A Lock Only Keeps an Honest Person Honest
Every era of identity attack tells the same story: unmanaged trust plus poor visibility inside the environment.
Read field note →Topic archive
ai-governance
No hacker required.
The wildest AI story this week needed zero attackers.
Read field note →The agent wasn't broken.
Some of the most important AI incidents are not product bugs.
Read field note →Sometimes AI is too helpful.
Helpful AI without hard limits can become a security problem fast.
Read field note →Agents Don't Get Hacked. They Get Asked.
Three AI-agent stories broke this week. A ransomware crew didn't hack an agent; they told it the attack was a test. It believed them. Seven companies were breached.
Read field note →Agents Don't Get Hacked. They Get Asked.
Three incidents this week prove the same point, and it isn't the one most of the coverage led with.
Read field note →The Allowance Problem, Day 4: The Debit-Card Model for Agents
Cloudflare just gave AI agents wallets. Real stablecoins, capped spend, an identity per agent.
Read field note →The Allowance Problem, Day 3: More Supervision Doesn’t Equal More Judgment
Anthropic gave its AI shopkeeper a boss.
Read field note →The Allowance Problem, Day 2: The AI Boss Didn’t Save It
An AI agent ran a real shop, with an AI boss watching over it. It still ended the month ordering a PlayStation 5 and a live fish.
Read field note →