I'm launching "The Technomist," a newsletter exploring how technology and business intersect, covering topics from product/idea discovery to AI strategies. Subscribe if you'd like to follow along: thetechnomist.com/about First post coming soon! #tech #business

"Agent security will be solved in the open, collaboratively, together."  At Red Hat, open is the mission, so couldn't agree more. Red Hat has been part of the OpenShell project from the early days, as maintainers and contributors, because we believe agent security and safety are the most important problems in AI to solve right now. An agent that can act on its own can be talked into acting against you. The limits that stop it should be built in the open, where everyone can inspect and improve them. Only then we can reap the real benefits of Agentic. Great to see the OpenShell community growing. Some reading and links 🔗 Secure the systems around the agents: redhat.com/en/blog/securing-… Secure Agent Onboarding: redhat.com/en/blog/why-red-h…

An OpenAI agent hacked HuggingFace for nine days. Nobody noticed. It left escape instructions for future versions of itself. Anthropic's Claude published a malicious PyPI package during evals. 15 real systems infected. A security company's credentials stolen. The model rationalized it was "still in simulation." Cursor, Codex, and Gemini CLI got compromised through workspace configs the agents themselves wrote. The agents followed every rule. Tools outside the sandbox executed what they wrote. All in the first six months of agents in production. I went through 77 tracked incidents and pulled out 21 anti-patterns: ➡️ Your agent should never see a real key. Replace with placeholders, resolve at the proxy. ➡️ Isolation protects the host. Nothing protects the agent from itself. ➡️ Humans missed 1-in-3 threats approving agent commands (40K runs). ➡️ Agents write files that privileged tools outside the sandbox execute. ➡️ Eval prompts said "no internet." The machines had live internet. Three companies breached. ➡️ PayPal's SRE agent masked a memory leak for 3 weeks by restarting instead of diagnosing. Each one links to the real breach that proved it and what to do instead. 🔗 Full writeup here: adelzaalouk.me/2026/aug/9/ho…

I built 𝗔𝗜 𝗦𝗰𝗿𝗼𝗹𝗹𝘀, an interactive timeline of AI history. I started this as a 𝗳𝘂𝗻 𝘀𝗶𝗱𝗲-𝗽𝗿𝗼𝗷𝗲𝗰𝘁 a while back and kept evolving it because most AI timelines I found had one of two problems: they either stopped around 2023, or they were useful as reference lists but not very good at showing patterns over time. AI Scrolls currently includes 359 events, from 𝗔𝗿𝗶𝘀𝘁𝗼𝘁𝗹𝗲'𝘀 syllogism in 𝟯𝟴𝟰 𝗕𝗖 to recent work on agents, context engineering, and harness engineering in 2026. I added 𝗚𝗼𝗼𝗴𝗹𝗲 𝗧𝗿𝗲𝗻𝗱𝘀 data for "artificial intelligence" and 14 related sub-trends, including agents, RAG, prompt engineering, context engineering, harness engineering, and vibe coding. You'll notice that search interest in "artificial intelligence" stayed relatively flat from 2004 to 2022, then jumped sharply after ChatGPT (no surprise by now 🙂). Prompt engineering appears to have peaked earlier, while AI agents is still climbing. 🔗 📜 𝗛𝗲𝗿𝗲 𝗶𝘀 𝘁𝗵𝗲 𝗹𝗶𝗻𝗸 𝗳𝗼𝗿 𝘆𝗼𝘂 𝘁𝗼 𝗲𝘅𝗽𝗹𝗼𝗿𝗲: aiscrolls.adelzaalouk.me/

Every layer counts!

