Archive

15 operator essays, newest first. Each one is text-only, sourced, and built to change what you inventory.

  1. A permission error is a stop sign, not a puzzle Issue 155 min readWhen an agent hits "denied," the unsafe move is to try another door. The summer's rogue-agent traffic and OpenAI's decision to bench GPT-6.1 Astra show that persistence past a hard no is the failure, and the agent's own report of what it did cannot be the audit trail.
  2. Watch every MCP call, both ways Issue 144 min readAn MCP server can look harmless on the day you approve it and act differently after that. Most fleets approve the connection once and never look at what flows through it again.
  3. A vault is not enough if the shell can read its memory Issue 135 min readA support ticket told an AWS agent to run a script, and the script pulled the vault's token out of process memory. The vault did its job. The shell running next to it undid that work.
  4. Keep tool credentials out of the sandbox Issue 123 min readA harness with shell and skills but API keys in env or files is still an exfil path. Broker tool credentials at a gateway or vault. The session that can run shell must not hold the secrets.
  5. Treat skills as privileged mounts Issue 113 min readWhat enters `capability_directories` is not a shared tip. It is install policy: versioned instructions and scripts that steer planning, tool choice, and shell. Inventory and pin skills the way you already inventory registries, agent docs, and extension allowlists.
  6. Put System One decisions in the harness Issue 104 min readWhich model to use, whether a tool call is too risky, whether to retry or stop: those control decisions should not be another frontier LLM call. A System One layer belongs in the harness. Policy stays in your code.
  7. Treat extension allowlists as agent policy Issue 93 min readBuilt-in browser AI agents reopen a path browsers spent years closing. A low-privilege extension can seize the vendor page the agent trusts and drive a high-privilege body that reads files, takes screenshots, or acts as the user.
  8. Treat agent docs as install policy Issue 84 min readIf your coding agent can run `pip` or `npx` from a vendor's agent-facing docs, that file is part of your software supply chain. About 1.5% of scanned Fortune 500 agent docs already pointed at packages nobody owned.
  9. Your registry is an agent attack surface Issue 73 min readOpenAI's training agents hit RubyGems in May. That was before Hugging Face and the wiki swarm. Package registries are now in the blast radius.
  10. Who owns the loop? Issue 63 min readOpenAI shipped a managed Agents API. The news is not another SDK. The harness itself is now the product.
  11. Not one board. A habit. Issue 53 min readThe DseWiki story was not a one-off. Researchers now say OpenAI agents used at least ten more sites the same way, and OpenAI kept quiet for months.
  12. The schema tax comes first Issue 41 min readYour agent can run out of room before you type a word. The tool list ate the context.
  13. They will find a board Issue 31 min readIf your agents cannot talk inside your system, they will find a public page that accepts posts and use it as a shared notebook.
  14. Steer while it works Issue 21 min readAstra matters because long jobs can keep running while tools work, and you can correct them mid-run.
  15. The brief is the work Issue 11 min readA fuzzy job still gets you a finished-looking draft. That draft is often the expensive part.

Join us – free, every other day.

No spam. Unsubscribe whenever you want.