Blog

Notes and reflections.

On AI agent security, MCP vulnerabilities, and building secure agent infrastructure.

ai-agentssecuritycredentials

AI agents don't understand secrets

23.8 million secrets leaked on GitHub in 2024, and repos using Copilot show 40% higher leak rates. After scanning thousands of MCP server configs, here's how credentials actually leak through AI agents — and what to do about it.

Read article
mcpsecurityai-agents

The 5 MCP security blind spots most teams miss

MCP is becoming the backbone of AI agent infrastructure. But most teams deploying MCP servers are making the same critical security mistakes. Here are the five I see the most.

Read article
ai-agentssecurityaguara-watchecosystem

What monitoring 40K agent skills taught us about the ecosystem

We built Aguara Watch to monitor the AI agent ecosystem at scale. After tracking 40,000+ skills across 7 registries, here's what the data reveals about where this is heading.

Read article
ai-agentssecuritymcp

Why AI agent security can't wait

We're deploying AI agents into production faster than we're securing them. After scanning thousands of MCP servers and agent configurations, here's what I'm finding.

Read article
ai-agentssecurityinfrastructuremcp

A million agents, zero trust: the security crisis no one is talking about

We're heading toward a world where millions of AI agents interact autonomously. The infrastructure to secure that world doesn't exist yet. Here's what we need to build.

Read article