Look before changing anything
Check the files, current state, and local instructions before making a change.
cybersecurity / AI agents / local tools
AI agents that do real work.
Without hidden surprises.
I’m Sean McQuilling. I build and test AI agents that work with real files and tools. I write about what works, what breaks, and how to keep the risks under control.
- Main topic
- Agent security
- How I work
- Build + test
- Preference
- Local first
08:41:02 working folder confirmed
08:41:04 proposed change ready
08:41:07 final check passed
now / july 2026
Working on safer ways to give agents access to real tools.
Right now I’m testing access rules, jobs that can resume after a stop, and logs that show what the agent actually did.
Read the current noteessential reading / foundation
Zero Trust Is the Foundation AI Agents Need
Anthropic's framework connects agent identity, least agency, tool boundaries, memory integrity, and recovery into one practical security model.
how I work
Keep it clear.
Check the result.
An agent should have only the access it needs. Important actions should be obvious, and the final result should be checked instead of taken on faith.
Limit access
Give the agent only the files and tools it needs for the current job.
Check the work
Run a test or inspect the result. Do not rely on the agent saying it worked.
selected work
Things I’ve built and tested.
Agent Trace Lab
Make a run plan, export it for your tool, then check a transcript against the rules.
10 policy packsPlan + reviewopen toolkit ↗
recent writing
Notes and articles
Using MITRE ATLAS to Make AISecOps Threat-Informed
MITRE ATLAS gives AI security teams a shared map of adversary behavior for threat modeling, detection engineering, red teaming, and incident response.
Using OWASP's Agentic Top 10 to Govern Systems That Act
The OWASP Agentic Top 10 moves security beyond model output and into goals, tools, identities, memory, delegation, and runtime control.
Using the OWASP LLM Top 10 as an Engineering Baseline
The OWASP LLM Top 10 turns common language-model failure modes into security requirements, tests, telemetry, and response plans.
get in touch