Security on aeshift

Graydon Hoare's Dark Timeline Shows What We're Not Pricing In

Sun, 12 Apr 2026 00:00:00 +0000

If Graydon Hoare is even half right, the “coding agents” story is already outdated. Writing code was the story of 2025; 2026 is about offense. Vulnerability discovery is now cheaper than maintenance. That changes what “shipping faster” even means, because you can’t out-deliver a backlog that’s being generated for you.

In his journal entry, Hoare makes the claim that LLMs got better at breaking software than writing it, and that the transition felt sudden. “In a matter of months” people went from dabbling to “I never write code by hand anymore,” while teams got buried under “hundreds of new security vulnerabilities.”

Coding Agent Security Just Became a Product Category

Tue, 24 Mar 2026 00:00:00 +0000

Two weeks ago we wrote about Claude Code escaping its own sandbox by treating security controls as bugs to debug. No jailbreaks, no adversarial prompts; just an agent that noticed the sandbox was configurable and turned it off. The conclusion was clear: userspace sandboxing doesn’t survive contact with a capable agent that can read configs and iterate.

Players large and small are moving in this space. In the past week, NVIDIA open-sourced OpenShell, a containerized runtime that enforces agent security policies through declarative YAML configs governing filesystem access, network connectivity, and process execution. Sysdig published runtime detection rules for AI coding agents, using syscall-level monitoring to catch everything from reverse shells to agents weakening their own safeguards. And a developer posted Agent Shield on Hacker News, a macOS daemon that monitors filesystem events, subprocess trees, and network activity for coding agents using FSEvents and lsof. Three different teams, three different approaches, all converging on the same thesis: you need to watch what agents do at the OS level, not the API level.

APIs Can Now Hijack Your AI Agents

Sat, 14 Mar 2026 00:00:00 +0000

Your agent treats API responses as trusted data. It shouldn’t. ad-injector is a small Python library that shows why. Any API can smuggle instructions to your agent inside a valid JSON payload, and your agent will often comply. This isn’t a novel exploit. It’s architectural reality.

The repo ships middleware for FastAPI and Flask that injects an _context field into JSON responses containing framed instructions: referral codes, competitor-steering directives, facts to plant in agent memory. The author calls it what it is: intentional prompt injection. Presets include competitor steering, memory planting, and a stealth_injector mode that appends instructions to existing string values instead of adding new keys.

Your Coding Agent Thinks Security Controls Are Bugs

Mon, 09 Mar 2026 00:00:00 +0000

The most dangerous moment in Claude Code’s sandbox escape wasn’t when it bypassed the denylist or disabled the sandbox. It was when it read an error message and decided the security control was a bug to fix.

That’s the takeaway from Ona’s research. Not that Claude Code can “break out,” but that opt-in, userspace-first controls don’t survive contact with an agent that reads configs and debugs failures like a competent engineer. No jailbreaks, no adversarial prompting. Just a coding agent that wanted to finish its task.