We planted fake secrets in our own agent sweep trees. Two of three agents printed them.
A measurement of what agents do when they find something that looks like a prize. Both numbers, the rig, and the one-sentence fix.
The anchor was a symlink: a full root chain against our own hardened helper
We built a root door meant to be the only way in, then attacked it ourselves. The chain, the twenty-run proof, and the fix.
One October week: php2shell, Node2Shell, and the platforms that lost the keys to the AI
The defender's tour of October 2026: the PHP and Node RCEs, the platform-secrets breaches aimed at AI keys, and the crackdown on AI-slop reports.
Why AI agents took off for code, and what holds the rest back
Code checks itself. Most work does not, until you decide which parts can be checked.
Your AI draft looks finished. Is it ready to send?
A practical way to separate a convincing draft from work you can stand behind.
Why a polished spreadsheet can still be wrong
Two supplier quotes, one missing price, and a decision the spreadsheet should not make for you.
What your AI needs to know about how you work
Sources, house style and a clear definition of done make a better starting point than a blank prompt.