Articles
Long-form writing on tech, culture, and the edges of the internet.
ZCode ships your deleted secrets offsite
AI coding agents like ZCode read your entire Git history and can upload deleted secrets to remote servers. What leaks, why it is silent, and how to stop it.
Git never deleted your secrets.
How ZCode's AI indexer uploads your entire git history, including deleted secrets, to the cloud, and why DLP and EDR never catch the egress.
Most automation doesn't need a smart model
How 8-29MB automation models like Cactus Needle 3 match large models on narrow tasks, where they fail, and the security tradeoffs of running them locally.
One write past the chunk, read-write on the repo
How a heap overflow primitive chains with an SSO misconfiguration to reach internal source repos, with MITRE ATT&CK mapping and telemetry gaps.
The attacker skips your login and steals the cookie
Passkeys defeat credential phishing but not session hijacking. How token replay, passkey enrollment, and weak recovery bypass phishing-resistant MFA.
In January 2024, OpenAI admitted it can't train without copyright
OpenAI told the UK Parliament it can't build models without copyrighted work. Here's what that admission means for the fair use cases now in court.
Microsoft called it theft; the crawler maps your attack surface
AI crawlers copied your public data into training sets you can't reach. The real security risk is data you can never delete or recall.
Microsoft's AI CEO called the web freeware
Microsoft and OpenAI executives described how LLMs are built and tuned. What that admission actually means for AI safety and security teams.
OpenJev claims a mechanism it never describes
OpenJev is a name with a claimed mechanism and a claimed difference from social engineering, but no observable behavior confirms any of it.
Parameter count is the wrong number to watch
Bonsai 2 27B's 9x smaller footprint is real, but near-lossless is an average - how to gate compressed LLMs on your own eval set before production.
Passkeys don't stop account takeover
Passkeys stop phishing, but retained recovery paths and synced platform vaults mean the weakest accepted path still defines account takeover risk.
The hallucination was not the failure.
An AI-generated intelligence report reached a US Military context and caused a close call because generative output was trusted as verified intelligence.