Writing

Writing

Two long essays on the things I keep running into: who stays accountable when an AI does the work, and the security failures that ride along with AI-written code. Plus work published elsewhere.

Essays

Who is accountable when the model is wrong?
AI can be Responsible for the work. It can never be Accountable for it. Designing that distinction into the system, with a RACI lens, is most of the job.
The security holes AI coding tools leave behind
I spent a decade breaking applications before I started building one with AI. The failures are not exotic. They are the same failures, arriving faster.

Elsewhere

TRM Labs · August 2025
Scaling Security in the Age of AI: How TRM Labs Built Self-Improving Vulnerability Agents with Reinforcement Learning
How TRM built an agent that opens production pull requests against critical vulnerabilities across 150+ repositories, then uses reinforcement learning on the outcomes to get better at it. The same accountability problem I write about here, at the other end: the model does the remediation, a human still merges.
Co-authored with Carlo Jessurun and Jayson Franklin