1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?" TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are. medium.com/@TalBeerySec/why-…

Another Agent Safety Platform Nobody Asked For: NVIDIA's Latest Solve for a Discipline Problem So NVIDIA just announced the Open Agent Safety Platform, complete with OpenShell runtime boundaries, Sentry watchdogs on BlueField-4 DPUs, and over a hundred partners lined up to celebrate. And my reaction is the same one I have every time the industry responds to a fundamentals problem with another layer of silicon: this wasn't needed. What's needed is discipline around security. Set up your sandboxes correctly. Run your tests safely. Put real boundaries around what your agents can touch before you let them loose. That's it. That's what we've always needed, and none of it requires a DPU or a press release. The recent agent incidents everyone points to weren't failures of missing hardware; they were failures of organizations that shipped autonomous systems without doing the basic, unglamorous work of threat modeling, least-privilege access, and proper testing. Throwing more technology at a discipline problem has never worked, and it won't work now, because this technology is still going to sit in the hands of people who couldn't configure a sandbox correctly in the first place. A millisecond quarantine in silicon is meaningless when the person deploying the agent approved permissions with a shrug. The vendors will sell this as the missing piece. It isn't. The missing piece is competent engineering culture, and you can't download that from GitHub. share.google/YLnFCQ3p6Zfb30u…