Sep 6, 2026
The Worms Learned to Use Your AI Agent: A Year of npm Supply-Chain Attacks
From s1ngularity invoking Claude Code to hunt for wallets, to Shai-Hulud self-publishing across 500 packages, to IronWorm stealing AI API keys — the twelve months that changed how I install software.
13 minSep 6, 2026MCP Security in 2026: The Protocol Got Hardened. The Ecosystem Didn't.
A year of MCP CVEs, a rewritten spec, an NSA guidance sheet and an OWASP Top 10 — what actually changed, what didn't, and the six controls I'd insist on before an MCP server touches production.
12 minSep 2, 2026Isolation Is Not an Abuse Control: Lessons From My Fleet
A free-tier signup mined crypto on my microVM fleet in 27 minutes. Containment held perfectly and it changed nothing. What I built afterwards, in what order.
9 min