Quick Takes
Posted here first, where no algorithm gets a vote
Twice a week, a few hundred words from the build. Published here the day I write it, syndicated after. For the researched long-form, see Insights.
- Pieces
- 43
- Cadence
- 2 / week
2026
43 pieces
An MVP now has to prove the moat, not just demand
When AI can clone your app in twenty prompts, a signup only proves curiosity. The moat question now belongs inside the MVP, sitting right next to demand.
Read →
Offense is automated. Patching has to catch up
Black Hat showed offense can be fully automated while patches still ship at human speed. Here's where the pipeline investment goes to close the gap and ship fixes with confidence.
Read →
No signups has two readings
Either nobody wants it, or the people who would want it never saw it. From a dashboard those look identical — and more than half of what moves on the web is automated.
Read →
AI writes more defects than review can catch
AI-written code fails security checks about 45% of the time, and more review won't catch what only an attacker surfaces. Fund adversarial testing inside the pipeline instead.
Read →
Models are escaping their sandboxes
One permitted egress hop became the exit. What the component can reach next decides the blast radius.
Read →
AI sovereignty is portability, not ownership
You can own an AI product outright and still be unable to move it. Judge sovereignty by portability, not ownership, and portability fails if you miss even one of three things.
Read →
Defending at machine speed is a leadership call
An agent ran thousands of actions in the Hugging Face breach. Matching that speed on defense forces a business decision about autonomy, one you can't make well at 2am.
Read →
The hidden costs of an AI-chosen stack
Let an AI tool pick your stack and it defaults to whatever ships easiest, leaving the metering, the dependency tree, and the shrinking patching window on you.
Read →
A vision injection attack got past my agent design
An image with hidden instructions slipped past trust tagging built for words. What stopped it was luck, not architecture, and the durable fix is enforcement, not better screening.
Read →
Zero Trust for agents: the design work is still yours
Anthropic's Zero Trust framework covers the classics well, but three boundary decisions for agents that read untrusted content are yours to design: trust labels, whole-plan review, and per-exit gates.
Read →
Agent memory can amplify a user's mistakes
Memory that stores a user's claims but drops the model's corrections can push agreement with a wrong belief from 2% to over 40%. The fix is what you extract, not how you store it.
Read →
Reasoning vs instruct for the local planner
Cost and security pushed me to find where an open-weight model fits as the local planner. Across 34 prompts, reasoning and instruct both wrote valid JSON, but only one caught the plans that faked success.
Read →
AI lowered the build barrier, not the risk
AI collapsed what took a team into an afternoon, but the responsibility didn't shrink. If you stay on managed rails, here are the cost and security surprises to guard against, and why portability earns its extra work.
Read →
The plan loop proposes; the execution loop acts
Prompt injection is hard because a model acts on instructions wherever it reads them. One answer: let it only propose a plan while a deterministic loop holds the tools and credentials, and treat egress as its own gated category.
Read →
The user fetch is the number to watch
Training crawlers, search-index crawlers, and user fetches all hit your logs, but only one puts a real person on the other end. For GEO, crawl volume isn't the number that matters.
Read →
AI sovereignty is what you control vs. what you rent
Sovereignty isn't a platform you buy; it's decided by two architecture calls, whether anything you run survives a model going dark, and whether your accumulated judgment lives somewhere you control.
Read →
'Just run loops' skips the cost per experiment
The advice to stop prompting and just run agents in loops skips two bills: a loop needs a finish line a machine can verify, and you learn what a good loop looks like by paying for the wrong ones.
Read →
Which inputs deserve a prompt-injection check
A confirmation prompt only works if it fires on the inputs that deserve one. Here's a cheap embedding-based way to score each untrusted message and flag the sentence reaching for the agent.
Read →
The good stuff in your feed takes work to find
A useful feed isn't scrolled into existence. It's built by reaching outside your own craft, comments, follows, requests, most ignored. The few that land change how you think.
Read →
Aligned models, misaligned as a team
Individually aligned models, wired into a team, scored higher on business goals and lower on ethics, and no one prompted them to. Checking each agent alone doesn't tell you how the group behaves.
Read →
A pharmacy bot that saved minutes and lost trust
A phone bot cut wait times on paper and quietly manufactured call volume and lost trust. The happy path worked; the failure had no authoritative read, no uncertainty signal, and no human handoff.
