The Board Slide Hiding in Your Agent Telemetry

The measurements that earn an AI agent autonomy are the ones your CFO has been asking for. The quarterly security slide has looked the same for a decade. Vulnerabilities discovered: 14,000. Triaged: 9,200. SLA attainment: 94 percent. Every number on that page describes what the security team did. None of them describes what the business […]

Building an AI SDLC on Thin Ice: What Worked and What Backfired

Writing code was never the hard part of software engineering. That was true before LLMs and it’s still true now. The hard parts were always understanding the problem, choosing an approach you won’t regret in six months, and keeping a system comprehensible to the people who have to maintain it. Code was the mechanical part. […]

Your Agent Produced the Right Answer. It Still Did the Wrong Thing.

Introducing PolicyEval, the open-source library that scores AI agents against their policy, not just their output. The first two posts in the series (#1, #2) landed on something uncomfortable. AI coding assistants ship vulnerability patches that compile, pass tests, and still break production. Roughly one in five. The fix wasn’t a smarter model – it […]

Shrink the Exposure Pile: Vulnerability Management in the Age of Vibe Coding

Part 1 of a two-part series. Security teams already own more scanners, exposure platforms, and dashboards than they can act on, yet the vulnerability backlog grows every week. The bottleneck has moved downstream, from finding vulnerabilities to remediating them, and AI-generated code widens that gap faster than any hiring plan can close it. On a […]

CVE-2025-68664: A Case Study in How AI Agent Velocity Is Stress-Testing Vulnerability Management

The proliferation of AI Agents is creating a “Vulnerability Gold Rush.” While developers are racing to ship features using LangChain, LiteLLM, and the new Claude/OpenAI SDKs, the underlying libraries are evolving so fast that security patches are frequently entangled with massive breaking changes. For an organization running dozens of agents, this isn’t just a maintenance […]