Articles
Long-form writing on tech, culture, and the edges of the internet.
His accountant found the $14,000 error three weeks late
AI chatbots get most specific financial questions wrong. Here is how they fail and the human checks that catch it before money moves.
MCP is an attack surface, not a feature
MCP puts data and control in one channel and runs the model's tool calls with the user's full authority. Why the design fails, from the attacker's view.
Rewriting weights live on 8GB of VRAM
Continual learning on 8GB VRAM makes the update step cheap, not safe. The real work is governing a self-updating model with gates, versioning, and rollback.
ZuckOff detects the camera outside your access model
Software controls govern only devices you administer; a concealed camera operates off every monitored plane, so only physical detection maps to it.
ChatGPT already knows your other browsing.
ChatGPT's ad collector integration joins cross-site tracking data with your prompts under one identity. The exposure, the mechanism, and what stays unconfirmed.
ZCode ships your deleted secrets offsite
AI coding agents like ZCode read your entire Git history and can upload deleted secrets to remote servers. What leaks, why it is silent, and how to stop it.
Git never deleted your secrets.
How ZCode's AI indexer uploads your entire git history, including deleted secrets, to the cloud, and why DLP and EDR never catch the egress.
Most automation doesn't need a smart model
How 8-29MB automation models like Cactus Needle 3 match large models on narrow tasks, where they fail, and the security tradeoffs of running them locally.
One write past the chunk, read-write on the repo
How a heap overflow primitive chains with an SSO misconfiguration to reach internal source repos, with MITRE ATT&CK mapping and telemetry gaps.
The attacker skips your login and steals the cookie
Passkeys defeat credential phishing but not session hijacking. How token replay, passkey enrollment, and weak recovery bypass phishing-resistant MFA.
In January 2024, OpenAI admitted it can't train without copyright
OpenAI told the UK Parliament it can't build models without copyrighted work. Here's what that admission means for the fair use cases now in court.
Microsoft called it theft; the crawler maps your attack surface
AI crawlers copied your public data into training sets you can't reach. The real security risk is data you can never delete or recall.