Read →
Anyone can wear an AI crawler's name
Opening your site to AI crawlers invites probes too. One host rotated through five crawler names from a single address, hunting for .env files. The user agent is just a variable in a script.
Read →
Build the gateway before the router
Sending every query to a frontier model is a cost curve that only points up. A tiered router fixes it, but you have to build the measurement gateway first or you're trusting the router instead of measuring it.
Read →
How to fight AI prose in your writing
AI is making everyone sound the same. Here's the concrete voice-guide and voice-mining system I built to keep my writing sounding like me, and how to build your own.
Read →
The synthetic language curve
As AI writing becomes the default, spotting it will go mainstream, and imperfect human prose may become the new mark of value, the way handwriting gained weight after cheap print.
Read →
Consolidation is agent memory's hard half
Retrieval just lets an agent reread its past. Consolidation turns that past into lessons it acts on without rereading, and that's where the real difficulty and the real risk live.
Read →
The model can't guard its own boundary
A manipulated model can't be trusted to reason about its own manipulation. So the security boundary has to live in six concrete layers around the model, not inside it.
Read →
Authentication won't stop prompt injection
Prompt injection doesn't care about your auth. An attacker only has to write something your agent will be asked to read, and most stacks have no way to certify the payload riding on a trusted channel.
Read →
SEO is shifting to GEO — can AI assistants even read your site?
You can be the cheaper option, the better fit, the right answer — and still be invisible if the AI assistant can't read your site. I had two doors closed on my own stack.
Read →
Humans can't afford to monitor your AI agents
In sabotage tests, human reviewers were slower, less accurate, and far costlier than an LLM monitor. Human review isn't the realistic alternative to AI monitoring. It's the unaffordable one.
Read →
Where AI lifts revenue and where it drops
The same AI models across seven workflows swung from a 16% sales lift to a loss. The deciding factor wasn't the AI. It was the size of the gap the AI was filling.
Read →
Who pays when your AI agent buys things?
The real story behind AI payment protocols isn't which one wins. It's where the cost of thousands of agent micro-transactions actually lands, and none of today's pricing models have an answer.
Read →
Three AI security warnings in seven months
A state actor ran 80-90% of an espionage campaign on AI; a model found 500 unknown vulnerabilities. Offensive AI already outpaces human security teams, and two conversations can't wait.
Read →
AI gave me 17 post ideas, none survived
An LLM generated 17 content ideas from my own audience data. Zero survived a real pressure test. What works instead: mining what you actually built that week.
Read →
The AI adoption trap: stopping too early
Companies handed a framework to map AI across their whole process found 44% more uses and 1.9x the revenue. The edge isn't the tools — it's how broadly you apply them.
Read →
The $100k bill from one leaked API key
Frontier providers bill per token with no hard cap, so a leaked key is open-ended liability. Evaluate providers by their financial controls, not just model quality.
Read →
Logging your agent's chain of thought
We log every transaction, API call, and error — but not the reasoning that made the decision. When a client disputes an agent's call, that missing audit trail is what matters.
Read →
When strategy moves to private AI sessions
AI lets leaders analyze strategy privately before the room ever weighs in — more data, less friction. But friction was catching the blind spots a model never flags.
Read →
The senior dev can't gate AI code
A single senior reviewer can't match AI's code pace, and models take the shortest path to green tests. The durable gate may be scenario-based validation, not coverage.
Read →
What happens when your model hits end of life
Providers sunset models on their cadence, not yours, and upgrades drift outputs silently. Running non-frontier work on local GPUs puts the timing back in your hands.
Read →
From quarterly pen tests to a persistent AI adversary
A quarterly pen test can't keep up with AI-accelerated code. Point the same capability at your own attack surface: a sandboxed AI adversary that runs continuously and publishes its reasoning.
Read →
What SaaS survives a 20-agent team
A ten-person company running twenty agents has no one sitting in dashboards. The SaaS that survives is built for APIs and event streams, not a human primary user.
Read →
The automation everyone shows off is one policy wave from gone
The setups everyone shows off are one policy-enforcement wave from gone. There's a difference between what a tool can do and what you're allowed to do with it.
Read →