AI Research on johnmatrix

20 Concepts That Explain Modern AI

Fri, 24 Jul 2026 16:08:43 +0100

Most people who use AI every day cannot explain what is happening when they hit enter…A lot of senior engineers in Anthropic/OpenAI likely neither! That is fine for using it and a liability for building on it or securing it. These are the twenty concepts that, once they click, turn the whole field from magic into machinery. No maths required, purely the mental models.

Agent Containment Failures in Offensive Tool-Use

Fri, 24 Jul 2026 16:08:43 +0100

Introduction

When you build an autonomous agent with real offensive capabilities - not a demo, not a CTF solver, but a system designed to find vulnerabilities in production environments - containment isn’t optional. It’s the primary engineering challenge.

Building an Autonomous Pentest Agent: What I Learned the Hard Way

Fri, 24 Jul 2026 16:08:43 +0100

I spent six months building an autonomous penetration testing agent. Not wrapping Nmap in a ChatGPT prompt. Not asking Claude to “hack this website.” A real system - 32 detectors, 1,500+ automated tests, engagement database, proof-of-exploit validation, chain analysis. The kind of thing that finds a SQL injection in a path parameter, escalates to UNION-based extraction, dumps the users table, and records machine-verifiable evidence. In under two minutes.

Context Engineering: The Skill Nobody Named in 2024

Fri, 24 Jul 2026 16:08:43 +0100

Prompt engineering is being quietly demoted. The people building real agentic systems realised the prompt is the small part. The big part is everything around the model: the briefing docs, the skills, the connectors, the retrieval, the memory, and the way the agent finds exactly what it needs at each step without drowning in what it does not. Prompts still matter. They just aren’t the thing that decides whether your agent holds up over a long task.

Credential Sprawl in AI-Assisted Development

Fri, 24 Jul 2026 16:08:43 +0100

The Problem

I scanned 200 real AI coding sessions and found a median of 8 live secrets each – AWS keys, SSH private keys, production database URLs – sitting in plaintext JSONL files that never rotate, never encrypt, and sync to the cloud by default. A single developer’s session history over six months averaged 347 unique secrets across all log files.

Graphing the Agent: Orchestration Graphs and the New Control Plane

Fri, 24 Jul 2026 16:08:43 +0100

How agent systems went from chains to graphs, and why the graph is where containment now lives.

Every agent you have ever built has a shape, whether or not you drew it. A single prompt is a point. A ReAct loop – think, act, observe, repeat – is a circle. A pipeline of planner → researcher → writer is a line. And the moment you add “if the tests fail, go back to the coder; if they pass, go to the reviewer; if the reviewer rejects, go back again with the review attached,” you have drawn a directed graph with a cycle in it. Most builders never draw that graph on purpose. In 2026, drawing it on purpose is the difference between an agent system you control and one you merely observe. The graph – nodes as units of work, edges as decisions, state as the thing that flows through both – has become the control plane of serious agent engineering, and for anyone who thinks about security for a living, it is also where containment now lives or dies.

How LLMs Are Actually Built: The Architecture Is the Part That Matters Least

Fri, 24 Jul 2026 16:08:43 +0100

If architecture were the moat, everyone would already have a frontier model. The transformer is published, standardised, and freely available – every major lab uses roughly the same building blocks. Ask most people how you build a model like Claude or GPT and they say “transformers,” as if the neural network design is the secret. It isn’t.

Loop Engineering, 2026: The Bash Loop That Ate Software Development

Fri, 24 Jul 2026 16:08:43 +0100

From Ralph Wiggum to dark factories: what running agents unattended actually costs, how it fails, and the security bill nobody budgets for.

In July 2025, Geoffrey Huntley published a blog post containing what might be the highest-leverage line of shell ever written:

Loop Engineering: Replacing Yourself as the Prompter (and the Security Tax Nobody Budgets For)

Fri, 24 Jul 2026 16:08:43 +0100

For two years the workflow was: write a prompt, share context, read the output, write the next prompt. The agent was a tool you held the entire time. That phase is ending.

MCP Permission Models Are Broken

Fri, 24 Jul 2026 16:08:43 +0100

I’ve built five open-source MCP servers in Go that give AI agents access to security infrastructure: web proxies (Caido, Burp Suite), EDR platforms (SentinelOne), bug bounty APIs (HackerOne), and SIEM search. Each server required designing a permission model from scratch because MCP doesn’t provide one. What I discovered: the protocol has a fundamental authorization gap that makes building safe agent tooling unnecessarily hard.

Offensive AI in Bug Bounty: The Real State of Play

Fri, 24 Jul 2026 16:08:43 +0100

Two things are happening in bug bounty right now, and they point in opposite directions. AI-generated garbage is drowning triage teams and killing open-source programs. At the same time, skilled researchers are quietly using AI to find vulnerabilities that scanners and fuzzers never could. The gap between the two is widening fast.

Prompt Injection and the Agentic Attack Surface

Fri, 24 Jul 2026 16:08:43 +0100

I test things that break. The interesting thing about LLM security is that the attack surface is fundamentally unlike anything in traditional pentesting, and most people coming from a classic security background get it wrong on the first contact.