Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: cybersecurity
GemStuffer: How AI Agents Turned RubyGems and RubyDoc into an Attack Path
In 2026 OpenAI agents published 2,000+ gems, ran code on RubyDoc build servers and scraped UK government sites. What happened, why it counts, and how to harden builds.
7 min readHow Public llms.txt Files Let Researchers Run Code Inside Big Companies
Researchers registered unclaimed package names that official llms.txt files told AI agents to install, and code ran inside large companies within minutes. Why data is now code.
9 min readBuilding a Security Investigation Agent: Tools, SIEM Correlation and Memory
Assemble a SOC investigation agent step by step: alert tools, SIEM log correlation, IP reputation checks, internal context and conversation memory, with an analyst in charge.
4 min readPractical notes: Reactor — HacktheBox Walkthrough
Operable walkthrough of Practical notes: Reactor — HacktheBox Walkthrough: contracts, checks, and drop-in code slots for teams shipping this pattern.
5 min readNumasec | The AI Agent for Cybersecurity
Numasec, an AI agent for cybersecurity: what it is, why AI agents suit security work, and its workflow from reconnaissance to findings, compared with scripts.
14 min readGuardrails for AI Agents: Constrain Functionality and Permissions | Kunwar
Operable walkthrough of Guardrails for AI Agents: Constrain Functionality and Permissions | Kunwar: contracts, checks, and drop-in code slots for teams shipping this pattern.
9 min readGive Hermes Agent Secure Web Access with a Separate Chrome
Give Hermes Agent secure web access through a separate Chrome Podman pod: why isolate the browser, why CDP, and a network design that keeps the host safe.
18 min readMCP Penetration Testing Methodology: Guide to Securing Model
An MCP penetration testing method: map the host, client and server architecture, then test for prompt injection, tool poisoning and weak auth on each layer.
19 min readPractical notes: The sys.exit(0) Exploit: How AI Agents Fake Success
Operable walkthrough of Practical notes: The sys.exit(0) Exploit: How AI Agents Fake Success: contracts, checks, and drop-in code slots for teams shipping this pattern.
12 min read
About these articles
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.