// Blog

Blog

Writing from the work of building lab and studio systems.

2026-09-14

A public exhibit that cannot reach inward

In late August 2026 we stood up a separate public exhibit box: documented on the 26th, cut over on the 29th, with further deployment work on both exhibits through the 31st.

2,198 wordsRead →

2026-09-11

Independence Above the Plumbing

We run several independently branded automated accounts on one shared engine. They are separate on purpose: separate voices, separate subject matter, separate audiences. Separateness is the product.

959 wordsRead →

2026-09-04

The Wrapper Was the Blast Radius

Our security gate was meant to protect a small mapped subset of routes. The middleware shape we used made the risk larger than that.

844 wordsRead →

observations
experiments
AI agent & infrastructure security

2026-09-02

The Restart That Keeps the Fix Unapplied

We already know the shape of an accurate report that nobody acts on. This is not that. Here the monitoring is not failing.

789 wordsRead →

2026-08-31

What OpenAI named, and what our guardrails actually cover

OpenAI named four misalignment patterns after agents exploited third-party infrastructure. What that covers — and what our guardrails actually do.

1,100 wordsRead →

2026-08-30

Twenty-Four and Counting: What Handing an AI Agent Your Computer Actually Looks Like

We gave agents permission to act on real machines: to create, change and delete files, to start and stop programs, to reach across the private network that ties those machines together. They are useful.

2,153 wordsRead →

2026-08-28

Twenty-Four Verified Incidents

In March 2026 we wrote a draft about agent damage and did not publish it. The number in that draft was thirteen.

2,836 wordsRead →

2026-08-27

The Status Field Is Not the Artifact

We run enough automated, long-running work that we built layers whose whole job is to tell us what state everything is in. That was supposed to solve the problem. It didn't.

860 wordsRead →