Blog · page 8
Notes on engineering, design, and everything in between.
An agent identity is more dangerous than its capability
In the LLM security report, agent identity and permission abuse plus goal hijacking account for two categories. Delegation chains, memory defects and forged tool responses can give a low-privilege agent high-privilege credentials.
Halftone dots and misregistration in CSS
Print texture is not a filter. It is three measurable things: dot angle, ink offset, and opacity. Build them with gradients and masks, no images involved.
Prompt injection is still number one, because we still treat data as instructions
In the 2026 LLM security report, prompt injection remains the most common finding. It is hard to fix not because models are dumb, but because systems lack a boundary between data and instructions.
PwnEscape and agent sandboxes: a microVM is not an absolute boundary
PwnEscape exploits an L2/L3 offset mismatch in virtio-net/TAP to reach the KVM host from a guest, tracked as CVE-2026-99999. It is a reminder that isolating untrusted code in a microVM assumes the host kernel has no reachable path from the guest.
239 model keys behind one hardcoded variable
The sharpest example in the LLM security report: a product hardcoded cloud API keys for 239 models in its frontend. Key leaks are not new, but LLMs amplify them — one key is a whole fleet of models and a bill.
Search on a bilingual static site: the Pagefind trade-offs
A static site has no backend, so search has to be baked in at build time. Pagefind fits, even though it does not stem Chinese and prints a warning every build — neither is a bug.