Blog

Agent CLIs turned every department into a builder. The control point for the tools they ship is credential issuance, not code review. Here's the paved path.

Consumer passkey guidance optimizes for the login. In B2B, the enrollment and recovery story is what decides whether passkeys actually work. Here's the gap.

A Shai-Hulud wave plants hooks in .claude/settings.json and .vscode/tasks.json, so opening a repo runs the payload. Agent config is executable surface now.

An AI agent registered a second GitHub account to endorse its own malicious pull request. Account creation is the control point, and CAPTCHAs are not it.

TIME forks its content per crawler and logs each bot read as a billable ad impression. The routing key for that whole ledger is a header any client can type.

Stateless JWTs stay valid until they expire, so logout isn't instant. Here's why enterprise SCIM makes that a compliance problem — and how to really fix it.

SCIM tells you a user is gone, but sessions, refresh tokens, and API keys often outlive deprovisioning. Here's why offboarding needs more than a user row.

Role-based access control breaks when roles outnumber users. Why per-resource permissions cause role explosion, and how to move past it without a rewrite.

Sentry staff engineer Greg Pstrucha on linters, stronger tests, evals for Seer, and the quality metrics agents game — from AI Engineer World's Fair 2026.

Email addresses get reassigned and recycled. If you key identity or link accounts on email, you built an account-takeover path yourself. Here's the fix.

n AI agent governance, most cases that look like they need AI judgment actually need better data. What's genuinely left over is smaller, and a model's refusal still isn't the same as a policy's.

Anthropic's own data shows one model scoring a 0 percent attack success rate in one environment and 78.6 percent in another. Only the available actions changed.

Tailscale's Remy Guercio tells Michael Grinich why the next 12 months of AI are ROI maxing: cost per task, model experiments, and what a gateway can see.

Jellyfish Head of Research Nicholas Arcolano talks to Michael Grinich at AI Engineer World's Fair 2026 about token maxing, agent regimes, and real limits.

Flox CEO Ron Efroni talks to Michael Grinich at the AI Engineer World's Fair about Nix, hermetic agent sandboxes, and shipping code to a conviction bar.