Technical blog covering cybersecurity, network engineering, infrastructure automation, and AI agent architecture. Written from hands-on experience building SOC platforms, homelab infrastructure, and agentic systems.
Brigade 0.26.0 and 0.26.1 shipped in four days. From August 4 through August 10, I merged 100 pull requests while a fleet of cloud builders helped turn my operating workflow into the first pieces of 0.27.0. The week ended away from the feeds, with the kids and family, during their last weekend of summer.
Brigade 0.26.0 remains gated while fresh checks close quiet failure modes. BrigadeClaw gained bounded retrieval, and Meme Roster turned 525 researched entries into a searchable local library of 492 distinct formats.
This week I folded GraphTrail's Rust code graph, MiseLedger's Go evidence ledger, and agent-notify into Brigade, turning three repositories into one product without flattening the engines underneath. Around that work I put T3 dispatch agents on three machines, started replacing Brigade's overwritten run snapshots with a chained append-only journal, kept a public agent offline after a failed gate,…
Two real failures from six months of running an always-on agent memory system: a nightly job that silently truncated the agent's memory index for weeks, and 195 handoff notes nobody was reading. The rules that came out of the scar tissue.
Two failure classes in five days: a merge queue correctness bug that mutated default branches and an Elasticsearch overload that emptied PR lists. GitHub's growth story is real, but the engineering debt is the buried lede.
GPT-5.5 is less interesting as a chatbot upgrade than as OpenAI's bet on Codex, computer use, long-running tool work, and enterprise agents. The launch is impressive, but the honest read has caveats around cost, routing, safety, and real developer workflows.
Anthropic's April 23 postmortem says the recent Claude Code quality slump was not a model regression. The failures were in the harness: defaults, session-state handling, and a prompt-layer change that quietly hurt coding quality.
Anthropic cut off third-party harness subscription coverage, Claude CLI reuse turned into a classifier mess, and a lot of OpenClaw users walked away. I rebuilt mine around GPT 5.4, strict agent lanes, local-first retrieval, and a pile of ugly fixes.
I ran OpenClaw Dreaming for a full week on top of my existing memory stack. It found real signal, surfaced a lot of junk, and made one thing clear: structured memory is still the foundation.
OpenAI and Anthropic are not just shipping cyber-capable models. They are pushing different ideas about who should get access, and that matters more to defenders than the launch-day hype.
Anthropic says Mythos can autonomously find and exploit serious software flaws across major operating systems and browsers. Here’s what the official launch materials actually say, and what cyber defenders and threat intel teams need to do with that information.
North Korean actors backdoored the Axios npm package on March 31. Here's the full attack chain, how to check if you're affected, and exactly what to do about it.
Anthropic's Claude Code source leak exposed far more than implementation details. It exposed roadmap, trust assumptions, and how brittle npm security has become.
Most threat intel workflows still force you through too many screens for one simple IOC question. I built misp-mcp so an agent can ask MISP directly, with tighter tool surfaces, better visibility, and shipping-grade test coverage.
How I replaced SCCM with FOG Project for 72 lab workstations, fought Debian Trixie installer bugs, fixed PXE boot on newer hardware, and built a repeatable Windows 11 imaging pipeline.
What I learned building MCP servers for Wazuh, Suricata, Zeek, TheHive, MISP, and more. The real challenge was not the protocol.
A practical look at the memory architecture I use in OpenClaw, what was already working, where it was weak, and the config changes that made long sessions much more reliable.
Why single-thread messengers like Telegram and Signal are holding back your OpenClaw setup, and how Discord's channel model fixes context contamination, cron confusion, and project sprawl.
How I built a local-first semantic code search API using FastAPI, SQLite, and Ollama embeddings to make retrieval fast, free, and private.
My AI orchestrator couldn't see its own subagent's results. Auto-announce sent outputs to the wrong place, truncated them, and required manual intervention. Here's how one API call fixed everything.
I tried to use GPT 5.3 Codex to summarize 70,000 code chunks. It reported phantom token usage that didn't exist. Here's what actually happened and how Ollama cloud models saved the project.
Domain controllers, file servers, network monitoring, imaging, WiFi controllers. All of it moved from Microsoft to open source. No downtime. No data loss. Here's the complete playbook.
How I built a system prompt injection hook that forces my AI agent to check local APIs before burning cloud tokens, then iterated through three coder models to find one that actually works.
Why AGENTS.md instructions fail when AI agents can bypass them. How git pre-push hooks enforce real constraints on autonomous coding agents.
The real story of building an AI agent memory system. From Kimi K2.5 blowing through tokens to local semantic search with Ollama. Every mistake, every fix.
A current OpenClaw multi-model setup using the Codex harness on GPT-5.6 as the main lane, focused harness subagents, Ollama for embeddings, Ollama Cloud for cheap offload, a Cursor subscription overflow lane, Grok / xAI as an optional provider tier, OpenClaw image generation with gpt-image-2, browser research tools, and Opus 4.8 ACP escalation.
Your AI agent has access to your email, calendar, and files. Here's how to lock it down properly, from baseline security to zero-trust architecture.
A complete, battle-tested guide to running OpenClaw on Windows via WSL2. Every gotcha, every fix, every thing the docs don't tell you.
A fiber cut at 2 PM exposed gaps in our network monitoring. So I built Watchtower, a real-time NOC dashboard integrating LibreNMS, InfluxDB, and FastAPI.
How I designed and deployed a full open-source SOC with Wazuh, TheHive, Cortex, MISP, Zeek, and Suricata for a network engineering lab, plus the integration work that made it usable.
Broadcom's per-core licensing made a working VMware cluster financially indefensible. The hypervisor swap was the easy part. Pulling pods over the WAN and a Proxmox 9 upgrade that blew the whole thing up are the parts worth reading about.
What NDG's 18-hour Proxmox VE 8 workshop actually taught me about storage, clustering, NETLAB+, Windows 11, backups, and building an academic lab environment that survives real use.
Building a structured analysis tool for intelligence work. Analysis of Competing Hypotheses, evidence weighting, and fighting cognitive bias with software.
Building an automated threat intelligence tool that delivers BLUF briefings with MITRE ATT&CK mapping, IOC extraction, and multi-source aggregation.
Building an incident response playbook generator that creates NIST-aligned, role-specific runbooks. Because nobody reads the binder during an actual incident.