Fail Closed AI Agent Guardrails: Why Empty Is Not Safe
An empty HOME migrated my real database. An empty git status force-deleted four worktrees. Five fail-closed rules for AI agent checks.
$ ls ~/blogs/security --sort=latest # my take, in writing
I put the flaws on paper.
My security write-ups. Vulnerabilities, exploitability and a few very bad assumptions. I brought details.
3 postsMy security essays / newest first
$ ls ~/write/security
my essays on the subjectI put it all here.
I Asked an AI Agent to Go Live. It Exposed My Server.
A live test of DeepSeek Harness, a self-hosted AI coding agent, shows what happens when an obedient agent is asked to expose a server, and why the firewall around it mattered more than the model inside it.
CVE-2026-63030: WordPress Pre-Auth RCE Explained
CVE-2026-63030 is critical, but automated exploitation fails on one overlooked detail that 70% of production sites already defend against.