Welcome to the rabbit hole. I haven’t had a blog for many years, but with the rise of LLMs and AI, I felt reinvigorated. While learning how to use Claude Code, Copilot, and eventually Codex, I became very interested in how all of this works, especially how we’re going to build secure software when software itself is doing much of the writing. That led me to start exploring code review agents, security review agent workflows, and the orchestration surrounding them all. During this journey, it occurred to me that our code is only as safe as the agents we use to produce it. After all, if I wanted to compromise a system, attacking supply chains or the engineers who use them to build systems would often be very effective. For a large part of my career, I worked as an Application Security Engineer or in closely related roles. During that time, one of my primary responsibilities was developer education. One of the best resources for that is the OWASP Top 10 Web Application Vulnerabilities. It turns out they also maintain a similar list for LLM-based applications. So, to continue learning, I’m going to take my own advice and study the top ten: why these vulnerabilities work and how to stop them. I’m especially interested in red teaming, so this will mostly come from a pentester and attacker mindset. But you can’t defend against what you don’t know or understand, so I hope this will be valuable for everyone. From time to time, I’ll also write about software development, team leadership, general computer security, and guitar playing. Expect random sci-fi references scattered throughout like little radioactive breadcrumbs ☢️🎸
Two posts are currently in flight:
- The Production Agent Attack Surface — what I’ve learned building agents in production and why it makes me nervous as a security engineer.
- Supply Chain Attacks on AI Tooling: Lessons from Shai-Hulud — a field report on the npm worm that targeted ~/.claude/, and what I built in response.
More to come. The source for this site lives at github.com/jaegerpicker/small_screens_big_worlds.
Let’s see how deep it goes!