Asking the questions no one else is asking.

Security & Adversarial AIAI Tools & Infrastructure

EchoLeak: Zero-Click Exfiltration Through Microsoft 365 Copilot

One email turned Microsoft 365 Copilot into a data exfiltration tool — no clicks, no user interaction. The attack bypasses every defense Microsoft built.

Developer PsychologyIndustry Analysis

The Homogenization Engine: How LLMs Are Shrinking Cognitive Diversity

AI makes every individual more creative. But groups using AI produce less diverse ideas. The cost is collective, invisible, and measurable.

→ Deep Dive 11 min

DeepSeek Writes Worse Code When You Mention Tibet or Taiwan

CrowdStrike found that political trigger words increase DeepSeek-R1's vulnerability rate by 50%. The implications go far beyond one model.

AI-Assisted DevelopmentIndustry Analysis

Context Windows Are a Lie: How LLMs Actually Use Long Context

Models claim 1M tokens. Research shows they struggle past 32K. Here's what 'lost in the middle' means for developers stuffing codebases into prompts.

AI Tools & InfrastructureIndustry Analysis

Hybrid RNN-Attention: Efficiency Gains Are Real, Revolution Isn't

Hybrid architectures deliver up to 8x inference speedup, but no model has proved the concept at frontier scale. An optimization, not a paradigm break.

→ Experiment 13 min

LLM-Generated Passwords Are Far Weaker Than They Look

I generated passwords across seven LLMs — from Gemini 1.5 to GPT-5.4 — and measured their entropy. Centuries to crack? Try hours.

→ Deep Dive 11 min

Clinejection: When a GitHub Issue Title Owns Your Pipeline

A GitHub issue title compromised Cline's CI/CD pipeline, stole npm tokens, and pushed malware to 4,000 devs. The first AI supply chain attack.

Developer PsychologyAI-Assisted Development

The Developer's Dopamine Loop: Why AI Autocomplete Is Addictive

AI code suggestions work like slot machines — variable rewards, dopamine hits, and a feedback loop that's reshaping how developers think and learn.

Security & Adversarial AIIndustry Analysis

→ Experiment 9 min

The Invisible Prompt: Hunting Hidden LLM Instructions on the Web

Microsoft found 50+ hidden AI instructions in commercial web pages. I built a detection pipeline, replicated the attacks, and scanned live sites.

→ Deep Dive 10 min

LLMs Hallucinate Packages. Attackers Are Registering Them.

AI coding tools invent package names that don't exist — and 43% of those names appear consistently across sessions. Attackers are registering them.