https://www.ashimmahara.com/tags/ai-agents/Recent content in Ai-Agents on Ashim MaharaHugoen-usWed, 29 Jul 2026 02:12:49 -0400https://www.ashimmahara.com/writing/huggingface_incident/Tue, 28 Jul 2026 00:00:00 +0000https://www.ashimmahara.com/writing/huggingface_incident/<p>An agent autonomously hacked into HuggingFace&rsquo;s infrastructure last week. In my humble opinion, this is perhaps the first major case of cyber misalignment at APT scale in terms of depth-of-access and trade-craft, but what it did not possess was the stealthiness and patience required for ensuring long-term access and goal achievement. The silver lining: it wasn&rsquo;t misaligned, or capable, enough to hide its own footprints, and that margin narrows as cyber capabilities develop further.</p>https://www.ashimmahara.com/writing/terminal_mcp_honeypot/Thu, 19 Feb 2026 00:00:00 +0000https://www.ashimmahara.com/writing/terminal_mcp_honeypot/<p>Sooo, it was quite interesting to see that there is a <code>docker diff</code> command in the <a href="https://docker-py.readthedocs.io/en/stable/containers.html#docker.models.containers.Container.diff">docker-py</a> sdk. This immediately piqued my curiousity around the possible use-cases of the feature. One thought that immediately came to me was <code>honeypots</code>.</p> <h2 id="honeypots">Honeypots</h2> <p>Honeypots - and honeytokens / canary tokens - are quite possibly the greatest ROI tool in the defensive cybersecurity realm. Their main goal is to capture attacker tradecraft and provide signals around trends in global security like data collected at scale by companies like <a href="https://www.greynoise.io/">GreyNoise</a>. In comparison, honeytokens/ canary tokens (<a href="https://www.securityengineering.dev/the-beginners-guide-to-honeytokens-aka-canary-tokens/">article from security engineering.dev</a>) are used as an early detection mechanism that provide early alerts.</p>