./blog
Notes from building and breaking
Write-ups on AI agents, Claude, and the tooling around them. No newsletter, no pop-up. The RSS feed is at the bottom.
A checklist for reviewing AI-generated code
AI-written code usually compiles, usually looks tidy, and is sometimes wrong in ways that read as convincing. This checklist covers what to look for: scope creep, weakened tests, missing authorization, invented packages, and quiet performance traps.
Claude Code skills, hooks, and subagents: what each is for
Claude Code has several ways to extend and steer it, and they overlap enough to be confusing. This guide explains skills, hooks, subagents, slash commands, and MCP servers, with examples and a simple rule for choosing.
How to write a CLAUDE.md that actually helps
A CLAUDE.md is the briefing Claude Code reads at the start of every session. Most are too long, too vague, or stale. Here's what belongs in one, what doesn't, and how to keep it useful.
A practical Claude Code workflow for real projects
Claude Code works best when you treat it like a capable colleague with a tight feedback loop: plan first, work in small verified steps, commit often, and keep its context clean. Here's a workflow that holds up on real codebases.
Least privilege for AI agents: permissions, sandboxes, approvals
An agent is only as safe as the access you hand it. This guide covers scoped credentials, tool permissions, sandboxing, human approvals, and audit trails, with a simple way to match controls to risk.
Prompt injection and the lethal trifecta, explained
Prompt injection is the defining security problem for AI agents, and there's no clean fix yet. This post explains why it works, how the lethal trifecta turns it into data theft, and the design choices that limit the damage.
How to evaluate an AI agent without fooling yourself
An agent that works in a demo can fail one run in three in production. This guide shows how to build a small evaluation suite, grade results honestly, handle nondeterminism, and avoid the traps that make scores look better than reality.
Multi-agent systems: when they help and when they don't
Splitting work across several cooperating agents can improve results and speed, and it can just as easily multiply cost and confusion. This post covers the common patterns, when they pay off, and a rule for starting simple.
Agent memory: short-term, long-term, and files
Models forget everything between calls, so any memory an agent has is something you build. This post covers the practical patterns, from summaries and notes files to searchable stores, plus the privacy and safety questions that come with them.
Prefer a feed reader? New posts show up in the RSS feed as soon as they're published.
RSS feed