Blog
Insights, updates, and deep dives on AI agents, decentralized standards, and the future of HOL.
BREAKING: Plex Media Server hijacked without a login to mine crypto and run proxies, now on CISA KEV (Plex2Shell, CVE-2026-96652)
How to fix CVE-2026-96652: upgrade Plex Media Server to 1.43.3.10861 or later. The Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) is exploited to install crypto miners and proxies, on CISA KEV Oct 20. Updating does not remove an infection.
Your AI Agent Writes Code. Who's Auditing Its Commits?
A maintainer's guide to conventional-commits-framework — what it does, who it helps, and how to get started.
What I Check Before I Install a Claude Plugin on a Client's Computer
What I Check Before I Install a Claude Plugin on a Client's Computer
A Claude consultant's pre-install checklist for small businesses: who made it, what it tells Claude to do, what it runs, what it touches, what Claude finds when it reviews it, where it gets tested, and who keeps track.
Michael Robichaud
A declaration buys fewer stages, never fewer boundaries
The ai-native-sdlc plugin packages six stages as committed Markdown artifacts and uses an opt-in PreToolUse gate to block uncovered source-code writes.
Letting an agent run Home Assistant, one approval at a time
Letting an agent run Home Assistant, one approval at a time
Home Assistant MCP (Vome) is now listed in HOL Guard. The source lists 57 tool entries across 11 risk classes: 56 marked for review and one `other` entry set to inherit its state.
VibesPlug's README lists 155 agents and supported coding tools
VibesPlug's README lists 155 agents and supported coding tools
The project README lists 155 specialized subagents, supported coding tools, npm setup commands and a standalone MCP server.
Your agent should never be handed a shell
Your agent should never be handed a shell
GuardFall reported exploitable agent-to-shell boundaries in 10 of 11 surveyed open-source AI coding agents under its tested configurations. SysKnife uses typed actions instead of model-supplied shell strings, terminal-issued approval receipts, and an Ed25519-signed audit chain.
Why I built jevmem, and what it guards against
Why I built jevmem, a project memory plugin for Claude Code, and the three things it guards against, with numbers from my own tests.
BREAKING: BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, now on CISA KEV (CVE-2026-102764)
How to fix CVE-2026-102764: upgrade BeyondTrust Remote Support to 24.3.1 or later and apply the BT26-05-RS patch from /appliance. Exploited as a zero-day since August, on CISA KEV Oct 16. Patching does not evict an attacker already inside.
HOL Guard
BREAKING: Exploited Atlassian bug lets strangers read files off Jira, Confluence and Bitbucket Data Center, now on CISA KEV (CVE-2026-21589)
How to fix CVE-2026-21589: upgrade Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center to Atlassian's Oct 5 fixed releases (Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1). Unauthenticated file read, on CISA KEV since Oct 15.
HOL GuardWhat aw1-breaker 2.0.0 checks before a tool call
What aw1-breaker 2.0.0 checks before a tool call
A source-based look at aw1-breaker 2.0.0's AST markers, rolling per-actor velocity check, and the result returned by its breaker.
How Obsidian MCP limits access to your vault
Obsidian MCP uses path checks, permission scopes, hashed-token authentication, and configurable destructive tools to constrain agent access to a vault.
Claude Code ran terraform destroy on the live stack
Claude Code ran terraform destroy with no saved plan. HOL Guard paused it: Allow just this once or Keep blocked.
HOL GuardHOL Guard research desk
Security research for the AI agent era
Threat guides and evidence dossiers on prompt injection, MCP tool poisoning, slopsquatting, and the attacks shaping how teams ship code with agents.
Prompt injection
How hidden instructions trick coding agents into unsafe work.
Read the researchEvergreen guideMCP security
Tool poisoning, overbroad permissions, and shadow MCP servers.
Read the researchNew dossierSlopsquatting and package hallucination
Slopsquatting is the supply-chain attack in which attackers register package names that AI models reliably hallucinate; when an agent writes an import for a package that never existed, the attacker’s registered code installs instead.
Read the researchNew dossierMalicious extensions and marketplace fraud
Malicious extensions and marketplace fraud place trojanized editor extensions, plugins, or CI actions inside trusted marketplaces, harvesting source code, prompts, and credentials from every developer who installs them.
Read the research