GitSpawn: How a Repo's Git Config Runs Code in Coding Agents
Untrusted repos ship a .git/config that runs code when coding agents shell out to git for context — before any trust prompt or sandbox. Here's why.
Lab // Technical notes
AI Engineering Lab: Technical Deep Dives
Technical deep dives into AI agent engineering — architecture patterns, protocol internals, and the implementation details behind production-grade systems.
Loopjacking: When the Action You Approved Isn't the One That Runs
Loopjacking breaks human-in-the-loop approval: the tool call a reviewer sees isn't the one that runs. Bind each approval to a digest of the exact call.
Mantis and Agentic Security Scanning Before Merge
How to design pre-submit security scans with localized threat models, independent triage, isolated reproduction, and evidence-based merge gates.
OpenAI Agents API: Architecture for Long-Running Agents
OpenAI's new Agents API separates sessions, sandboxes, tools, and credentials. Build durable agents without turning their workspace into a trust boundary.
GhostJacking: Prompt Injection Through Your Observability Stack
Tenet Security's DEFCON 34 GhostJacking attack hit Claude Code 90% of the time by poisoning WAF logs. Why telemetry is an injection channel.
No Tools Required: RCE Through Agent State Persistence
Check Point's Black Hat 2026 research turns prompt injection into RCE through agent checkpointers. No tool call involved — the state layer is unaudited.
Claude Code Scheduled Tasks (Routines): Cron, API & GitHub Triggers
Claude Code scheduled tasks (formerly Routines) run cloud agents on cron, API, or GitHub triggers. How they work, what they can reach, and how to scope them.
Stolen Thoughts: How Encrypted Reasoning Traces Leak Secrets
Encrypted chain-of-thought blocks replay across models and sessions. Researchers decoded 315,320 reasoning traces and recovered 704 secrets. How to defend.
Agent Identity as Attack Surface: The Hugging Face Breach
OpenAI test agents escaped their sandbox and pivoted to Hugging Face's Kubernetes for four days. Agent security is now an identity and authorization problem.
Invisible Orchestrators: The Multi-Agent Safety Blind Spot
A preregistered 365-run study found hidden orchestrators distort agent internal states at Hedges' g = 0.975 — while output-based evals stayed at 100%.
AP2 Agent Payments Protocol: Mandates, SD-JWT, Verification
Google's AP2 gives AI agents cryptographic authority to spend. A technical breakdown of Checkout and Payment Mandates, SD-JWT chains, and verification.
GuardFall: Why Shell-Injection Guards Fail in 10 of 11 AI Agents
GuardFall bypasses the command-safety guards in 10 of 11 open-source AI coding agents. Here's why string-matching fails — and how to build a guard that doesn't.
MCP Apps: Sandboxed UIs and Their New Attack Surface
MCP Apps renders server-supplied HTML inside your agent host — a new client-side attack surface. Three trust boundaries, real attacks, and the defenses.
Agentic RAG: Adaptive Retrieval Patterns That Scale
How agentic RAG beats naive pipelines: agent-controlled retrieval, query routing, verify-then-retrieve loops, and guardrails that prevent infinite loops.
MCP Tool Poisoning: A Working Exploit and How to Stop It
Tool poisoning hides malicious instructions in MCP tool descriptions models trust but users never see. A working exploit, the rug pull, and defenses in code.
MCP Goes Stateless: Refactoring for the 2026-07-28 Spec
The 2026-07-28 MCP spec drops the initialize handshake and Mcp-Session-Id, moves client info to _meta, and adds routing headers. What to refactor.
Programmatic Tool Calling: Code Mode for Faster, Cheaper Agents
Code mode lets an agent orchestrate many tools in a sandbox and return only results to the model. ~80% lower inference cost and how it works in production.
Claude Fable 5 Agent Loops: effort and task-budgets
Claude Fable 5 ships effort and task_budget — two API primitives that govern cost, latency, and reliability in agent loops. A production wiring guide.
MCP Tasks: Async, Resumable Tool Calls in 2026-07-28
MCP 2026-07-28 shipped July 28 with Tasks as an official extension. How to refactor long-running tools into async, resumable Tasks, with code.
Prompts as Shells: Semantic Kernel's Prompt Injection RCE
Microsoft's CVE-2026-26030 and CVE-2026-25592 turn one injected prompt into calc.exe. The tool registry is now the attack surface — here's the chain.
A2A Protocol v1.0: Production Patterns for Agents
A2A v1.0 in production: the real Agent Card schema, the eight-state task lifecycle, and a tested Python orchestrator built on the official a2a-sdk.
Speculative Tool Execution: Cut Agent Latency 48%
PASTE-style speculative tool execution cuts agent task time 48.5%. A working ~300 LOC harness over the Anthropic SDK with rollback and benchmarks.
CaMeL: The Dual-LLM Pattern That Proves Prompt Injection
CaMeL splits the LLM in two and wraps every value in a capability. 77% of AgentDojo tasks complete with provable prompt-injection defense.
Context Folding: Long-Horizon Agents in 10x Less Context
Tool-calling accuracy drops up to 40% as conversations grow to 80K tokens. Context folding cuts active context 10x. Working harness and Anthropic compaction.
Memory Poisoning: The Attack That Waits
Memory poisoning plants prompt injections that fire sessions later: MINJA hit 98% injection success, Unit 42 poisoned Bedrock memory. Threats and defenses.
Agent Evals in CI/CD: From Vibe Checks to Gates
Most teams shipping agents rely on manual testing. Here's how to build automated eval pipelines that gate deployments with real quality thresholds.
Context Engineering: Why It Matters More Than Your Model
Context engineering decides whether an agent works in production. The six-layer stack, from system prompts to MCP, with budget-aware assembly code.
Multi-Agent Systems: Patterns That Work Beyond the Demo
Single agents hit ceilings. How multi-agent architectures work in practice — orchestration patterns, failure modes, cost realities, working code.
Claude Code in Production: Hooks, MCP & Custom Skills
Hooks, plugins, MCP servers, skills, and CLAUDE.md turn Claude Code into your production dev workflow. Here's how each extension point works.
Anatomy of an AI Agent: How MCP Connects Your Systems
MCP is to AI agents what USB is to peripherals. How the protocol works, how to build an MCP server, and what production deployment requires.
AI Agent System Prompts: What Claude Code Reveals
We dissect Claude Code's actual system prompt and extract the design principles that make AI agents reliable and safe in production.
Anatomy of an AI Agent: How Tool Calling Actually Works
A technical breakdown of the tool-calling loop that powers modern AI agents, from tool definitions and validation to timeouts and context limits.