Posts

Making coding agents work more like people, or at least in a way that is better suited for interaction with people, might only require a good memory system. Experience tells me that it’s probably easier than we think. AI Agents, today, have pretty limited context windows; even when they include a million tokens or more, they feel very forgetful after a compaction. They also don’t continuously learn from experience in mainstream harnesses, and generally have to re-obtain context every time you open a new session. As amazing as they are, this all makes for a fairly janky experience. ...

In which we discover that the secret menu is neither secret nor a menu. When trying to review a new MCP service for security, I’ve heard the argument, “This is not net-new, it’s just the same as our existing APIs,” and therefore it can get rubber-stamped, riding the coattails of APIs gone before. This is true on the surface: MCP is another way to express an API. It’s self-describing with tools and resources as its basic entry points. It works over pipes or HTTP or SSE. It leans on the same authorization primitives that similar protocols use. ...

In which I apply basic security decomposition, least privilege, sandboxing, and memory compartmentalization to AI agents, and discover that you can, in fact, make things better in this new world. Security Principles in Play The trouble with AI agents isn’t that they are fundamentally insecure, it’s that they are insecure by default. We take decades of understanding about untrusted data cleaning, separation of concerns, zero trust, etc., and chuck AI on top of all of it at once, only then to wonder why our previously secure systems are suddenly vulnerable. ...

When thinking about making AI agents more secure, there are a some important classes into which we can place vulnerabilities. A couple of the more interesting ones are the Confused Deputy problem and Privilege Aggregation. Each of these is an issue on its own, but together they make for a very serious combination. This post series aims to tackles some of the many dimensions of this space, elucidating what’s wrong, and suggesting some ways in which we might try mitigating them. ...

The idea of an AI agent, something that does things on your behalf, but doesn’t go off the rails, is alluring. Everyone wants their own personal concierge, multiple of them if it can be helped, to manage things for them in an increasingly complex world. But the way we talk about it is super ambiguous, and sometimes that makes a difference in how we think about building particular solutions. What is an Agent? It’s worth nailing down some vocabulary, but before we do, let’s go over some examples to ground the discussion. ...

AI writes insecure code, right? We’ve certainly heard that while AI can write code, it also tends to create vulnerabilities that are preventable, to create things that shouldn’t be put out in production. It can stick secrets into code without being asked. It can generate buffer overflow vulnerabilities. It can create authentication that is easily bypassed. Honestly, a lot of that is true. But why is it true, and more importantly, when? ...