Read the source, then write down what it actually says
I build the evidence layer for AI agents, and I write about where it does not hold yet. Every figure below was read at its primary source, every note lists what it was checked against, and where a source did not support a claim the claim is not here.
Short, dated, and sourced. RSS
One coding agent answered repo-controlled git config with a confirmation prompt in August. Another answered the neighbouring case with a refusal. The gap between those two choices is the whole argument, and neither public record tells you which one you are running.
A gap in the SEAT post-handshake attestation draft turned out to have been argued on the working group list in July, and specified in a closed issue a year before that. What I filed instead came from reading the RFCs the draft already cites.
The MCP tasks extension requires an authorization check on every task request. Its own rationale says that check is often impossible, the sentence that used to make servers disclose that is gone, and no error code represents a denial. One of the two losses was already found and fixed by somebody else three weeks ago.
Spring AI released a fix on 21 August for a bug where a tool absent from the request could still be called. The vulnerable dispatch is one line. The public fix exists on one of the three affected release lines, and the fallback left almost nothing useful in the log.
Publishing proves you own the namespace and you own the package. The repository URL next to them gets a regex, 498 entries name a repo owned by someone other than the publisher, and the one a vendor flagged twelve days ago is still marked active.
Google Cloud tells you to update go-sev-guest so your parser stops breaking on v4 attestation reports. I wanted to know what you can actually check once it parses, and the answer sent me to look at my own verifier.
Thirty poisoned npm packages are gone along with their attestations, and the Sigstore copy that survives can only be fetched with a digest that no longer exists in any public place I could find.
Both poisoned versions 404 on PyPI, no CVE was ever issued, and the KEV entry filed two days later belongs to the scanner rather than the gateway.
Coverage of the reasoning-trace harvest reported three different totals as if they disagreed. They are all the paper's own numbers, at three different denominators.
The gym booking story is being told as an API with no authorization. The agent's own account says two of the three operations it touched returned 403, and one did not.
Longer pieces, published on dev.to and cross-posted to Medium.
Three cases where a valid signature produced a false conclusion. Each one is a missing binding, not a missing signature.
Human block rates fall from about 17 percent to about 5 percent inside a single session. A control that decays the more you use it is not a control.
The best published number in agent security, ten months in production with zero false positives, still misses one attack in three.
Every party did their job correctly and the incident happened anyway, because no layer owned the question.
Stop prompt-engineering safety. Move the constraint off the probabilistic model and onto a deterministic knowledge graph.
We do not ask microservices nicely to respect rate limits. Safety is an architectural constraint, not a request.