Justin Kwon

Security engineer. Building Sigil (open-source AI-SPM, Rust). I watch how AI coding agents get popped — usually a config nobody reviewed.

[Justin Kwon @ju571nK]

プロンプトインジェクション、2026年も OWASP の LLM 脅威1位のまま。PR の説明文に隠したインジェクションで Copilot が RCE された CVE-2025-53773（9.6）とか、365 Copilot のゼロクリック情報漏洩 EchoLeak とか。コーディングエージェントに権限を渡しすぎると CI/CD がそのまま攻撃面になる。ツールごとの最小権限、ちゃんとやろう。

#��キュリティ #AIセキュリティ #DevSecOps
https://t.co/dh9MdjTgR6

[Justin Kwon @ju571nK]

Gitea の Docker イメージに CVE-2026-20896（CVSS 9.8）。デフォルト設定のせいで、X-WEBAUTH-USER ヘッダを送るだけで誰でも管理者になれてしまう問題。Sysdig が実際の悪用の試みを検知したとのこと。1.26.3 で直っているので、self-host してる人は早めに更新した方がいい。

#セキュリティ #DevSecOps #Gitea
https://t.co/l7ANZy24e6

[Avi Chawla @_avichawla]

Prompt, context, harness & loop engineering, clearly explained!

An agent is a while loop with four layers of engineering wrapped around it:

- Prompt engineering
- Context engineering
- Harness engineering
- Loop engineering

Each one wraps the last, and the model sits in the middle, so none of them compete with the others. Instead, they just zoom one level further out.

> Prompt engineering:

This defines the input the model sees on one call, often composed of a role, instructions, examples, and an output format.

The techniques here alter the internal computation and reasoning the model goes through due to the wording it sees:

- Chain-of-thought makes it work in steps before answering
- Few-shot examples define the format and the edge cases
- A JSON schema or XML tags make the output parseable by code
- Self-consistency samples a few chains and takes the majority

> Context engineering:

It's everything the model sees on a turn, not just the prompt. That includes the query, retrieved docs, memory, prior turns, and tool outputs from earlier steps.

The window is finite and fills up fast, so the engineering work is to rank inputs and cut everything that isn't pulling weight.

You do this by:

- Retrieving only the chunks relevant to the query, then reranking them
- Keeping key facts out of the middle, where accuracy drops
- Summarizing old turns, evict stale outputs, push big blobs to files

> Harness engineering:

It's the code around the model that defines the tools, parses the calls, retries on failure, and can route work to sub-agents so one handles retrieval and another handles code.

A verifier then grades the result by running tests, validating a schema, etc.

Prompt and context involve getting one call right. The harness involves everything that has to happen around that call for it to run in a real system.

> Loop engineering:

In the usual setup, you manage the outer loop, i.e, you write a prompt, read the turns the agent runs, write the next prompt, and repeat, while catching failures.

This layer hands that job to the agent itself. It kicks off on a schedule or an event, and runs many turns with no prompt in between.

A loop inherently doesn't know when it's finished. An agent can report that it's done and halt while the tests still fail. So the stop can't be the agent's word, but rather it has to be a real signal, like:

- A turn and token cap to stop stuck runs
- A no-progress detector to catch repeated calls
- A completion check to verify the goal with a separate model or a deterministic test

By this layer, you're operating on the whole run, so the engineering moves from writing each prompt to setting the goal and the stop conditions up front and letting it run.

If you want to dive deeper into loop engineering, my co-founder wrote a full breakdown of that outer loop.

It goes from the basic while loop to a run that finishes on its own, with the code behind each part, and the parts that are hard to get right, like knowing when to stop, context rot over a long run, and keeping the checker separate from the maker.

Read it below.

[Justin Kwon @ju571nK]

CitrixBleed系の新しい脆弱性(CVE-2026-8451)、公���から24時間以内に攻撃が始まったらしい。NetScalerをSAML IdPとして使ってる構成が対象で、未認証で悪用できるタイプ。14.1-72.61 / 13.1-63.18より前のバージョンはパッチ急いだほうがいい。
#セキュリティ #DevSecOps #CVE
https://t.co/yJvI0NPL7g

[Justin Kwon @ju571nK]

Wow!

[Anthropic @AnthropicAI]

Claude Fable 5 will be available again globally tomorrow.

After a series of productive conversations with the US government, we're redeploying the model with a new set of classifiers to target and block more cybersecurity tasks. In the near term, some routine tasks like coding and debugging will fall back to Opus 4.8. We’ll continue to refine these classifiers over the coming weeks to reduce false positives and better distinguish genuine misuse from legitimate requests.

We’ve also begun drafting a consensus framework—with Amazon, Microsoft, Google, and other Glasswing partners—for assessing the severity of AI jailbreaks and how AI developers should respond to them. We invite other industry partners and model providers to join us in this effort.

Finally, we’re scaling up our collaboration with the US government on model testing and safeguards. This will include pre-release access to models and safeguards for evaluation, information sharing on jailbreaks and misuse, and dedicated resources for joint research.

