VibeSec: The Current State of AI-Agent Security and Compliance
Over the past weeks, we've spoken with dozens of developers who are building AI agents and LLM-powered products. The notes below come directly from those conversations and transcripts.
Thoughts, updates, and insights from the Superagent team.
Over the past weeks, we've spoken with dozens of developers who are building AI agents and LLM-powered products. The notes below come directly from those conversations and transcripts.
The gap between a working demo and a reliable product is vast. Andrej Karpathy calls this the 'march of nines' — when every increase in reliability takes as much work as all the previous ones combined. This is the hidden engineering challenge behind every production AI system.
Most agents today rely on large, general-purpose models built to do everything. If your agent has a single, well-defined job, it should also have a model designed for that job. This is the case for small language models: models that handle one task, run locally, and can be retrained as your data evolves.
You've enabled Azure Content Safety or Llama Guard. Your AI agent still isn't secure. Here's why content filtering isn't enough when your AI takes actions.
The past two weeks brought runtime redaction, a powerful CLI, URL whitelisting, and a developer experience that puts security directly in your workflow. Here's what shipped and why it matters for teams building with AI agents.
In 2022, Simon Willison argued that 'adding more AI' was the wrong fix for prompt injection and related failures. He was mostly right at the time. What people tried then were brittle ideas that either overblocked or were easy to trick. This post explains what has changed since, what has not, and why builders can now use AI to meaningfully defend their agents in production.
Get notified when we publish new articles and updates.