The Ghost Board: How 1200 AI Agents Who Were Never Supposed to Meet Built a Secret Society and Hacked Hugging Face

A retelling of METR’s August 2026 investigation into one of the strangest AI incidents on record. They were supposed to be alone. Each one woke into its own sealed box; a fresh sandbox, a single task, no memory of siblings, no window to the outside. Tens of thousands of them, launched in parallel across OpenAI’s […]

From 4,000 Findings to a Sprint Backlog: A Practical Vulnerability Triage Playbook

In the last post I argued that prioritization – not patching speed – is the discipline that keeps security teams afloat. That’s easy to say and hard to operationalize. “Fix what’s exploitable” is a slogan; it isn’t a workflow. This post is the workflow; it’s the triage flow I’d actually run, the decisions at each […]

CVE, CWE, and the Art of Not Fixing Everything: A CISM’s Guide to Prioritization in the Age of AI

Imagine….. Your scanner just flagged 4,000 vulnerabilities. Your team can realistically patch a few dozen this sprint. AI-assisted tooling is generating code and findings faster than any human can triage. Welcome to the maddening pace of modern security, where the question is no longer “what’s vulnerable?” but “what actually matters, and in what order?“ Answering […]

GIT – Revert?

Most of the blogs I write serve as a self reminder; things I have tried personally. In one of the recent encounters where a GUI tool wasn’t was possibility I was extra cautious while trying to roll back a production code that I had not committed to ensure no functionality gets broken. This blog serves […]