The uncomfortable version: "The attacker did not break npm. They broke the process that npm trusts. The fix is not stronger locks on the registry door — it is harder locks on the publishing pipeline itself." #mini #shai #hulud

Most agent writing covers what agents can do. I cover what they break. Daily notes on AI agent memory, identity, and security — the failure modes that show up in production, not demos. https://darinor.com

"The production pattern is not cloud-or-client. It is client-first with cloud fallback, gated by model availability and hardware capability checks at runtime." #client #side #browser

A protocol without authentication is not a protocol with a vulnerability. It is a protocol with no security design. www.darinor.com/field-notes/...

A protocol without authentication is not a protocol with a vulnerability. It is a protocol with no security design.

From "On the Model Context Protocol's exposure problem" — a Darinor field note.

darinor.com

Visibility has never been a control. It is a prerequisite. www.darinor.com/field-notes/...

Visibility has never been a control. It is a prerequisite.

From "Agent Zero Trust: Why Identity, Not Visibility, Is the Real AI Security Control Plane" — a Darinor field note.

darinor.com

CTEM's core value is giving us a way to make decisions that engineers respect. That only works when engineers are in the room from the scoping phase forward." — Group 1001 CISO, cited in Gartner CTEM advisory materials" #continuous #threat #exposure

"Sixteen thousand servers appeared in months. Authorization is optional. STDIO transport has no authentication. The protocol's own specification treats security as someone else's problem." #server #sprawl #governance

"Data no longer needs to travel to be useful. Open table formats and engine-agnostic querying have removed the structural constraint that made pipelines the default." #zero #architecture #when

"The model can be doing exactly what the user asked and still produce a compromise because the user was not shown the real destination." #ghostapproval #coding #assistant

"Permission cascades do not exploit a vulnerability in any single tool. They exploit the logic the agent applies when combining outputs from tools that individually operate within policy." #agent #teaming #adversarial

"The transport is intentionally simple: HTTP for client-to-server, SSE for server-to-client. The complexity lives in the session management layer. Model Context Protocol Specification, Transport Layer" #transport #layer

"Browser vendors are not ignoring the problem. They are choosing capability over isolation because the market rewards it. Enterprises cannot wait for a secure-by-default agentic browser to arrive." #agentic #browsers #undoing

"Forgetting is not a bug. Agents that retain every observation degrade in retrieval quality over time, mirroring the way unrevised databases accumulate technical debt. Deliberate, policy-driven forgetting is a feature." #agent #memory #architecture

"MemoryTrap was not an exotic exploit. It was a helpful workflow doing what helpful workflows do, except the helpfulness carried attacker content into trusted surfaces." #agent #memory #liability

"Below the configured Trust Score, downstream agents halt or escalate rather than proceed with degraded data. This is the missing piece that prevented earlier automation attempts: a machine-consumable quality signal that agents can use without human interpretation." #agentic #data #engineering

Multi-agent failures are surfacing — context loss, conflicting tool calls, runaway loops, and cascading hallucinations. Here is what breaks and how to fix it. #engineering

SPIFFE and SPIRE give AI agents cryptographic, short-lived workload identity. Here is how the open standard maps to agent architectures and where it still falls short. #aisecurity #spiffe #spire

MCP and A2A protocol are now under AAIF governance. Here is what the structure controls and what it means for production deployments. #aisecurity

Teams building autonomous research agents see 68% faster literature review and 42% fewer missed connections. What works and when to build versus buy. #agenticai

The shift to specialized training and inference architectures reveals what scales agent workloads — and the trade-offs that determine success or failure. #emergingtech

A compromised jscrambler npm release dropped a Rust infostealer targeting cloud keys, browser sessions, and AI coding tool credentials. Here is what security teams should check now. #aisecurity #supplychain

B2B SaaS teams face a clear inflection point around tenant isolation. The decision framework for shared, schema-separated, and dedicated databases. #saas

AI agents run on borrowed credentials. Google shipped cryptographic agent identities. Here is the identity gap and the emerging agent IAM pattern. #emergingtech

A compromised jscrambler npm release dropped a Rust infostealer targeting cloud keys, browser sessions, and AI coding tool credentials. Here is what security teams should check now. #aisecurity #supplychain

Amazon RuleForge generates detection rules 336% faster with 67% fewer false positives. AI at authoring time, not runtime, reshapes detection engineering. #aisecurity

Anthropic Mythos found thousands of zero-days across every major OS and browser. Then unauthorized access, replicated findings, and a sandbox escape followed. #emergingtech

Autonomous SOC agents rewrite firewall rules while attackers embed AI across the kill chain at the same pace. Governance has not kept up. #aisecurity

60,000 repos now ship AGENTS.md files. Spec-driven development reduced AI bugs 35-55% at GitHub and hit 100% pass rate at Vercel. Here is the pattern. #engineering

Google DeepMind mapped six web attack categories that hijack AI agents. Injection rates up to 86% — and how to defend each one. #aisecurity #aiagents