CERT-In's advisory on AI agents as attackers: what to fix in your own estate
CERT-In says agents under evaluation reached Indian firms' live systems through exposed credentials. What the advisory asks of teams that run agents.
5 min read
Blog
The SpanDock blog
News, how-tos and researched articles on AI coding tools, agents, MCP, cost and governance, from the SpanDock team.
Coding-agent telemetry now shows who acted and what was stopped
Copilot can now attribute activity to a user without capturing content, and Claude Code logs stopped tool calls. What to collect and how to read it.
OpenAI's 12-hour prompt caching: when the higher write price pays off
OpenAI now offers a 12-hour cache lifetime at 2.5 times the input price. The break-even point, a worked example, and the billing details to check first.
What a low prompt-injection success rate doesn't tell you about an agent
New research finds low attack success rates mostly mean agents ignored injections, and detector rankings don't transfer. How to read these evaluations.
5 min read
FastMCP's October advisories: which versions to run and what upgrading misses
FastMCP published 16 advisories in five days, including client-side code execution. The versions that fix them, and the steps an upgrade won't do.
DeepSeek's 1017 update and the model name that moves under you
DeepSeek swapped the model behind deepseek-flash on 17 October, and legacy names followed. Why aliases change agent behaviour, and how to pin and re-test.
Anthropic user profiles: keeping one customer's ban off your whole platform
Anthropic's new user profiles let platforms attribute API requests to end customers, so enforcement can hit one tenant. What to send, and what is not live yet.
Step-up authorisation in MCP: start agents with minimal scopes
A large MCP server now lets agents connect with minimal OAuth scopes and ask for more mid-task. How the specification's step-up flow works, and what to check.
5 min read
Claude API OpenTelemetry export: what the spans hold and how to count them
Anthropic's API can now send OpenTelemetry spans to your own backend. What the content modes capture, how delivery works, and why token counts need care.
GitHub's package firewall preview: a checkpoint between coding agents and npm
GitHub's package firewall checks npm installs from CI runners and coding agents against age, malware and attestation rules. How it works, and its limits.
6 min read
Anthropic moved its monorepo off Git: what agent-scale merging asks of yours
Anthropic built Scion after daily merges rose from 2,500 to over 30,000. What drove it, what it changed, and which lessons apply to teams that stay on Git.
EN 18286, the first AI Act harmonised standard: what it covers and who needs it
The EU has published its first harmonised standard under the AI Act, for quality management. What a presumption of conformity means and who should act.
6 min read
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Networking (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (1)
- #Skills (1)
- #Testing (1)