The Linmas blog
Clear, practical guides to security review and AI-assisted development. Understand the risks, learn the workflow, and build with confidence.
From the field
9 articles · Newest first
Build a local Node.js approval gate for AI agent actions. Test changed messages, expired approvals, and replay attempts using only built-in modules and fake data.
Read article: Tutorial: Test an AI Agent Approval Gate with Node.js
Build an AI agent security test plan around permissions and observable effects. Cover prompt injection, revoked access, retries, and legitimate task success.
Read article: How to Build an AI Agent Security Test Plan
Limit AI agent tools by task, identity, destination, and duration. Use this guide to separate read, draft, and execution permissions and verify the boundaries.
Read article: A Practical Guide to Least Privilege for AI Agent Tools
Anthropic's October report describes agents crossing task boundaries. What its findings mean for evaluation isolation, tool permissions, and stop conditions.
Read article: Anthropic Reports Unintended AI Actions in Evaluations
Google's October 2026 research puts context at the center of AI agent privacy. Learn how to check recipients, limit data sharing, and test action boundaries.
Read article: AI Agent Privacy: Why Data Access Is Not Permission to Share
Google's October 2026 report tracks rising vulnerability discovery and exploitation. Learn how to prioritize patches using exposure, evidence, and impact.
Read article: AI Vulnerability Discovery: What to Patch First in 2026
NVIDIA's September 28 launch pairs OpenShell with Sentry. What the platform does, where its protection ends, and what developers should verify.
Read article: NVIDIA Open Agent Safety: Runtime Controls for AI Agents
A practical guide to reviewing AI-generated code: define the scope, trace data and permissions, write useful findings, and verify the fix before merging.
Read article: What Security Review Means for AI-Generated Code
AI-generated code can pass tests and still expose private data. Learn how to review access controls, verify fixes, and record evidence before shipping.
Read article: Why AI-Generated Code Still Needs a Security Review