AI Security

Should AI coding agents start from your golden path templates?

Yes: point coding agents at the same templates, registries and merge gates as people. How to set it up, what to log and where agents need own limits.

Should AI agent read tools and write tools be on separate servers?

Splitting read tools from write tools into separate servers and identities makes least privilege easy to enforce. When it pays off and when it is overkill.

Shared credential or per-user sign-in for an MCP connector?

A shared key gives everyone the same access, while per-user OAuth ties access to a person. Compare both for security connectors, with a table to decide.

Oct 19, 20266 min read

Self-hosted or vendor-hosted agent sandbox: who owns isolation?

A vendor-hosted agent sandbox hands isolation to the provider. A self-hosted one hands it to you. What each choice changes for egress, secrets, evidence.

Oct 19, 20266 min read

What security training do data and ML engineers need?

Data and ML engineers need security training on data handling, notebook and pipeline hygiene, third party model and package risk, and access control.

What security training do developers building LLM apps need?

Developers building LLM apps and agents need training on prompt injection, output handling and excessive agency. Topics from the OWASP LLM Top 10 2025.

Scheduled tasks in an AI assistant: ten questions to ask first

Ten vendor-neutral questions to ask before trusting an AI assistant to run tasks on a schedule: where it runs, who it acts as, and how failures surface.

Oct 19, 20267 min read

What's your SBOM story if your product has AI features?

Buyers now ask whether an SBOM covers AI components. What the 2026 CISA guidance says, what a startup can list today, and what to leave unclaimed.

Safetensors vs pickle: which model format should you load?

Prefer safetensors over pickle when a model offers both. Here is the difference, what each format can and cannot do, and a simple order of preference.

How do you right size AI agent permissions from usage logs?

Compare what an AI agent is granted with what it actually called over 30 to 90 days, then cut the difference. A step by step method and its limits.

How do you revoke an MCP server from every agent that uses it?

Removing an MCP server from every agent takes more than deleting one config line. A checklist: find users, cut access, rotate secrets, verify.

How do you review large AI-generated changes for security?

DORA links AI adoption to higher delivery instability and says small batches counter it. How to review big AI-generated diffs without rubber-stamping.