Just posted an article on tracking AI Success Rate for software development using Kiro CLI to the AWS Builder Center and my blog. Will pushing it out other places in a bit, teriradichel.substack.com

We need to give pentesters a new name now that everyone is calling AI scanners a “pentester.” Even RSA is doing it. Back to this: Maybe is AI is so great we don’t need CEOs anymore. Only investors. (Sadly, someone is going to take this seriously.) medium.com/cloud-securi...

Sad to hear about Dr. Eric Cole’s passing. 😢 I picked Eric Cole based on his background for my first cybersecurity class. It was well worth it.

Risks Associated With That Software You Just Downloaded How a VS code extension, your music software, third party code, MCP servers and your AI generated code can lead to a major data breach Updated post from my original series on secure code by design teriradichel.substack.com/p/risks-asso...

There are these things called private messages. Sometimes it’s nice to use them if your message is only intended for one person. As some messages should be. One of the reasons I have replies disabled on some other platforms.

When you give your employees access to AI tools how do you know if they are using them for your own code or something else? Are you monitoring prompts and responses?

The AWS builder center has gotten better if you haven’t looked lately. I’m posting my articles if you want to follow me there too. One of my favs: the #awswishlist If you like any of mine please give a thumbs up! Also, life is too short to take myself too seriously 😆 builder.aws.com/community/@t...

Code Structure For An AI Generated Infrastructure Deployment Script How you structure your code makes it more maintainable and possibly consumes less tokens teriradichel.substack.com/p/code-struc...

My Methodology For Writing an Infrastructure Script With AI Agents How I used AI to write code for this project and why my README file probably won't help as much as understanding my approach teriradichel.substack.com/p/my-methodo...

Depending on how many paid subscribers I get may release some of my prompts, videos, rules and error handling. How interesting is this to everyone out there?

Securing Your AI Agent Infrastructure Governance, security, and cost control matter with AI more than ever I’m expanding on the script I wrote in a couple of weeks with AI. teriradichel.substack.com/p/securing-y...

Back home. My dog has now been to over 20 states. I’ve been to all 50 and a bunch of them multiple times. Back to work.

I’m reading about the Canvas breach which runs infrastructure on AWS: Canvas login portals hacked in mass ShinyHunters extortion campaigns. The details are light but from what I can gather they may have used IDOR/BOLA to bypass trust boundary between free and enterprise accounts. Question:

If you were wondering if this affects AWS VMs ~ per Google aimode and AWS documentation: The AWS Nitro System mitigates the Copy Fail vulnerability through architectural isolation, specifically by pinning dedicated physical resources and eliminating shared Dom0 kernel components.

In Deadwood, SD this week a lady on the street told us not to pet the fluffy cows. My husband then had to buy this hat. Seeing a lot of fluffy content about AI. 🤖 I’d like to see more deep dives on data flows at all layers of AI products. It seems harmless but is it?

I have to take care of a family member. Headed out to help her for I don’t know how long but hope to be working on AI again soon. Trying to enjoy the scenery along the way waiting for her to get back home.

Since when is it ok to have production applications and critical development platforms to randomly work or not work or produce such varying levels of quality?

Well sometimes life throws a curve ball. Working on some new research but have to take care of a family member so will be a little sporadic.

I noticed the person who suggested I was drinking when I posted these trying to figure out what was wrong with Opus 4.6 has deleted his comment. 😁 Some of us have spidey sense from doing this way too long. When you know you know. Glad they fixed it.

You can architect a solution that uses AI without giving it all your credentials. Here’s how.

Reducing Token Burn Rate With A Well-Designed Architecture Trying to put out the AI token fire - or at least manage it as a controlled burn by using deterministic scripts for gathering inputs and directing agents teriradichel.substack.com/p/reducing-t...

I spoke about mistakes in this video. Make sure you add correction text so you don’t reinforce the mistakes.

BlueSky needs to allow edits and longer posts, or at least do what Threads does and break posts into multiple posts if someone enters one that is too long. Such a pain I post less here.

AWS VPC Endpoints are so complicated and expensive but I really want to use them. They provide a unique level of security that a NAT does not replicate. The problem is the rabbit hole you end up going down after you think you are “just” going to add the free gateway endpoints.

Claude pricing changing to pay per token. This makes sense as long as value per token remains consistent. This will make it difficult to compare to prior performance and I wonder how users can transparently measure the usage. platform.claude.com/docs/en/abou...

AWS Secrets Manager now supports hybrid post-quantum TLS to protect secrets from quantum threats - AWS aws.amazon.com/about-aws/wh...

AWS needs to extend CloudWatch with tools that make it a real SIEM. Don’t overlay it with complexities it doesn’t need. Just extend it.

This post is not about Mythos capabilities because I can’t know until I try it. Opus 4.6 was great until is changed and I presume Mythos is better. These are questions I have about AI risks for businesses that rely on it that I don’t see anyone else asking - or answering.

There are varying levels of exploits in terms of complexity but technically my fuzzer at RSA 2020 generated exploits. Without AI. It produced a working script and performed attacks. I did review manually. But I have so many more ideas for that fuzzer with and without AI - bound by time and compute.

Anthropic Mythos ~ Anthropic released a new model they claim is scary good at finding security vulnerabilities. What questions should we be asking? This is not a hot take. I’m just pondering how much we can trust a model, the purported ROI, and how we can evaluate the risk of relying on it.

I am looking at messages in Google Developer tools and it is saying cdn.tailwindcss.com should not be used in production so if you are…. tailwindcss.com/docs/insrall...

I’ve added links to my presentation on how I use AI 🤖 for pentesting 😈 in this post. Most of the slides have a related blog post and I’ll probably write more about all these topics as I research this further. The PDF has links to related posts. teriradichel.substack.com/p/how-i-use-...

Awesome video on S3 files youtu.be/zb8TdNJhZCk

The Computer History Museum is such an awesome place for a conference. Thanks to everyone who came to the AWS Community Day!

🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖 Pentesting is not a scanner or a fuzzer - whether SAST, DAST, AI, deterministic or non-deterministic. Pentesting is a human * using those tools * to see if they can find a security problem that your teams and tools may have missed. 🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖

I read all the Mythos hype right before I submitted my talk for today at the Computer History Museum. Did I need to change my slides? