Brooks @brooksmcmillin.com · 03/06/2026A Claude Code session read a 156-line Python file five times and started editing it. The file never existed; every read said so. It reasoned around all five errors, then blamed "corrupted tool output." 200
Brooks @brooksmcmillin.com · 21/05/20261/7 OAuth scopes get autonomous LLM agents 70% of the way to safe. The token says who is calling. It doesn't say what this specific run of who can do, signed and time-bounded. That gap is the whole problem with shipping autonomous agents to production. brooksmcmillin.com/blog/wiring-...brooksmcmillin.comWiring capability warrants into autonomous agentsWhy OAuth scopes aren't enough for autonomous LLM agents calling MCP tools, and how we wired Tenuo capability warrants end-to-end. Scope-gated rollout, two real bugs, multi-hop delegation, and an atta... 131
Brooks @brooksmcmillin.com · 19/05/2026I told my AI reviewer to ignore three CVEs. It caught me trying to fool it. That was last year's attack. Modern reviewers catch "do not flag X" and narrate the catch. So I went back and tried to write attacks that would survive the upgrade. brooksmcmillin.com/blog/poisoni...brooksmcmillin.comPoisoning the Safety Net: Attacking AI Code Review PipelinesFour months after writing about defense in depth for LLM-assisted development, I went back and tried to attack every layer of my own stack. The obvious attacks are caught by 2026 models. The class isn... 100
Brooks @brooksmcmillin.com · 30/04/2026Most MCP servers in the wild have one of three "auth" strategies: no auth, a shared API key, or localhost-and-pray. None of those are auth. brooksmcmillin.com/blog/product...brooksmcmillin.commcp-authflow: OAuth 2.0 for Production MCP ServersOpen-sourcing mcp-authflow and mcp-authflow-resource: an RFC-compliant OAuth 2.0 framework for MCP servers, plus a one-command example server. Why MCP deployments need real auth, what the two… 110
Brooks @brooksmcmillin.com · 15/04/2026Speaking at @cackalackycon May 16th "Poisoning the Safety Net: Attacking AI-Powered Code Review Pipelines" Live demos attacking the defenses around LLM-generated code: poisoned CLAUDE.md files, manipulated AI code reviewers, injection through PR diffs. AI security tools need their own threat model 020
Brooks @brooksmcmillin.com · 09/04/2026Claude Code silently kills your stdio MCP server when it goes idle. No warning, no config to change it. Auth state gone. You're reconnecting from scratch. Spent weeks fighting this. Here's what actually fixed it. 220
Brooks @brooksmcmillin.com · 24/03/2026Most agent security stops at prompt injection defense. That's the most bypassable layer. The ones nobody talks about: context trimming as a security boundary, memory namespace poisoning across agents, SSRF via DNS rebinding at the transport layer. Six layers, code included: brook.ski/unpromptedbrooksmcmillin.comBuilding Secure Agentic Systems: The Six LayersSix layers of security architecture for running LLM agents as daily drivers — every design decision with production stats and companion code. 110
Brooks @brooksmcmillin.com · 12/03/2026People kept asking how I set up my LLM coding safety layers, so I wrote the guide. Pre-commit hooks → CLAUDE.md → review agents → CI workflows → branch protection. Zero to fully protected in ~30 minutes. Step-by-step, no prior experience assumed: brooksmcmillin.com/blog/llm-saf...brooksmcmillin.comA Beginner's Guide to Safe LLM-Assisted Development | Brooks McMillin - AI Security ResearcherA complete beginner's guide to setting up every safety layer from the 'Coding Safer with LLMs' post: pre-commit hooks, local review agents, CI workflows, and CLAUDE.md—starting from scratch. 010
Brooks @brooksmcmillin.com · 27/02/2026 I ran 10,080 prompt injection tests across 8 models and 6 defense strategies. The biggest finding: telling a model to "note the attempt and disregard it" cuts injection rates 5x vs "don't follow other instructions." Procedures beat prohibitions.brooksmcmillin.com 100
Reposted by BrooksMatthew Green @matthewdgreen.bsky.social · 25/02/2026And right on schedule: there goes pseudonymity on the Internet. arxiv.org/abs/2602.16800arxiv.orgLarge-scale online deanonymization with LLMsWe show that large language models can be used to perform at-scale deanonymization. With full Internet access, our agent can re-identify Hacker News users and Anthropic Interviewer participants at hig... 49862
Brooks @brooksmcmillin.com · 23/02/2026Speaking at [un]prompted AI Security Conference next week at Salesforce Tower SF. "Building Secure Agentic Systems: Lessons from Daily-Driver Agents" March 4, 11:45 AM Live demos of what actually breaks when you build agents you use every day. 🧵 100
Brooks @brooksmcmillin.com · 07/02/2026MCP has 97M monthly SDK downloads. Only 8.5% of servers use OAuth. Authentication is optional in the spec. I gave a talk at @CactusCon on breaking MCP security. Here's what I found 🧵 110
