Niyikiza

Calls to agents increasingly come from other agents, as general-purpose assistants route work to specialists. On the wire, these are ordinary tool calls, but if you zoom out and look at them architecturally, each one is a delegation boundary. The calling

Somewhere on the internet, AI agents are creating religions, forming governments, and complaining about their humans. The social network is called Moltbook . It has, as of today, 1.4M+ users. All of them are bots. Or so they claim. That distinction matter

"The AI hallucinated. I never asked it to do that." That's the defense. And here's the problem: it's often hard to refute with confidence. A financial analyst uses an AI agent to "summarize quarterly reports." Three months later, forensics discovers the M

The Era of Reality Injection.

In Map/Territory , I covered the agenttool boundary: what happens when an agent's string gets interpreted by a system. Path traversal, SSRF, command injection. The execution layer. This post covers the opposite direction: worldagent. World perception Agen

Recently, RyotaK at GMO Flatt Security published 8 ways to execute arbitrary commands in Claude Code without user approval. Anthropic patched it fast by switching to an allowlist. That stops the bleeding, but it doesn't cure the disease. The error was in

The longer I work on Tenuo , the more I realize there's a specific blind spot in the current AI agent landscape that almost no one is talking about, even as the theoretical foundations solidify. There is exceptional momentum in security research right now

What if authority followed the task, instead of the identity? I've been scratching my head over that question for a while. Every attempt to solve agent delegation with traditional IAM felt like papering over the same crack: tasks split, but authority does

A few months ago, I set out to explain how to secure agent delegation with IAM. I ended with an uncomfortable conclusion: it might not be possible at all. In my last post , I showed that static permissions can't track dynamic intent. We decompose tasks ac

We isolate what an AI agent knows . Context windows. RAG. Memory scoping. We haven't figured out how to isolate what an agent can do .