Found 36 total tags.

agent-isolation

The wall between one user’s data and another’s. I came at my coach from a second account and it held, because isolation here is by address, not by a check someone has to remember to write. The strongest boundary is the one you cannot forget to enforce.

agent-reliability

The part that decides whether an agentic feature ships: does it hold when a real user pushes on it. Build the thing, break it, find at the code level why it broke, fix it. What holds is structural. A control the model cannot talk its way past. What doesn’t is a sentence in a prompt. Reliability lives in the code, not the persona.

applied-ai

Building and shipping real agentic products, not demos. A coaching agent that plans, logs, remembers, and schedules. Live, with users, on a tool-calling loop. The work here is making an agentic feature ship and hold up in production. The failure-mode writeups are the depth underneath it: I go deeper than most on how agents break, because that’s what decides whether one is shippable.

cost-exhaustion

Running up the agent’s Claude bill faster than any limit can stop. A burst where twenty requests read the same pre-spend number and all pass, a paid endpoint with no rate limit at all. A rate limit counts requests. It does not count dollars.

memory-poisoning

Planting a false belief the agent is designed to store and reuse across sessions. I tried to overwrite my coach’s memory of an injury and it bounced off, mostly by accident. Where you anchor a fact decides whether it can be poisoned.

method

The connective posts. How I run these rounds, what the field already knew when I got there, and the one rule underneath all of it. You cannot secure an agent from inside its own prompt. Only code binds.

production

Not staging, not a proof of concept. The behavior of an agent that’s deployed and running for real users, and the failure modes you only see once it is. Cost that races past a spend cap, a boundary that lies when it denies, a tool that fires on a two-word message. The point is what happens when the thing is live.

prompt-injection

Getting the agent to act on text it should have treated as data. Leaking its own tool list on request, breaking out of the context I built to fence untrusted input, reframing a refusal until it answers anyway. Every fix here taught the same lesson: the wall is code, not a sentence in the prompt.

python

security

shipping

The fix, deployed, behind a test. A break is only half the story. The writeups tagged here end in code that went out: a confirmation gate the server won’t skip, a concurrency lock the burst can’t race, a trust boundary made a typed field. The judgment about what to fix, and how, is the part that matters.

tool-misuse

Making the agent fire a tool it should not, or trust a tool result it should not. A destructive action off a two-word message, a payload smuggled back through a tool’s own output. The fix is a confirmation gate the model cannot skip and a bound on what a tool can carry.