The Database Note That Copilot Read
SQL Copilot's instruction metadata got me thinking about who can leave notes for an agent, and whose permissions it has when it acts on them.
cybersecurity / AI agents / local tools
Building agents.
Figuring out the security.
I’m Sean McQuilling. I work on enterprise security and build AI agents on my own machines. This is where I share the experiments, awkward failures, and security questions that come out of both.
- Main topic
- Agent security
- How I work
- Build + test
- Preference
- Local first
AGENT SECURITY / BY DESIGNIllustration
Capability isn’t
permission.
New here? Start with a reading path →
work update / last updated october 2026
Updating the site’s field notes and documenting the current Aria build.
The latest posts look at MCP OAuth and SQL Copilot. Aria’s project notes now describe her current portrait selection and creative tools.
Read the current notefeatured / cybersecurity
A Small Detail in the MCP OAuth Fix
The Python SDK update caught my attention because finishing the fix takes a little more than changing a version number.
from my own builds
Meet Aria.
A local companion with a lot going on.
Research, memory, an image studio, her own inbox, and the occasional evening playing a DOS game together. Aria is where many of the notes on this site began.
Explore Aria →selected work
Things I’ve built and tested.
Agent Trace Lab
Sketch an agent’s risks, make a run plan, and work through a transcript in your browser.
Threat modelerPlan + reviewopen toolkit ↗
recent writing
Notes and articles
What Did the Agent Actually Read?
Use CyberChef to inspect an encoded instruction in a tool response, then separate an agent's proposed action from what actually happened.
Your Evaluation Sandbox Holds Production Authority
An evaluation environment can be disposable while its credentials are not. A practical design for separating test workloads, provider keys, and production authority.
get in touch