From the counter
52 posts
-
The 2026 agent-ecosystem incident ledger: ten malicious skills, MCP servers and lures, sourced and dated
Ten publicly documented incidents, each traced to the finder's write-up or an advisory, fall into four repeat patterns. Lookalike MCP servers lead with five. Removal time is public for only two.
-
The agent decision log: what auditors, insurers and incident responders will ask your coding agents to prove
After an agent incident, everyone asks what was installed or fetched, under which policy, and who approved it. A minimum log schema, mapped to hook and telemetry fields, lets you answer with a query.
-
Where should an agent artifact check run? Hook vs package wrapper vs gateway vs registry, by what each can see
Each enforcement point sees a different slice. Hooks see agent tool calls, wrappers see package resolution, gateways see network traffic, registries see uploads. Place checks by the artifacts and failure modes you actually face.
-
After NVD's triage: what a 2026 CVE record still carries, and how small teams rebuild triage for free
In a sample of 890 CVE records published in 2026, 96% carried a CVSS score from the CNA or CISA, but under 10% carried a CPE string. Severity mostly survived NVD's triage. Product matching did not. Here is the free rebuild.