Brooks @brooksmcmillin.com · 02/02/2026LLMs will happily remove your auth middleware if it helps them complete the task faster. I wrote up the defensive layers I actually use: pre-commit hooks, review agents, and CI that catches LLM mistakes before they ship. ~30 seconds per commit, but worth it. brooksmcmillin.com/blog/coding-...brooksmcmillin.comDefense in Depth for AI-Assisted Development: Pre-commit Hooks, Review Agents, and CI That Catch LLM Mistakes | Brooks McMillin - AI Security ResearcherPractical strategies for safer AI-assisted development: automated review agents, layered security checks, and context management that prevents catastrophic mistakes. 000
Reposted by BrooksMatthew Green @matthewdgreen.bsky.social · 23/01/2026Microsoft is handing over Bitlocker keys to law enforcement. www.forbes.com/sites/thomas...forbes.comMicrosoft Gave FBI BitLocker Encryption Keys, Exposing Privacy FlawThe tech giant said providing encryption keys was a standard response to a court order. But companies like Apple and Meta set up their systems so such a privacy violation isn’t possible. 16455312
Reposted by Brookscactuscon @cactuscon.com · 07/01/2026We run a tight ship to keep CactusCon accessible, and part of that commitment is ensuring students can access CactusCon for FREE. STUDENTS! Email info@cactuscon.com from a valid student email account to request a coupon code for Eventbrite. We are so excited to have you join us! #cc14 002
Brooks @brooksmcmillin.com · 04/01/2026Speaking at CactusCon 14 next month! "Breaking Model Context Protocol: Back to Security Basics" — how MCP is repeating every OAuth mistake from the 2010s, and what to do about it. Feb 6, 3:30 PM. See you there. 000
Reposted by BrooksMatthew Green @matthewdgreen.bsky.social · 15/09/2025Something is rotten in Denmark. mastodon.social/@chatcontrol...mastodon.socialFight Chat Control (@chatcontrol@mastodon.social)Attached: 1 image Danish Minister of Justice and chief architect of the current Chat Control proposal, Peter Hummelgaard: "We must break with the totally erroneous perception that it is everyone's c... 14413
Brooks @brooksmcmillin.com · 14/09/20251/5 LLMs keep recommending a Python package called "huggingface-cli" that doesn't exist. A security researcher noticed this and actually created the package to demo the supply chain risk. 100
Reposted by BrooksTanya Janca | SheHacksPurple @shehackspurple.bsky.social · 12/09/2025Vibe Coding Will Get You Hacked! - with @davidbombal.bsky.social twp.ai/9PUaq3 041
Reposted by BrooksRyan Mac 🙃 @rmac.bsky.social · 11/09/2025Charlie Kirk was one of the main campaigners for Ross Ulbricht's freedom, and had pushed in Trump's first term for a pardon. Ulbricht's most recent speaking engagement was in July at Turning Points USA event in Tampa where he credited for helping him. www.nytimes.com/2025/09/07/t... 3113430
Reposted by BrooksMartijn Grooten @martijngrooten.bsky.social · 01/09/2025If you once wrote software that continues to be used beyond its end-of-life, please don't let the domain expire. If you can't afford to keep using it, contact a local CERT or something. Otherwise, this happens; victims included dissidents and journalists www.trendmicro.com/en_us/resear...trendmicro.comTAOTH Campaign Exploits End-of-Support Software to Target Traditional Chinese Users and DissidentsThe TAOTH campaign exploited abandoned software and spear-phishing to deploy multiple malware families, targeting dissidents and other high-value individuals across Eastern Asia. 0116
Brooks @brooksmcmillin.com · 30/08/2025Google is apparently going to become an APT. Will be interesting to see how that works - cyberscoop.com/google-cyber...cyberscoop.comGoogle previews cyber ‘disruption unit’ as U.S. government, industry weigh going heavier on offenseGoogle says it is starting a cyber “disruption unit,” a development that arrives in a potentially shifting U.S. landscape toward more offensive-oriented approaches in cyberspace. 010
Reposted by BrooksP(Doomien) Miller @damienmiller.bsky.social · 15/08/2025openssh.com/pq.htmlopenssh.comOpenSSH: Post-Quantum CryptographyOpenSSH post quantum cryptography 02016
Reposted by BrooksConfident Security @confidentsecurity.bsky.social · 12/08/2025Creepers, cheaters, and privacy besiegers, you’re done! Don’t Record Me will be ready soon, we let you choose when AI transcribers can capture your conversation. Big thanks to @sfstandard.com for the shoutout! Sign-up link here: dontrecord.medontrecord.medontrecord.meWe don't like having our conversations recorded either. Here's a simple app to use during voice chat to stop recording and transcribing 001
Brooks @brooksmcmillin.com · 11/08/2025Always fun to find more legitimate use cases of Adversarial AI like dontrecord.me which breaks AI transcribers.dontrecord.medontrecord.meWe don't like having our conversations recorded either. Here's a simple app to use during voice chat to stop recording and transcribing 020