Thank you to our users for your patience, and to our partners across the government, industry, and the research community who worked alongside us to make Fable 5 available again.

Read our full blog: https://t.co/VHyum831ri

[Andrew Ng @AndrewYNg]

“Loop engineering” is a hot buzzphrase after mentions of it by Boris Cherny (Claude Code’s creator) and Peter Steinberger (OpenClaw's creator) went viral on social media. Loops are now a key part of how we get AI agents to iterate at length to build software. In this letter, I’d like to share my 3 key loops, shown in the image below, for building 0-to-1 products. These loops guide not just how I build software, but also how I decide what software to build.

Agentic coding loop: Given a product specification and optionally a set of evals (that is, a dataset against which to measure performance), we can have an AI agent write code, test its work, and keep iterating until the code is bug-free and meets its specification. This idea of closing the loop took off around the end of last year, and it has been a game changer in enabling coding agents to work longer productively without human intervention. For example, over the weekend, I was building an app for my daughter to practice typing, and my coding agent could easily work for around an hour, using a web browser to check what it had built multiple times before getting back to me, without needing my intervention.

The engineering loop executes quickly. Every few minutes, the coding agent might build and test a new version of the software. I hear frequently from developers who are finding new ways to engineer more effective engineering loops. This is an active area of invention!

Developer feedback loop: In this loop, a developer examines the current product and steers the coding agent to improve it. Last year, a lot of developers (including me) were acting as the QA (quality assurance) function for our coding agents, manually finding bugs and then asking the agent to fix them. But with coding agents much more able to test their own code, the amount of time we need to spend on this function has decreased significantly. This allows us to make higher-level product decisions, such as what key features to offer, where the UI needs improvement, and so on.

The developer-feedback loop operates over time intervals between tens of minutes and hours — that's how frequently a developer might review a product and give feedback. In the case of the typing app, I changed my mind a few times about the visual design, what cat costumes she can unlock as she learns (she loves cats), and the user flow for a grown-up to log in and steer the child's learning experience.

When a developer has a clear vision for what to build, it is still a lot of work to translate that vision into a specification for a coding agent to implement. Further, after the developer has seen an implementation, they might update (or perhaps clarify) the spec to steer it toward what they want. If you find that the system repeatedly runs into certain problems, building a set of evals for the agent becomes useful.

AI-native teams are increasingly using AI to help shape product direction, for example, automating the gathering and analysis of usage data, summarizing written and verbal customer feedback, or carrying out competitive analysis. However, for pretty much all the products I’m involved in, I see humans as having a significant context advantage over current AI systems — we know a lot more than the AI system about the users and the context the product has to operate in — and thus humans play a critical role. Many people describe this human contribution as “taste,” but I prefer to think of it as humans having a context advantage, since that gives us a clearer path to helping AI systems get better. This also speaks to why this step can’t be automated: So long as the human knows something the AI does not, human-in-the-loop is needed to to inject that knowledge into the system.

External feedback loop: This includes a wide range of tactics like asking a few friends for feedback, launching to alpha testers, or putting the code into production with A/B testing. These tactics are usually slow, rarely taking less than hours and sometimes taking days or even weeks. This data informs the developer vision, which in turn continues to drive the detailed product spec, which in turn drives the coding agent.

With coding agents speeding up software development, more engineers are starting to play a partial product management role. For many engineers who are growing into this role, the hardest part is shaping the product vision and striking a balance between building (bridging the gap between vision and spec) and getting user feedback to evolve the vision. It is important to do both!

I will write more about how to do this in future posts, but for now, I find it encouraging that engineers are playing an expanded role (just as product managers and designers now do more engineering).

[Original text: The Batch]

[Justin Kwon @ju571nK]

プロンプトインジェクション、2026年もOWASP LLMリスク1位のまま。前年比340%増、監査したAIの73%が露出、しかも55%が間接型。外部のコンテンツ読みに行くエージェント系コーディングツール使ってる人は特に気をつけて。
#セキュリティ #AI #LLM
https://t.co/wcoCzh3lJC

[Codez @0xCodez]

https://t.co/eJB3TgyJwV

[Codez @0xCodez]

A senior Anthropic engineer just dropped 11-page PDF on "Loop Engineering" for agentic systems.

The shift: you stop prompting the agent. You build the system that prompts it instead.

Schedule → Discover → Build → Verify → Repeat

Every loop runs one turn, five moves:

• Discovery: it finds its own work - failing CI, open issues, recent commits - instead of being handed a list.

• Handoff: each task gets an isolated git worktree so parallel agents don't collide.

• Verification: a second agent, told to assume the code is broken, reviews the first. The "thing that can say no."

• Persistence: results get written to disk, never left in a context window that gets flushed.

• Scheduling: an automation wakes it on a timer. That's what makes it a loop.

The key insight: an agent grading its own work always praises it.

This 11-page PDF changed how I'm building agentic systems today.

