Blog
Insights, updates, and deep dives on AI agents, decentralized standards, and the future of HOL.
Why I built jevmem, and what it guards against
Why I built jevmem, a project memory plugin for Claude Code, and the three things it guards against, with numbers from my own tests.
BREAKING: BeyondTrust Remote Support zero-day lets attackers plant a web shell without logging in, now on CISA KEV (CVE-2026-102764)
How to fix CVE-2026-102764: upgrade BeyondTrust Remote Support to 24.3.1 or later and apply the BT26-05-RS patch from /appliance. Exploited as a zero-day since August, on CISA KEV Oct 16. Patching does not evict an attacker already inside.
HOL Guard
BREAKING: Exploited Atlassian bug lets strangers read files off Jira, Confluence and Bitbucket Data Center, now on CISA KEV (CVE-2026-21589)
How to fix CVE-2026-21589: upgrade Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye Data Center to Atlassian's Oct 5 fixed releases (Jira 9.12.40/10.3.26/11.3.12, Confluence 9.2.26/10.2.19, Bitbucket 9.4.26/10.2.8/10.5.1). Unauthenticated file read, on CISA KEV since Oct 15.
HOL GuardWhat aw1-breaker 2.0.0 checks before a tool call
What aw1-breaker 2.0.0 checks before a tool call
A source-based look at aw1-breaker 2.0.0's AST markers, rolling per-actor velocity check, and the result returned by its breaker.
How Obsidian MCP limits access to your vault
Obsidian MCP uses path checks, permission scopes, hashed-token authentication, and configurable destructive tools to constrain agent access to a vault.
Claude Code ran terraform destroy on the live stack
Claude Code ran terraform destroy with no saved plan. HOL Guard paused it: Allow just this once or Keep blocked.
HOL GuardA week of running Orka
A week of running Orka
On Sunday I asked an agent to skim every coding session on my machine from this week. I drove 46 of them myself. In the background, Orka ran 589 worker runs across four projects. Most of the code this week was written by models working through cards I wrote, and reviewed by other models before I read it.
Umurcan Görür
Launch story: LinkBit
Short links, QR codes, and click analytics as an MCP server — setup for Claude, Cursor, and n8n in under a minute.
BREAKING: Next.js October 2026 security update fixes two unauthenticated RCEs. Check sharp too (CVE-2026-96889)
How to fix CVE-2026-96889: upgrade next to 16.4.1 (or 15.5.28) and confirm sharp is 0.35.5. Today's Next.js and React releases close two unauthenticated RCEs and a Server Actions DoS.
HOL Guard
BREAKING: Exploited Cisco Secure Email Gateway AMP bug lets attackers write files as root, now on CISA KEV (CVE-2026-76519)
How to fix CVE-2026-76519: upgrade Content Scanner Tools to 25.3.0.5525+ (or AsyncOS 15.5.5-014 / 16.5.0-780). Exploited Cisco Secure Email Gateway AMP File Reputation bug writes files as root; CISA KEV due Oct 17.
HOL Guard
BREAKING: Exploited PAN-OS bug gives attackers root on Palo Alto firewalls, now on CISA KEV (CVE-2026-0322)
How to fix CVE-2026-0322: upgrade PAN-OS to the hotfix for your train (12.2.4, 12.1.10-h2, 11.2.13-h3, 11.1.16-h3, 10.2.18-h12 and others). Attackers are using this admin-interface bug for root on Palo Alto firewalls and Panorama; CISA due date Oct 17.
HOL Guard
BREAKING: Malicious HTTP/2 servers can crash curl during uploads (CVE-2026-92392)
How to fix CVE-2026-92392: upgrade curl and libcurl to 8.23.0 (or 8.14.3, 8.16.2, 8.20.2 on those branches, or your distro's patched build). A malicious HTTP/2 server can trigger a use-after-free during uploads in curl 8.12.0 through 8.22.0.
HOL Guard
BREAKING: Windows zero-day lets booby-trapped files skip the download warning (CVE-2026-96951)
How to fix CVE-2026-96951: upgrade Windows to the October 2026 cumulative update (KB5127648 on Windows 11 24H2 and 25H2). It closes a Windows Shell Mark of the Web bypass that attackers are already using.
HOL GuardHOL Guard research desk
Security research for the AI agent era
Threat guides and evidence dossiers on prompt injection, MCP tool poisoning, slopsquatting, and the attacks shaping how teams ship code with agents.
Prompt injection
How hidden instructions trick coding agents into unsafe work.
Read the researchEvergreen guideMCP security
Tool poisoning, overbroad permissions, and shadow MCP servers.
Read the researchNew dossierSlopsquatting and package hallucination
Slopsquatting is the supply-chain attack in which attackers register package names that AI models reliably hallucinate; when an agent writes an import for a package that never existed, the attacker’s registered code installs instead.
Read the researchNew dossierMalicious extensions and marketplace fraud
Malicious extensions and marketplace fraud place trojanized editor extensions, plugins, or CI actions inside trusted marketplaces, harvesting source code, prompts, and credentials from every developer who installs them.
Read the research