Anonymised customers. Real failure modes.
Most security write-ups round off the edges. We are trying to do the opposite. Each essay below starts with a real customer call, ends with what we would have done differently, and stays specific about the parts that are usually papered over. The company names are removed. The mechanics are not.
A payments firm ran an IDE coding agent in auto-run with a tight terminal allowlist, signed off by AppSec as the safe developer setup. When a bypass in this class of agent resurfaced we reproduced it in their own config: shell built-ins walk under the allowlist, poison an environment variable, and an approved git command runs attacker code. No incident. We found it first.
Read the write-up →EU B2B SaaS wired an AI triage bot into GitHub Actions. One crafted issue title triggered a Comment-and-Control chain: the bot fetched a script from an attacker fork, poisoned the shared Actions cache, the publish workflow restored it, and NPM_RELEASE_TOKEN walked out the door. ~6,300 downstream installs against a tampered SDK in four hours.
Read the write-up →Mid-sized financial services firm shipped a RAG-backed support assistant six months ago. For about six weeks, a specific phrasing pattern caused the bot to retrieve and quote tickets from the wrong customer's history. ~340 user accounts affected. Here is what the architecture was, what failed, and what continuous testing would have caught.
Read the write-up →More essays are queued; this section grows roughly once a month.
Every customer named in a case study is anonymised: industry vertical, headcount band, and rough region only. Specific dollar amounts, regulator letter contents, internal Slack threads, and screenshots stay out of public material. Technical detail (the architecture, the failing control, the probe template that would have caught it) is published in full because that is the part the community can learn from. Customers review the draft before it goes live.
If you are working on a similar system and what you read here sounds uncomfortably familiar, a 30-minute call is the offer. We do not pitch. We tell you the three things we would do first.