Tag
Posts tagged “security”
The Boundary I Stated Out Loud Had a Shelf Life
From 14 August, Claude Code runs in auto mode by default and a classifier approves tool calls instead of me. Anthropic has the numbers to justify it and they are not close. The part that changed how I work is buried in the docs: a boundary you state in conversation is stored in the transcript, and the transcript gets compacted
Aug 12, 2026 · Robert Bojor
Isolation was never on the list
Anthropic documents git worktrees as a way to stop parallel sessions colliding. Its page on choosing isolation for your threat model does not list them at all. Its changelog has six fixes in twenty-eight days stopping worktree-isolated agents from reaching the main checkout. All three of those are true
Aug 5, 2026 · Robert Bojor
The Protocol Stopped Remembering You
MCP shipped its 2026-07-28 spec and deleted the handshake, the session, and the server's ability to call back into your model. The operational case for it is good. The bill lands on everyone who now has to hold the state themselves
Jul 29, 2026 · Robert Bojor
The Vulnerability Was the Easy Part
Traefik published a response-poisoning advisory this morning and my proxy was on an affected build. Patching it took ninety seconds. Everything that broke afterwards was something I added to make sure it never happened again.
Jul 27, 2026 · Robert Bojor
Nothing Broke, and That Was the Problem
A deny rule in my .dockerignore was matching almost nothing, and quietly shipped my internal sales notes to a public subdomain. The same pattern means the opposite thing in .gitignore, and nothing anywhere warned me.
Jul 20, 2026 · Robert Bojor