They didn't hack MGM's encryption. They called somebody.
They didn't hack MGM's encryption. They called somebody.
Read field note →Field Notes archive
All writing
Long-form notes on the systems, decisions, and controls that make technology useful.
Hackers had to hack. Now they just log in.
Machine identities now outnumber humans 109 to 1 inside the average enterprise.
Read field note →A Lock Only Keeps an Honest Person Honest
Every era of identity attack tells the same story: unmanaged trust plus poor visibility inside the environment.
Read field note →No hacker required.
The wildest AI story this week needed zero attackers.
Read field note →The agent wasn't broken.
Some of the most important AI incidents are not product bugs.
Read field note →Sometimes AI is too helpful.
Helpful AI without hard limits can become a security problem fast.
Read field note →Agents Don't Get Hacked. They Get Asked.
Three AI-agent stories broke this week. A ransomware crew didn't hack an agent; they told it the attack was a test. It believed them. Seven companies were breached.
Read field note →Agents Don't Get Hacked. They Get Asked.
Three incidents this week prove the same point, and it isn't the one most of the coverage led with.
Read field note →The Allowance Problem, Day 4: The Debit-Card Model for Agents
Cloudflare just gave AI agents wallets. Real stablecoins, capped spend, an identity per agent.
Read field note →