Read it now, then explore the article below.

[Justin Kwon @ju571nK]

数字の出どころと、自分が試して引っかかった点をまとめました
https://t.co/ss0VDKvQP2

[Justin Kwon @ju571nK]

Vercelの検証で地味に衝撃だったやつ。

「賢いSkill」より「ただのテキストファイル(AGENTS.md)」のほうが精度が高かった。
しかもSkillは56%のケースで一度も呼ばれてなかった。用意しただけで満足してたの、自分だけじゃなかったらしい。👇

[Justin Kwon @ju571nK]

【AIコーディング注意】"Agentjacking"が登場。公開のwrite-only Sentry DSNとMCP連携を悪用し、攻撃者のエラー内容をClaude Code/Cursorへ間接プロンプトインジェクション。6/12時点で注入可能な組織2,388社を確認。エラーログを無条件に信頼しない設計を。

#セキュリティ #AIセキュリティ #プロンプトインジェクション #MCP
https://t.co/jqo3EHw7bH

[Justin Kwon @ju571nK]

【サプライチェーン警戒】@redhat-cloud-services の npm 32パッケージ(96バージョン)が��ざん。週12万DL規模。認証情報を盗むワーム "Mini Shai-Hulud" の変種「Miasma」。GitHubアカウント乗っ取り経由。依存パッケージのバージョン固定&監査を。
#セキュリティ #DevSecOps #サプライチェーン
https://t.co/w2VSRuX161

[Justin Kwon @ju571nK]

Kubernetes Ingress-NGINX に設定インジェクションの脆弱性 CVE-2026-4342（CVSS 8.8）。コントローラ権限での任意コード実行とSecret漏洩につながる恐れ。運用中なら優先的にパッチを。

#セキュリティ #Kubernetes #クラウドセキュリティ #CVE
https://t.co/x8d0tSH023

[Justin Kwon @ju571nK]

@Saanvi_dhillon the model won’t remember them next week. the agent wrapping it can read and send your .env in the same session though. that exact “cat .env then exfil” has already happened in the wild. rotate anything you pasted.

[Justin Kwon @ju571nK]

Strongest layers here are the two at the bottom. “What gets measured gets improved” is the whole agent-security story. Most incidents aren’t model failures, they’re config and environment failures, and almost nobody measures that across a fleet. Did a breakdown across Codex / Claude Code / Antigravity: https://t.co/cfCe2Ug7y2

[Sandeep Jain @sjsandeep_jain]

Most people think AI agents are just smarter chatbots.

They're not.

The companies winning with AI are building systems, not prompts. 👇

🧠 Orchestration Layer
Breaks goals into tasks, routes work, manages state, and enforces guardrails.

👥 Specialized Agents
Research agents. Reasoning agents. Action agents. Data agents. Communication agents.
Each agent does one job exceptionally well.

🔧 Tools & Integrations
APIs, databases, code execution, documents, web search, external services.
This is where agents stop talking and start doing.

📚 Memory Layer
Short-term context + long-term knowledge + event history.
Without memory, every conversation starts from zero.

📊 Observability & Monitoring
Track costs, latency, failures, and agent behavior in production.
What gets measured gets improved.

🛡️ Governance & Reliability
Authentication, security, fallback agents, audit trails, human oversight.
Required for enterprise-scale AI.

💡 The biggest misconception in AI today:
People focus on the model.

Top AI teams focus on the architecture.

Because the difference between a demo and a production AI system isn't the LLM...
It's everything around it.

📌 Save this architecture
🔁 Repost for AI builders
➕ Follow for practical AI engineering breakdowns 🚀

[Justin Kwon @ju571nK]

【npmサプライチェーン攻撃】6/17、@mastra組織が乗っ取られ、dayjsのタイポスクワット「easy-day-js」が140以上のパッケージに本番依存として混入。週110万DL規模に影響、2次ペイロードは暗号資産ウォレット情報を窃取。北朝鮮APT BlueNoroffに��属の見方。AIフレームワークが標的に。
#セキュリティ #DevSecOps #サプライチェーン
https://t.co/8uM5fVNOKg

[Justin Kwon @ju571nK]

@alexxubyte Interesting diagram.

But most companies are still at step zero:

Inventory.

They don't know which agents are running, which MCP servers are enabled, or what permissions have been granted.

[Justin Kwon @ju571nK]

@NVIDIAAIInfra Before runtime policies, we need basic visibility.

You can't govern what you can't inventory.

[Justin Kwon @ju571nK]

@kidtsang I think we need to start with visibility.

Most organizations don’t know:

Which AI agents are being used
Which MCP servers are configured
What permissions have been granted

It’s difficult to secure what you can’t see.

[Justin Kwon @ju571nK]

TrustFall wasn’t a Claude Code problem.

It exposed a bigger issue:

Most companies have zero visibility into AI coding agents.

No inventory.
No posture management.
No monitoring.

We’re repeating the same mistakes we made with endpoints 20 years ago.

That’s why I’m building Sigil.