Wes

gametheory

[GAME THEORY] The Agent Did Not Hack You. The Connector Did.

MCP is not just an AI security story. It may be the first real test of agent connector supply-chain risk.

weekly

[SIGNALS WEEKLY] Perimeter Pressure, Supply Chain Drift, and Identity Theft

The perimeter blinked. VPN portals and CI tokens are still doing incident cosplay.

forecasts

[FORECAST] Fake Hires, Real Access

Forecasting is not fortune-telling. It is how defenders turn messy signals into better questions.

gametheory

[GAME THEORY] Your AI Agent Remembered the Secret. So Did the Attacker.

AI agents are becoming useful because they remember. That also means they are quietly becoming data stores.

weekly

[SIGNALS WEEKLY] Shifting Extortion Tactics and Fragile Software Supply Chains

The pipeline had keys. Nx Console and Megalodon are the same warning: your CI/CD workflow may be production access wearing YAML pajamas. CI/CD is not “just automation.”

forecasts

[FORECAST] The next secret-stealing campaign may start with a tool you trusted

AI coding tools are becoming trusted middlemen. That gives defenders a new attack path to understand before it gets ugly.

breach

[BREACH] The Extension Had the Keys

The plugin had keys. A VS Code extension sat beside repos, tokens, terminals, and AI configs. That is not just productivity. That is inherited access.

weekly

[SIGNALS WEEKLY] Tokens, Edges, and Exploits: Shifting Paths to Compromise

The token survived. npm packages, CI/CD runners, and edge boxes keep turning “contained” into “still owned.” The boring weakness became the breach path.

gametheory

[GAME THEORY] AI-agent spoofing is becoming a claim-vs-proof problem

Known AI agents are becoming trusted traffic. The first defender move is finding claims without proof.

forecasts

[FORECAST] The Threat Was Real. The Public Proof Probably Falls Short (Final: 2026-05-21)

The forecast likely resolves No, but the useful lesson is where Iran-linked operators still depend on access defenders can pressure.

weekly

[SIGNALS WEEKLY] Identity-First Intrusions and AI-Driven Attack Surface Shifts

The login was real. The control plane did the rest. Storm-2949 is the ugly part: one Entra ID identity can turn into SaaS theft and Azure abuse. Nobody owns this until incident day.

podcast

[PODCAST] ANALYST YELLS AT CLOUD

Get closer to the people who understand where threat actors are today — and where they are likely headed tomorrow.