Technology

Nobody reviews their cloud configuration by hand. There is too much of it, it changes under you, and the dangerous mistakes (a storage bucket opened to the world, an admin account with no second factor, a node agent that will answer anonymous requests) don’t announce themselves. Vulnerability scanners don’t help much here either; they look at the software running on a host, not at whether the host’s own control plane is set up the way it should be. That gap is what posture management tools exist to fill: pull the configuration out of the cloud APIs, compare it against a published checklist, and tell you what fails. ...

Say you run a security operations center and you want an AI copilot to help triage network traffic. The raw material is sitting right there: AWS VPC Flow Logs, a line per network connection, millions of them a day. Pasting them into a hosted large language model (an LLM, the kind of model behind Claude or ChatGPT) feels like it should just work. The problem is what a flow log line actually contains: your internal IP layout, your AWS account number, the identifiers of your network cards. Hand that to a third-party service and you have shipped a map of your private network to someone else’s computer, where it may be logged, cached, or used for training. ...

A Go service can pass every test, clear go vet without a word, and still be quietly broken. The kind of bug I mean does not throw an exception or fail an assertion. It leaks. A file handle that never gets closed, a goroutine that nobody waits for, a lock that an early return skips over. Each one is invisible on a laptop with a single request in flight, and each one turns into a 3 a.m. incident once real traffic arrives: file descriptors exhausted, memory climbing with abandoned goroutines, a handler wedged on a lock that was never released. ...

Here is a situation that has quietly become everyone’s problem. A vendor ships you a piece of software, and along with it a file called bom.json. It is a Software Bill of Materials, or SBOM: a machine-readable list of every open-source component inside that software, the same way a packaged food lists its ingredients. Regulators now ask for these, procurement teams now demand them, and your own security team now receives them. So the file lands in your inbox. Now what? ...

Coding agents are good at writing code that looks right. The failure mode everyone who uses them has hit is code that calls something that doesn’t exist: a helper the model assumed you had, a method the library never shipped, a package name that sounds plausible. Python doesn’t complain until the line runs. A reviewer skimming a 400-line agent PR may not notice either, because the code reads fine. The Rabbit Hole Generator picked Skylos this week. Its pitch for that problem is to treat review as a proof: before a human looks, statically check that every package, helper, and API the change references actually exists, and say incomplete instead of guessing when it can’t tell. Its README tagline is “Code checks that show their work.” That’s a claim a security reader can test directly, so I did. I planted eight different AI-style mistakes and ran them through Skylos, through two ordinary Python tools for comparison, and through the pull request gate Skylos generates for GitHub Actions. Then I tried to get a bad change past that gate. ...