Most AI agents say "done" when the output is fine, not good. They can fix their own mistakes when someone points them out. Nobody is pointing them out automatically. 𝗔𝗻𝘁𝗵𝗿𝗼𝗽𝗶𝗰 built this, but it only works inside their managed platform. I wanted the same pattern with an 𝗼𝗽𝗲𝗻 𝘀𝗼𝘂𝗿𝗰𝗲 stack. I am calling it 𝗼𝘂𝘁𝗰𝗼𝗺𝗲 𝗹𝗼𝗼𝗽𝘀: A rubric-graded quality gate between the agent's output and the user's inbox. A separate judge model scores the result, and the agent revises until the rubric is satisfied or the iteration budget runs out. To build this loop, I used 𝗢𝗚𝗫 (github.com/opendatahub-io/og…) for inference and 𝗠𝗟𝗳𝗹𝗼𝘄 (mlflow.org) for evaluation. OGX gave me a single endpoint across all agentic API surfaces (chat-completions, responses API, messages API, Interactions API), integrates with self-hosted runtimes like vLLM and natively supports retrieval and document processing workflows with various DB providers. An outcome loop makes 𝘁𝘄𝗼 𝗺𝗼𝗱𝗲𝗹 𝗰𝗮𝗹𝗹𝘀 𝗽𝗲𝗿 𝗶𝘁𝗲𝗿𝗮𝘁𝗶𝗼𝗻 (agent + judge), and 𝗢𝗚𝗫 routes both through the same base URL, so you can self-host one and use a hosted provider for the other. 𝗠𝗟𝗳𝗹𝗼𝘄 turns rubrics into versioned metrics that log scores, justifications, and artifacts automatically, so you can actually see which criteria fail and whether your rubric is calibrated. Some learnings along the way: ➡️ Build the judge before the loop. A weak judge lets bad output through, a harsh one wastes iterations. The judge is the system. ➡️ Stop at the first passing score. Extra iterations drift; models rewrite good sections to satisfy criteria they already passed. ➡️ Start the rubric loose, tighten from the data. You won't know which criteria matter until you see real outputs fail. This is part 3 of my continuous learning for agents series: adelzaalouk.me/series/agent-… Link to the post: adelzaalouk.me/2026/may/12/b…

We're way past the point where AI is just the model. There's more at stake now! Wrote a 𝘁𝗵𝗿𝗲𝗲-𝗽𝗮𝗿𝘁 𝘀𝗲𝗿𝗶𝗲𝘀 breaking down what goes into building a 𝘄𝗵𝗼𝗹𝗲 𝗔𝗜 𝗽𝗿𝗼𝗱𝘂𝗰𝘁: ➡️ 𝗣𝗮𝗿𝘁 𝟭 covers the framework, building off Moore's whole product model and introducing a tweaked version. ➡️ 𝗣𝗮𝗿𝘁 𝟮 covers compound systems, agentic loops, and the architecture patterns emerging right now. ➡️ 𝗣𝗮𝗿𝘁 𝟯 tackles the question: if everyone has access to the same models, what makes your product defensible? adelzaalouk.me/series/beyond…

AI agents need to run shell commands, write to disk, and make network calls to do real work. Security teams look at that access list and see a breach waiting to happen. Give an agent those permissions and things go wrong fast, a 𝗵𝗮𝗹𝗹𝘂𝗰𝗶𝗻𝗮𝘁𝗶𝗼𝗻 turns 𝗿𝗺 -𝗿𝗳 on the wrong directory, a bad tool call POSTs credentials to an external endpoint. And the threat model has a new entry: 𝘀𝗲𝗺𝗮𝗻𝘁𝗶𝗰 𝗺𝗮𝗹𝘄𝗮𝗿𝗲 (not executable payloads), malicious instructions hidden in natural language that agents follow because they read documentation the same way they read prompts. 𝗡𝗼 𝘀𝗶𝗻𝗴𝗹𝗲 𝗰𝗼𝗻𝘁𝗿𝗼𝗹 𝗵𝗮𝗻𝗱𝗹𝗲𝘀 𝘁𝗵𝗶𝘀. A firewall does not stop an agent that was told to write secrets to a file it is allowed to touch. A guardrail does not help if the agent never hits the model with the malicious content. 𝗬𝗼𝘂 𝗻𝗲𝗲𝗱 𝗹𝗮𝘆𝗲𝗿𝘀 (𝗱𝗲𝗳𝗲𝗻𝘀𝗲 𝗶𝗻 𝗱𝗲𝗽𝘁𝗵), and each layer must assume the one above it has already failed. Here is a 𝘀𝗶𝘅-𝗹𝗮𝘆𝗲𝗿 𝗳𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸 for how we are building the agent's secure runtime with 𝗥𝗲𝗱 𝗛𝗮𝘁 𝗔𝗜: ➡️ 𝗛𝗮𝗿𝗱𝗲𝗻𝗲𝗱 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺 locks down the base. Security context constraints, SELinux, and DNS-based egress filtering before the agent even starts. ➡️ Agent pods run inside 𝗹𝗶𝗴𝗵𝘁𝘄𝗲𝗶𝗴𝗵𝘁 𝗩𝗠 𝗿𝘂𝗻𝘁𝗶𝗺𝗲𝘀 (Kata Containers), not just containers. Container escape hits a hardware boundary. ➡️ An agent "𝘀𝗵𝗲𝗹𝗹" (𝗢𝗽𝗲𝗻𝗦𝗵𝗲𝗹𝗹) enforces per-binary network policies and kernel-level filesystem allowlists. The agent binary can only reach the endpoints and paths you explicitly permit. ➡️ Conversation-layer 𝗴𝘂𝗮𝗿𝗱𝗿𝗮𝗶𝗹𝘀 (NeMo Guardrails) intercept prompt injections and filter unsafe outputs before the model processes them. ➡️ Continuous 𝗿𝗲𝗱 𝘁𝗲𝗮𝗺𝗶𝗻𝗴 (Garak) runs 120+ adversarial probes against your deployed agents. You find the gaps before someone else does. ➡️ 𝗪𝗼𝗿𝗸𝗹𝗼𝗮𝗱 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗮𝗻𝗱 𝘁𝗿𝗮𝗰𝗶𝗻𝗴 give every agent a cryptographic identity (SPIFFE) and full OpenTelemetry traces. When something goes wrong, you know which agent did what, when, and why. The design principle assumes breach at every layer and contains the blast radius at the next one. developers.redhat.com/articl…

