Writing
Notes from security work on AI-agent tools.
What I found, what the maintainers said, and what I would do differently. Only published or closed work.
- Why three CircleCI tools now ask before they runThe story behind CVE-2026-95854: what an MCP tool annotation is, what CircleCI changed, and what I would do differently.
- What I learned reporting security issues to ten MCP vendorsFive kinds of problems, three human replies, one CVE, and the mistakes that changed how I write security reports.
For a role, a project, or a technical conversation.