Tech · Culture · Fiction
Article Agents Need Orchestration
Managed agents aren't plug-and-play. Real reliability comes from structured pipelines with validation, state tracking, and fallbacks—no exceptions.
A Trivy-based CI/CD misconfiguration led to credential exposure in a Cisco-related incident
A review of how a misconfigured Trivy scan in Cisco’s CI/CD pipeline led to AWS credential exposure due to unverified post-scan execution. Explores the systemic failure behind treating scanning outputs as trusted signals.
Cisco's Source Code Breach Was Structural, Not Accidental
Cisco's source code breach wasn't a fluke. It was the predictable result of credential drift, third-party trust gaps, and dev infrastructure treated as low-risk.
Claude Code's System Prompt Is a Production AI Agent Blueprint
Claude Code's system prompt is a working engineering spec for production AI agents. Six concrete patterns for context isolation, tool selection, parallelism, error recovery, memory, and blast radius management.
How Systems Inherit Trust Without Revalidating It
Systems inherit trust without revalidation, creating blind spots for persistent compromise. When execution relies on reference rather than verification, attackers exploit valid workflows to propagate silently across infrastructure.
How Trust in Open-Source Updates Becomes a Systemic Failure Mode
A structural analysis of how trust in open-source updates becomes exploitable when systems assume past safety implies future safety, using the Trivy compromise as a case study.
ShinyHunters, Trivy, and the Pipeline Identity Problem
ShinyHunters cloned 300 Cisco repositories through Trivy running in a CI/CD pipeline. This is what failed structurally, why it failed, and what pipeline identity enforcement must look like.
Stay in the loop
New writing delivered when it's ready. No schedule, no spam.