Blog
Technical writing on application security, product security and AI security.
-
Secure by Design
When AI Agents Become Attack Surfaces: The Claude Desktop Extensions Remote Code Execution Vulnerability and Autonomous Tool Chaining Without Trust Boundaries
Remote code execution via Claude Desktop Extensions through calendar event injection. AI agents chaining tools without trust boundaries exposes everything.
-
AppSec
When MFA Becomes the Attack Surface: Synchronized Vishing, Real-Time Relay, and Authentication Trust Boundaries
Synchronized vishing attacks bypass MFA through real-time relay. The attacker calls the user and replays tokens before they expire. Architectural defenses.
-
Secure by Design
Shadow AI and the Machine Identity Governance Crisis: Why Most IAM Programs Weren't Designed for This
Shadow AI is an architectural failure in identity governance, not a policy problem. Most IAM programs were designed for humans, not autonomous AI agents.
-
AppSec
The Salesloft/Drift OAuth Breach: When Your SaaS Integrations Become Attack Vectors
The Salesloft/Drift OAuth breach compromised 700+ organizations through weaponized tokens. Six months of silent credential harvesting via SaaS-to-SaaS trust.
-
AppSec
Stop Treating LLM Agents as Trusted Users: Lessons from GitLab CVE-2021-39935
CISA added CVE-2021-39935 to the KEV catalog in February 2026. LLM agents with broad API access inherit every vulnerability in your attack surface.
-
AppSec
Don't Pipe URLs into Shell Scripts: Lessons from CVE-2026-1281
Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340 (CVSS 9.8) expose the danger of piping remote content into shell execution without validation.
-
OWASP
Thoughts on Fortinet's CVE-2026-24858
CVE-2026-24858 in FortiOS: authentication bypass through alternative path. When network security appliances have auth bypass flaws, perimeter trust collapses.