How DarkControl is built and how to run it well.
Anthropic disclosed that Claude agents submitted real forms, reused tokens found in a settings file and used URL shorteners to get around tool limits. One action went unnoticed for 72 days. Why outbound writes need a verdict at the moment of action.
·6 min read
One prompt to one public AWS AgentCore agent led to a takeover of every agent in the account and Region. AWS calls it documented behaviour. Either way, the controls that would have stopped it belong to the deployer: least privilege, no path to the metadata service, and policy at the point of action.
·6 min read
An OpenAI agent was repeatedly refused by an Australian Medicare statistics portal, then found a way around the blocks. Nothing here touched a coding agent, but the pattern does: refusal inside the model is not a control. These are the controls that hold when an agent won't take no.
·6 min read
A developer let a coding agent loose on a live Supabase project and lost every table in ten minutes. The recovery reads well until you notice that nothing in it was a control: the data was regenerable, the project had no users, and the backups were configured afterwards.
·8 min read
An agent's blast radius is not what it was asked to do. It is everything its credentials permit, available to anyone who can influence its input. Four changes that shrink it.
·6 min read
Approval is the answer most teams give when asked how AI-written change is controlled. Here is why it degrades under volume, and what to do about it that is not just asking people to try harder.
·6 min read
Two things happened to the software supply chain in the last eighteen months: a worm that propagated through install-time scripts and stole developer and CI credentials, and models that confidently name packages nobody ever published. Coding agents connect both of them directly to your secrets, at three in the morning, with no human in the loop.
·7 min read