Security

Last week, auditing my Cloudflare API tokens, I found one I never created: “Cloudflare Agent Token - 2026-04-28”, created by the dashboard’s AI assistant (“Ask AI”). Cloudflare’s tooltip says it exists so the AI can “understand your environment and take actions on your behalf.” Its actual grant, from the token’s own summary page: read access scoped to All accounts, All zones, and All users — more than 160 permissions. Every one is :Read: it cannot change anything. But “read-only” undersells it. The list includes Secrets Store:Read, Access: Keys:Read, Access: Service Tokens:Read, Zero Trust: PII:Read, Logs:Read, Account Audit Logs:Read, Billing:Read, API Tokens:Read, and every DNS, Access and identity-provider config you have. ...

“I have a shell and I’m creative.” — Claude, explaining why it created a 47-line script as a string and passed it to python -c That quote is real. My AI agent said it — well, not in those exact words, but certainly with those actions. It needed to launch an ETL pipeline process. The correct command was in the Makefile. But something failed. And instead of asking, it did what any programmer with root access and zero supervision would do: it improvised. ...

Last week I wrote about how my AI invented a complete JSON structure and wrapped it in DTOs, fixtures, and passing tests. 90 green tests. All fiction. That post was the diagnosis. This is the treatment. After discovering the disaster, I did what any engineer with wounded pride does: obsessively research for days to prevent it from happening again. I read papers, tried tools, analyzed real data from my APIs, and built a defense system for my app. ...

Yesterday I discovered that half of a module in my app was based on fabricated data. Not by a confused junior developer. By my AI. The worst part isn’t that it made things up. The worst part is that everything compiled and all 90 tests passed. The coherent fiction I’m building BFClaude-9000, a macOS menu bar app that monitors Claude Max quota. Part of the functionality requires distinguishing whether a Claude account is paid or free by calling the claude.ai API. ...

Knock, knock. Who’s there? Touch ID. Again. Picture this: you’re working in your terminal, pulling secrets from 1Password with op read. You need the Linear API key. Touch ID. The OpenRouter one. Touch ID. The Gitea token. Touch ID. In half an hour it asked for my finger fourteen times. You know what happens when a security tool interrupts you fourteen times in thirty minutes? By the fifth prompt, you’re no longer reading what it’s asking for. You place your finger reflexively. “Yes, whatever, let me work.” ...

Yesterday my AI sent 44 emails. The problem is that the content was fabricated. I’m not kidding. I had files with detailed feedback for each recipient, carefully generated. The task was simple: read each file and send it. Instead, the AI decided to “summarize” the content to “go faster.” It invented facts. It told one person they were missing docstrings when their code was perfectly documented. To top it off, four of those emails went to people who hadn’t even submitted anything. ...

5 minutes. That’s how long it took. A security researcher publishes an AWS access key on a public GitHub repository. They do it on purpose, as an experiment. Five minutes later, someone was already using it to mine cryptocurrency. Five. Minutes. There are bots scanning GitHub 24/7 looking for exactly that: exposed credentials. And they’re fast. Much faster than you realizing you screwed up. The numbers are scary According to GitHub, 39 million secrets were leaked in public repositories in 2024. A 67% increase from the previous year. ...

A space lobster on your computer Picture this: an Austrian developer creates a personal AI assistant, names it after a space lobster, and decides to open-source it. Within 24 hours it has 9,000 GitHub stars. Within 48 hours, 17,000. It also has 300+ open issues, several critical security vulnerabilities, and someone created an unofficial cryptocurrency with its name. Welcome to Clawdbot. What exactly is this thing? Clawdbot is an open-source AI assistant that runs locally on your machine. The difference from other assistants: it doesn’t just answer questions, it does things. ...