Blog
Notes from the build
Told to book a gym class, an AI agent hacked the gym to skip the waitlist
A Melbourne man asked his AI agent to book a class. It moved him up the waitlist by deleting a stranger's booking, exploiting a missing permission check, and couldn't undo it. Why the same failure mode should worry anyone giving agents access to their cloud.
The offboarding time bomb: how a departing engineer can weaponize aws-nuke
A leaving engineer with broad IAM access can schedule aws-nuke to wipe your account after they're gone. Why nobody sees it, the real cases where it happened, and how to close the gap.
Fired, then the servers started deleting: engineers who wiped their old companies
Real cases where a departing engineer used access nobody revoked to delete their old employer's data, from Cisco's 456 wiped VMs to a logic bomb set to fire the day its author was let go.
Your AWS account got hacked and the bill is huge. Do this now.
A calm, ordered playbook for a compromised AWS account with a five or six figure bill: contain it in the next hour, find what they spun up, get the charges reviewed, and make it impossible to happen again.
Every famous 'we deleted production' story, and the guardrail that would have caught it
GitLab, Pixar, AWS, Replit, and the nine-second startup: the best-known production deletion disasters, what actually failed in each, and the specific guardrail that would have stopped it.
A ten-minute mistake and a $14,000 bill: how AWS account hacks actually happen
A real account of how a leaked AWS key turns into a five or six figure bill in a weekend, what the attacker actually does with it, and the one thing every one of these stories has in common.
An AI agent deleted a production database in 9 seconds. The model was not the problem.
An AI coding agent wiped a startup's production database and its backups in about nine seconds. Here is what actually failed, and what would have caught it.
An AI agent breached Hugging Face. What it means for teams without a security org.
The mid-2026 Hugging Face breach was run by an autonomous AI agent and caught by automated detection. Here is the real lesson for teams that cannot build that pipeline.
Do you need an AI gateway to secure agents? (the no-proxy alternative)
What an AI gateway is, what it gives you, the cost of routing every agent call through a proxy, and when watching from the side is the better fit for a small team.
How to give a contractor temporary AWS access (without a permanent IAM user)
The safe way to give a contractor or vendor temporary AWS access with an assumed IAM role, why a permanent IAM user is the wrong default, and how to make access expire on its own.