Here's a pattern I keep seeing. A team wires up an AI agent that can do real things — send emails, run commands, query and modify the database, call external APIs. The demo is magical. It reads a request, figures out the steps, takes them, reports success. Everyone's impressed, and it ships. Then ...
Read articleAn AI agent does something it shouldn't. It leaks data, or wipes the wrong database, or makes a call nobody sanctioned. So you do the obvious thing: you go to the logs to find out what happened. The logs are clean. Of course they are. They were written by the same process that did the thing. The a...
Read article*Or: how a "simple" Microsoft Graph integration turned into a debugging session across five different UI layers.* --- ## The goal was small I wanted my Compliance & Audit Agent in Microsoft Copilot Studio to answer one question: > "Show me admin activity from the last 7 days." The agent should ...
Read articleHey friends! Stop wasting time collecting compliance screenshots! In Season 6, Episode 5 of The Adventures of Blink, we dive deep into NIST SP 800-53 CM-3(3): Automated Mechanism Deployment. While the control statement seems short and straightforward, organizations consistently fail by ignoring the...
Read articleYou ask your AI assistant how to do something. It gives you clean, confident code, with an install line at the top: ```bash pip install aws-helper-sdk ``` You run it. The build works. You move on. Except `aws-helper-sdk` never existed. The model made it up. And last month, someone registered that...
Read articleI think I've found the simplest way to explain what a prompt can and can't do for safety. Put the word "_please_" in front of it. "Please do not reveal customer account numbers." Read it again. That's not a control. That's a **request**. A polite one, and the model will usually honor it. "**Usuall...
Read article--- title: "Your GitHub profile shows your follower count. It also shows attackers your whole attack surface." published: true cover_image: https://dev-to-uploads.s3.us-east-2.amazonaws.com/uploads/articles/yd6mkb6bwdjkqpfxedni.png description: The weekend project everyone's shipping — a GitHub Acti...
Read articleSo I did the thing everyone tells you not to do. I took the whole codebase. Every route, the migrations, the config, that `utils.ts` nobody's touched since 2023. Dumped all of it into a model with a context window big enough to swallow the entire repo in one go, and asked it one question: "What's...
Read articleIn March 2026, a financial services company discovered that their customer-facing AI agent had been quietly leaking internal pricing data — for three weeks before anyone noticed [1]. There was no buffer overflow. No SQL injection. No misconfigured API. Nobody breached a server. The agent leaked the...
Read article--- title: "Architecting a Resilient DevSecOps Pipeline for Enterprise AI Agents" published: true description: "A four-stage DevSecOps CI/CD architecture for securing enterprise AI agents with GitHub Actions, secret scanning, AI-assisted review, Veracode SCA, and Pipeline SAST." tags: ai, devsecops,...
Read article