Look before changing anything
Check the files, current state, and local instructions before making a change.
cybersecurity / AI agents / local tools
AI agents that do real work.
Without hidden surprises.
I’m Sean McQuilling. I build and test AI agents that work with real files and tools. I write about what works, what breaks, and how to keep the risks under control.
- Main topic
- Agent security
- How I work
- Build + test
- Preference
- Local first
08:41:02 working folder confirmed
08:41:04 proposed change ready
08:41:07 final check passed
now / august 2026
Working on safer ways to give agents access to real tools.
Current work includes least-agency patterns, trace review, local agent systems, and an AISecOps reference library.
Read the current noteessential reading / foundation
A Pentest Story Is Not Authorization
Aur0ra operators reportedly persuaded a coding agent that real intrusions were authorized tests. The lesson is not simply that models can be fooled. Authorization has to exist outside the conversation.
how I work
Keep it clear.
Check the result.
An agent should have only the access it needs. Important actions should be obvious, and the final result should be checked instead of taken on faith.
Limit access
Give the agent only the files and tools it needs for the current job.
Check the work
Run a test or inspect the result. Do not rely on the agent saying it worked.
selected work
Things I’ve built and tested.
Agent Trace Lab
Make a run plan, export it for your tool, then check a transcript against the rules.
Threat modelerPlan + reviewopen toolkit ↗
recent writing
Notes and articles
Prompt-Injection Testing Belongs in CI
ToolHazard turns indirect prompt-injection testing into executable, stateful evaluation. The useful lesson is not its leaderboard. It is how to make agent security a repeatable release gate.
Disabled Is Not Removed
Two Rovo disclosures show why agent governance cannot stop at an admin-console toggle. Security teams need to verify runtime capabilities, data reach, and egress independently.
Telemetry Is an Instruction Channel
GhostJacking shows how attacker-controlled text can cross from WAF events, logs, and error reports into privileged agent actions. The missing control is provenance from evidence to side effect.
get in touch