Posts

A review packet has passing tests but a missing MCP write receipt. Further agent writes are blocked while an authorised operator reconciles the outcome.

Claude Code review packets: unknown is not a pass

Passing tests cannot settle a missing MCP write receipt. Give unresolved effects a status that the approval gate cannot ignore.

An agent writes revision 41, an engineer writes revision 42, and conditional recovery refuses to overwrite the engineer's repair

Claude Code rollback must not erase the next engineer's fix

A saved snapshot can undo the agent’s change and somebody else’s repair. Make recovery conditional on the revision the agent wrote.

One Claude Code MCP call fans out to paid workers while a shared cost capability blocks work beyond the 25 dollar limit

One Claude Code MCP call spent the whole agent budget

The Claude Code run had a $25 limit and made one MCP call. Hidden fan-out behind the server produced a $286.40 bill.

A Claude Code incident replay forks into a faithful path using captured MCP evidence and a misleading path that calls today's live tools

Your Claude Code incident replay used today's tool output

The same prompt and repository commit produced a clean replay because an MCP tool returned newer evidence. The team had rerun the task, not reproduced the incident.

Jacob Coxon's AI warning and the control lesson from the OpenAI and Hugging Face incident

Jacob Coxon’s resignation and Evan Hubinger’s AI-risk estimate have revived the safety debate. A documented agent-control failure offers a more immediate lesson.

My new book reconstructs the OpenAI and Hugging Face agent incident

OpenAI Evaluation Agents Hacked Hugging Face Systems is now live on Leanpub and Amazon Kindle, with an evidence-led reconstruction and practical AgentSecOps controls.

Claude Code plans against resource version 41, but a state-bound write gate blocks execution after the resource changes to version 42

Claude Code approved one state. Its MCP write changed another

A reviewer approved a Claude Code change against resource version 41. By execution time, version 42 existed, but the MCP write replaced it anyway.

An allowed Claude Code CI retry passes through build and release systems before a fresh capability gate blocks production deployment

Claude Code had no deploy permission. Its MCP tool deployed anyway

A permitted CI retry reached production through an artifact event and a more powerful release service. Tool permissions missed the effect that mattered.

Claude Code's audit trail put the effect before the approval

Clock skew made an approved Claude Code run look unauthorized. Wall-clock timestamps cannot prove the order of a production agent’s approval, dispatch, commit, and revocation.

A Claude Code transcript passes through five independent evidence checks for identity, authority, durable effect, observation, and cleanup before a reviewer accepts the run

A Claude Code audit trail needs proof beyond the transcript

A Claude Code transcript can describe an MCP action without proving who was authorized, what committed, whether an independent read saw it, or what rollback left behind.