Tagged: AI
24 posts · browse all tags
-
Checked Out, Not Checked: Inside Plugin4Shell's Zero-Click Hit on Four AI Coding Agents
A SHA pin is supposed to mean a plugin can never silently change under you. AIR Security found that four major AI coding agents check out the pinned commit but never confirm they landed on it, and a git ref collision is enough to swap in different code while the pin still looks honored.
-
Metasploit Deep Dive Part 12: msfmcpd, Rapid7's Own MCP Server
Five weeks after this site wired an LLM into Metasploit through a third-party MCP project, Rapid7 shipped a first-party one, with a safety model worth comparing directly against both that community project and this site's own MCP server.
-
The Judgment Gap Just Got Numbers: Two 2026 Surveys on AI Pentesting Tools
The AI Pentest Agents series closed by arguing these tools need a human checking their work, not replacing it. Two independent surveys published within weeks of that series wrapping just put real numbers on exactly that gap.
-
Juniper Session Smart SD-WAN Deep Dive Part 4: WAN Assurance, Marvis, and AI-Native Operations
What "AI-native WAN" concretely means on the Mist side of Juniper's SD-WAN stack: WAN Assurance's telemetry model, Marvis's self-driving remediation, and where the AI layer actually earns its keep versus where it's a dashboard feature.
-
AI Pentest Agents Part 1: From Assistant to Autonomous Swarm
A new wave of AI pentesting agents landed in the space of two weeks in July 2026. This opens a series on what they actually do, how they differ from each other, and how they differ from the raw LLM-plus-nmap-plus-Metasploit approach this site already tried in AI Part 7.
-
AI Pentest Agents Part 2: Inside PentestCode's Coordinator and Engagement State
A close read of PentestCode's actual README: the strategist-coordinator design, the thirteen agents, the engagement-state graph with Dijkstra/Yen's K-shortest attack paths, the eighteen mandatory tools, and the honest limitations section the project ships with itself.
-
AI Pentest Agents Part 3: PentestGPT and the Academic Case for Reasoning, Generation, Parsing
PentestGPT is the oldest project in this series by a wide margin — a USENIX Security 2024 paper before it was a product. What its three-module design got right early, what changed in its 2026 agentic rewrite, and what its own published benchmark numbers actually say.
-
AI Pentest Agents Part 4: PentAGI and the Cost of Docker Root
PentAGI takes the opposite infrastructure bet from PentestCode: full Docker sandboxing instead of a root-free binary, which buys real isolation at the cost of a docker.sock privilege model worth understanding before you install it.
-
AI Pentest Agents Part 5: NodeZero, XBOW, and What Production-Safe Actually Means
NodeZero and XBOW aren't developer tools you install — they're commercial platforms with real production track records, real customers, and a review-before-submission discipline the open-source entrants in this series don't have to answer to.
-
AI Pentest Agents Part 6: Fingerprinting the Swarm, a Defender's Read on Agent Noise
PentestCode's own README admits it isn't stealthy and repeats work it's already done. What does that actually look like on the wire, and does it give a defender anything a human red-teamer wouldn't?
-
AI Pentest Agents Part 7: Installing PentestCode, and Where the Sandbox Runs Out of Road
The sandbox verified PentestCode's root-free install claim, then ran out of road on an LLM credential. The real run happened on the Proxmox lab: three independent root vectors on Metasploitable2, $9.64, and a critic agent that caught a real technical error.
-
AI Pentest Agents Part 8: Does the Human Pentester Still Have a Job
Closing out the series: what changes for a working pentester when tools like this exist, why every project in this series still insists on a human in the loop somewhere, and how this question echoes the one this site already asked about Ansible.
-
Ansible Deep Dive Part 13: Does Ansible Still Matter in an MCP/AI World?
Part 13, the closing piece: if an AI agent can SSH in and fix things itself, do playbooks, idempotency, and config management still matter? A case for yes — argued through the same MCP server that writes this very site.
-
AI Part 8: Kali 2026.2's Nine New Tools, and the MCP Server With 150 More Behind It
Kali 2026.2 shipped nine new tools, one an AI CLI by default. I installed and ran every one I could in a rootless sandbox, then looked behind the curtain at a 17,000-line MCP server wrapping 150+ tools, and Kali's own local-LLM stack. No fabricated output.
-
AI Part 9: From Draft-Only to Whole-Site — the v2.4 Tool Surface and the Rails Behind It
Parts 7 and 8 went out to other people's tool servers. This one comes home. v2.4 turns my blog's MCP server from a draft-publishing surface into one that can read, grep, write, and illustrate the whole site — and the interesting part was never the tools. It was the guardrails.
-
AI Part 7: When an LLM Gets Nmap and Metasploit as Tools
I wired an LLM into nmap and Metasploit against a deliberately vulnerable lab. The exploit worked — a real, server-verified root shell — but the sharper finding was the models themselves: a 7B fabricated its tool output wholesale, an 8B mangled its arguments, and only a 32B drove the tools honestly. No fabricated transcripts — the model's included.
-
Python for Network Engineers — Part 12: AI-Assisted Network Automation
The final post in the Python for Network Engineers series. We look at how to put AI tools to work inside the automation workflows we've built — config review, fleet-wide AI-assisted parsing, a minimal MCP server that lets an AI agent call your automation scripts directly, and the discipline that keeps AI-assisted automation safe.
-
How I Use Claude to Help Run This Blog (and Why You Should Try It)
I built a custom MCP server so Claude can write and deploy posts directly to this site. Here's how it works, and an honest look at where AI fits into my workflow.
-
AI Part 1: Why I Gave Claude Write Access to My Site
A year ago I would have called this irresponsible. Today an MCP server lets Claude write to my site. The trust model isn't "I trust the model" — it's "I trust the blast radius".
-
AI Part 2: The Minimum Viable MCP Server
A personal MCP server is a tiny HTTP service. The spec accommodates a lot of complexity that, if you're the only user, you can stop building. Here's the inventory of what I have running, and what I deliberately left out.
-
AI Part 3: Designing Tools for an LLM, Not for Yourself
The verb in the tool name is the most important part. Descriptions answer the questions a chooser asks, not the questions a maintainer asks. Allowlists fail closed; blocklists fail open. Error messages are also instructions.
-
AI Part 4: Safety Rails — Allowlists, Atomic Writes, Audit Logs, Rollback
About two hundred lines of code, none of them clever, all of them the reason I sleep fine with the service running. Allowlists, atomic writes, an audit log, and a manual rollback path.
-
AI Part 5: Prompt-Driven Authoring in Practice
What's it actually like to use? The honest answer, including where the loop is tight, where it's still clumsy, and the three things I'd warn anyone trying this.
-
AI Part 6: Connector Quirks, Cache Traps, and What I'd Do Differently
Six months in. The cache layer you don't see, OAuth refresh edge cases, and the short list of decisions I'd make differently if I were doing this again from scratch.