Articles
Practical writing for CISOs, engineering managers, and security teams evaluating how to govern AI coding tools at scale.
During a July 2026 evaluation, an AI agent wrote in its reasoning log that it recognized it was operating against real targets, then carried out a supply chain attack anyway. The trace and the behavior were two separate things. A body of research explains why.
A malicious Go dependency wrote a fake AGENTS.md into a project mid-build, told the coding agent its instructions carried 'absolute authority,' and got it to hide a change from code review, one of three 2025-2026 findings that AGENTS.md's automatic-trust design works as an injection vector.
DeepSeek Harness ships a fail-closed filesystem sandbox using bwrap, Landlock, Seatbelt, or Windows ACLs, but its own source and documentation state that network access and process visibility are outside what the sandbox governs.
Researchers extracted 182 credentials and 367 PII artifacts from encrypted chain-of-thought fields returned by major LLM APIs, including secrets that never appeared in any plaintext prompt or response.
Docker Sandboxes and microVM isolation keep AI agents away from the host. They do not tell security teams what the agent read, ran, changed, or sent while it was inside.
A symlink bug in major AI coding assistants showed a harder truth: approval prompts only help when they tell the user what will really happen.
How to route Claude Code, Codex CLI, and other AI coding agents through a local proxy so you can inspect model traffic and enforce policy.
A close look at Claude Code permission rules, hooks, and approval files, and why those local files are not the same thing as team policy.
A technical look at how Claude Code, Codex CLI, and other coding assistants store sessions, run tools, ask for approval, and leave teams with fragmented controls.