Blog

Notes on credential security for AI agents.

Your AI coding agent can read every secret on your machine. In August 2025, one did.

2026-10-08 — The s1ngularity npm attack didn’t exploit a bug in any AI agent — it just asked nicely. The structural fix is to never let the agent hold the secret.