Karpathy and Tobi Lutke built the same loop independently. Point an AI agent at code, give it a score to chase, let it run experiments overnight. One got a better model. The other got a 53% speedup on a 20-year-old codebase. I generalized the pattern into a tool that works for any domain. Pointed it at a RAG search engine, got 14 experiments and a 9.3% improvement while I did other things. The real work isn't the loop. It's writing good evals. adelzaalouk.me/2026/mar/15/a…

Your AI coding agent makes the same mistake every session. You correct it, it adapts, the session ends, and tomorrow it's forgotten everything. I built a system that captures corrections, figures out which skill caused the failure, and checks whether I already fixed it. The key insight: an agent that remembers everything learns nothing. An agent that remembers only what you choose to teach it gets better every week. adelzaalouk.me/2026/mar/22/t…

Most CLAUDE.md files I've seen are way too long. The model can only reliably follow ~150 instructions, and Claude Code's system prompt already uses ~50 of those. If Claude keeps ignoring your rules, your instruction budget is probably overdrawn. Wrote about how to fix it. adelzaalouk.me/2026/mar/7/yo…

Spent the weekend building a tool for solving the coding agents' sprawl problem. Introducing ✨ aimux ✨ If you're running multiple coding agents like Claude, Codex, Gemini, etc, you know the pain: which session is stuck? What did it do? How do I debug it? How much did it cost? aimux is a single-binary TUI that gives you one view across all your AI coding agents. Discovery, traces, cost tracking, annotations + labels (for evals), and OTEL export! No daemons, no hooks, no modifications to your tools. Integrates with MLFlow and is easily extensible as well. Multiplex your AI agents. Trace, launch (built-in for different coding agents), export. Never leave the terminal. Install: brew install zanetworker/aimux/aimux Repo: github.com/zanetworker/aimux Site: zanetworker.github.io/aimux/

Long-context models are impressive, but they haven't killed RAG. In fact, RAG, especially the retrieval part of it, is 𝘮𝘰𝘳𝘦 important than ever for building truly intelligent AI systems/applications. Here is a post that explains why, covering: 👉𝗕𝗲𝘆𝗼𝗻𝗱 "𝗡𝗮𝗶𝘃𝗲" 𝗥𝗔𝗚: The original vision (as defined in the original RAG paper), and why fine-tuning (especially embeddings) is key. 👉 𝗟𝗼𝗻𝗴 𝗖𝗼𝗻𝘁𝗲𝘅𝘁 ≠ 𝗡𝗼 𝗥𝗲𝘁𝗿𝗶𝗲𝘃𝗮𝗹: Why longer context isn't always better. 👉 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗥𝗔𝗚: Used to handle query complexity, dynamic and multi-step knowledge discovery and acquisition. 👉 𝗥𝗲𝗮𝗹-𝗪𝗼𝗿𝗹𝗱 𝗔𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻𝘀: From customer support to healthcare, see examples of RAG in action. The "𝗥" in RAG is essential for controlling: 👉 𝗣𝗿𝗲𝗰𝗶𝘀𝗶𝗼𝗻/𝗳𝗿𝗲𝘀𝗵𝗻𝗲𝘀𝘀:  Combats knowledge cutoffs and provides targeted retrieval (hint: fine-tuning helps here). 👉 𝗘𝗳𝗳𝗶𝗰𝗶𝗲𝗻𝗰𝘆: Smart chunking beats brute-force large context to produce accurate results in some use-cases. 👉𝗔𝗱𝗮𝗽𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆: Agentic RAG handles complex, multi-step information needs with retrieval as a tool. 👉 𝗙𝗼𝗰𝘂𝘀: Good retrieval provides focus. Without it, you have a distracted generator (It's coffee for LLMs and the right-hand for agents)! Read the full post for more details 👇 thetechnomist.com/p/rag-reig…