Amard Sonal

I audited an AI-written billing service this week. 22 findings, 10 critical.

None of them crashed. All returned 200. Four that stuck with me: an auth check that silently lets anyone in when one env var is missing, SQL injection in the one query that wasn't parameterized, a broken permission boundary so anyone can attach a charge to a workspace that isn't theirs, and a Stripe retry that double-grants seats because there's no idempotency check anywhere.

MCP just locked its biggest revision ever, and it quietly changes the unit of distribution from "a user opens your app" to "an agent calls your tool." That's a strategy decision, not an integration ticket.

A couple of weeks ago the Model Context Protocol shipped its final 2026-07-28 spec the largest revision since it launched. Most of the coverage was about the plumbing: it's stateless now, it runs on ordinary HTTP, the session handshake is gone. Real changes, and if you operate a server they matter. But that's not the part I'd flag for makers. The part I'd flag is what MCP has quietly become while everyone argued about transports: the way software gets used by agents instead of by people. There are close to ten thousand servers in the official registry now, MCP lives under the Linux Foundation with AWS, Google, Microsoft and Salesforce behind it, and this same release added MCP Apps servers can now render their own interactive UI right inside the agent. The protocol stopped being a developer curiosity. It became a distribution surface.

octoscope 0.27.0 the integrity scan stops describing a repo and starts noticing things about it.

Before this release the supply-chain scan could only talk in the present tense: here is what auto-executes right now, here is a commit tip that looks forged. Useful if you happen to scan while the implant is sitting there. Useless for the two questions you actually have when a worm is circulating did something change, and what could whoever got in reach?