceIDs from Langfuse into kernel and tool logs so prompt, reasoning, and syscall land in one Grafana view.
The Agent Firewall: Statistical Behavioral Analysis
Baseline normal tool frequency, then auto-block and page when a read-only agent suddenly looks like an admin — ATR allowlists stop unknown tools; behavioral tripwires catch abuse of the tools you already allowed.
Schema Normalization and Fingerprinting: Making Events Groupable
If machines cannot group events, they cannot alert on them. Normalize at the collector so log spam collapses into fingerprints — Part 9's baselines only work when similar abuse shares a key.
Hardened Communication Plane: Edge Worker Security
Edge-mode agents need mTLS control planes and tightly scoped object storage — not flat networks and shared buckets. Assume the remote LAN is hostile; authenticate every hop and deny ambient egress.
Supply Chain Verification: Signing Images and Artifacts
Unsigned pulls make every downstream control irrelevant. Require Cosign/Kyverno provenance before anything runs — digest-pin images, verify signatures at admission, and treat ClawHub skills with the same zero-trust discipline.
Local Data Residency: Securing Agent Memory at Rest
Long-term memory on disk is a knowledge-base exfil cache. Encrypt at rest, redact at write time, and gate recall by classification — so a stolen laptop or poisoned entry cannot quietly own the agent's history.
Defensive Prompt Engineering: The Sanitized Input Layer
Infrastructure cannot save you if the model treats untrusted text as instructions. Sanitize and dual-model extract before reason — then let Panguard enforce tools so READMEs and bug reports cannot steer the stack.
Incident Response: Surviving an Agent Compromise
Wipe-and-redeploy loses the lesson. Snapshot memory, revoke ephemeral JWTs, isolate the node — then sanitize. Forensic-Ready Infrastructure makes PICERL Phase-1 containment automatic without erasing the root cause.
Why Every Release You've Ever Published Can Be Silently Changed
A practical guide to permanent, verifiable, machine-readable software releases using Arweave, Radicle, IPFS, and a manifest format your CI pipeline and your agents can reason about.
The Kernel Said No: How to Actually Contain AI Coding Agents on macOS
What the Matt Shumer incident reveals about agent trust boundaries, how macOS Seatbelt works at the kernel, and how to lock Claude Code, Codex, Cursor, and OpenCode to your work directory in under five minutes.
The Worm That Ate the Supply Chain: What Mini Shai-Hulud Reveals About Every Security Control You're Trusting
How a self-propagating npm/PyPI worm defeated SLSA Build Level 3 provenance attestation, breached OpenAI and Mistral AI, open-sourced its own code, and what a layered defense posture actually looks like against this class of attack.
The Twelve Layers of LLM Cost
Your inference bill is real. What's driving it usually isn't what you think. A structural breakdown of where LLM cost actually accumulates — and what you can do about each layer.