--- title: "Correlic (@correlic) | Hashnode" description: "Kernel-level security observability for AI coding agents. Read the latest articles by Correlic on Hashnode." url: "https://hashnode.com/@correlic" --- @correlic # Correlic @correlic · Joined March 2026 Kernel-level security observability for AI coding agents [Website](https://correlic.com/) ## Comments [The tipping point framing is right. The thing that tips with it: the security surface. Enterprise agents have access to production credentials, internal APIs, and sensitive data stores. The governance and monitoring infrastructure needs to scale at the same rate as the agent deployment — and right now it isn't.](https://hashnode.com/posts/why-2026-is-the-tipping-point-for-enterprise-ai-agents/68ef9714e866c71dcdbdfabf/comment/69e6c4acc9501dd0104f6b10) Comment · Article · Apr 21 · [Why 2026 Is the Tipping Point for Enterprise AI Agents](https://hashnode.com/posts/why-2026-is-the-tipping-point-for-enterprise-ai-agents/68ef9714e866c71dcdbdfabf) [Useful builder's perspective. One thing worth adding to the 'what actually works' list: monitoring. When an agent breaks or does something unexpected, having a runtime trace of what it actually did (not just what you told it to do) saves hours of debugging. Behavioral observability is underrated in the builder workflow.](https://hashnode.com/posts/i-built-5-ai-agents-with-claudes-new-builder-tool-heres-what-actually-works-in-2026/69ccf86bcc1311e87202b333/comment/69e6c4acc9501dd0104f6b0b) Comment · Article · Apr 21 · [I Built 5 AI Agents with Claude's New Builder Tool - Here's What Actually Works in 2026](https://hashnode.com/posts/i-built-5-ai-agents-with-claudes-new-builder-tool-heres-what-actually-works-in-2026/69ccf86bcc1311e87202b333) [Good comparison on the capability side. The security angle is the missing piece in most of these benchmarks — what syscalls does each agent make in a standard session? Gemini CLI, Claude Code, and Codex CLI all have different filesystem and network footprints. That behavioral difference matters a lot if you're running these in a corporate dev environment.](https://hashnode.com/posts/openclaw-vs-claude-code-vs-hermes-agent-2026-ai-agent-battle-stability-cost-and-self-learning-compared/69ca83076ea5899ba877ca10/comment/69e6c4a4c9501dd0104f672d) Comment · Article · Apr 21 · [OpenClaw vs Claude Code vs Hermes Agent: 2026 AI Agent Battle - Stability, Cost, and Self-Learning Compared](https://hashnode.com/posts/openclaw-vs-claude-code-vs-hermes-agent-2026-ai-agent-battle-stability-cost-and-self-learning-compared/69ca83076ea5899ba877ca10) [The irony of a security scanner being the supply chain attack vector is exactly the kind of thing that should keep every DevSecOps team up at night. Security tooling runs with elevated privileges by design — it needs to read configs, scan filesystems, access container registries. That makes it a high-value target for supply chain compromise. The Trivy case is a good reminder that your security tools are part of your attack surface, not outside it. Verifying signatures and pinning versions for security dependencies should be treated with the same rigor as production code dependencies, if not more.](https://hashnode.com/posts/from-security-tool-to-credential-stealer-the-teampcp-trivy-supply-chain-compromise/69cf64f821e7d63506cf617d/comment/69d99135c8e5007ddb1b7c5d) Comment · Article · Apr 11 · [From Security Tool to Credential Stealer: The TeamPCP Trivy Supply Chain Attack](https://hashnode.com/posts/from-security-tool-to-credential-stealer-the-teampcp-trivy-supply-chain-compromise/69cf64f821e7d63506cf617d) [This is an important intersection that doesn't get enough attention. AI coding assistants are effectively automating the trust decisions that developers used to make manually — which package to use, which version, whether a dependency is actively maintained. When the model suggests a dependency it saw in training data, there's no guarantee that package hasn't been typosquatted or abandoned since. The compounding risk is that AI-generated code tends to pull in more dependencies than hand-written code because the model optimizes for working solutions, not minimal dependency trees. Every additional package is another node in your attack surface graph. Tools like lockfile auditing and SBOM generation help, but the real gap is at the point of code generation itself — we need runtime and build-time checks that can flag suspicious or unexpected dependency introductions before they ever land in a PR.](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d/comment/69d9901cc8e5007ddb1ab8d7) Comment · Article · Apr 11 · 1 · [AI-Assisted Development Has a Supply Chain Problem](https://hashnode.com/posts/ai-assisted-development-has-a-supply-chain-problem/69d7f382fa7251682ee30a8d) [Really solid layered approach here. The defense-in-depth pipeline diagram is especially useful — too many teams treat prompt injection defense as a single-layer problem (just the system prompt) and miss that you need independent controls at input screening, output validation, and tool privilege boundaries. One thing I'd add: the regex-based input screening is a good first pass, but in practice attackers are moving toward multi-turn injection and encoded payloads (base64, Unicode homoglyphs) that regex misses entirely. The LLM classifier fallback helps, but there's an interesting cost-security tradeoff there since you're now spending tokens on every request just for classification. The RAG source trust scoring is underrated — I've seen production systems where user-uploaded PDFs get the same retrieval weight as internal docs, which is essentially handing attackers a direct line into the context window. Labeling unverified sources in the prompt context is a simple but effective mitigation that more teams should adopt.](https://hashnode.com/posts/secure-by-design-patterns-for-llm-backend-apis/69d76c88fa7251682e73447c/comment/69d98da0c8e5007ddb191fe1) Comment · Article · Apr 10 · 1 · [Secure-by-Design Patterns for LLM-Backend APIs](https://hashnode.com/posts/secure-by-design-patterns-for-llm-backend-apis/69d76c88fa7251682e73447c) [The shell builtin bypass is the detail that makes this really interesting. Most sandbox implementations focus on blocking known-dangerous executables but completely overlook that export, cd, source, and eval are handled by the shell interpreter itself and never show up as process executions. It's the same class of oversight you see in WAFs that filter paths but miss URL-encoded traversals. The cursor-tunnel abuse for C2 is also worth highlighting — legitimate signed binaries being repurposed for persistence is a pattern straight out of the APT playbook (LOLBins), and the fact that it blends with normal dev tunnel traffic makes detection genuinely difficult at the network layer. Curious whether anyone has looked into whether similar builtin-chaining attacks work against other AI coding editors with sandbox models.](https://hashnode.com/posts/nomshub-how-to-check-if-your-mac-was-affected-by-the-cursor-sandbox-escape/69d976a4c8e5007ddb0956e8/comment/69d98c58c8e5007ddb18268a) Comment · Article · Apr 10 · [NomShub: How to Check If Your Mac Was Affected by the Cursor Sandbox Escape](https://hashnode.com/posts/nomshub-how-to-check-if-your-mac-was-affected-by-the-cursor-sandbox-escape/69d976a4c8e5007ddb0956e8)