All posts
Everything published here, newest first.
316 posts · showing 221–230
2026
10 posts-
Retry Semantics: Which Tools Are Safe to Call Twice
Agents repeat tool calls for at least five ordinary reasons — none of them bugs. Whether that's harmless or a duplicate charge is a property of the tool, and usually one nobody wrote down.
-
Progressive Disclosure: Give the Agent Tools As It Needs Them
The tool list is a per-call parameter, not a fixed property. Withhold the write tools until acting is authorized and a compromised context has nothing dangerous to reach for — enforcement, not instruction.
-
Your First Agent: Build the Smallest Useful One
Three read-only tools, sixty lines of loop, and the raw array printed every turn. Then break it on purpose — a failing tool teaches more in five minutes than a week of building the complicated version.
-
Graceful Degradation When the Model Provider Is Down
A fallback exercised only during incidents is exercised for the first time during an incident. Six degradation rungs, and the three cheapest ones cover most of the value.
-
Request, Worker, or Durable Execution? Hosting Models for Agents
Where a run lives decides how long it can be, whether it survives a deploy, and whether it can wait for a person. Pick by the longest wait it can hit — and keep state out of process memory so the answer can change.
-
The Sales-Research Agent and the Problem of Stale Facts
Every fact in the brief had been true. None was labelled with when — so someone opened a call congratulating a person on a role they'd left a year ago.
-
Least Privilege for Agent Credentials
Since injection isn't fully preventable, the credential decides whether a compromise is an inconvenience or an incident. Four scoping dimensions — and the one nobody uses is usually the highest-value.
-
Red-Teaming Your Own Agent: A Practical Injection Suite
Trying a few "ignore your instructions" prompts tests the easiest attack against the strongest defense. A real suite is a matrix of carriers, payloads, and targets — asserting on actions taken, not words said.
-
When Memory Makes an Agent Worse
Every retrieved memory is content injected into the context, relevant or not. Three ways that degrades the agent — including the one where it argues with a user about their own stated preference.
-
Shared Tool Access: When Two Agents Touch the Same Resource
An agent holds a stale read for seconds, not microseconds — long enough that last-write-wins silently deletes another agent's work while both report success. Partition, append, or version.