Blog

The deflection chart looks great. Then hand a human one escalated ticket exactly as the AI left it and start a two-minute clock. If they can't say what the customer asked, what the AI tried, what was promised, and who owns the next move, the handoff isn't done.

AI coding agents can generate a convincing pull request in two hours. The operator problem is review legibility: the missing receipt that makes approval safe.

At 7:42 a.m. the appointment-reminder agent is about to dial. The risky turn is not the model speaking. It is the moment a patient asks for a refill.

Eight reviewer agents approved the merge and left a page full of yellow triangles. The button is live. The warnings are still alive. Here is the artifact for that gap.

Companies watch what their agents read and write. A new benchmark says watch what they ask, too. The search trail is a data surface.

A new static scanner called SkillsGuard treats agent skill packages as untrusted code, not documentation. The idea worth keeping: a skill is a future instruction source, so put it on a quarantine bench before it loads.

A small open-source project turns a coding agent into a read-only compliance auditor. The reusable idea isn't the prompt. It's the room you run it in.

RootSign shows why agent audit logs need rehearsal. The chain may verify cleanly, but concurrency, retries, redaction, and tamper tests still deserve a deliberate break-it-first run.

The hard part of multi-agent work is not picking a framework. It is the traffic between agents after one request fans out. Here is a copyable ledger for watching it.

A clean npm audit does not mean a clean workstation. MCP servers, plugins, and skills can sit outside the review. The Agent BOM intake note catches them.

When an AI agent needs Stripe access, the default move hands it the raw key. A better pattern gives it a secret handle, a host allowlist, and a daemon that owns the call. Here is the courier policy that makes that concrete.

AutoJack turned a single web page into a host-level code execution path through a local agent control socket. The useful lesson is not panic about one pre-release bug. It is that loopback stops being private when a browsing agent shares a host with privileged local services.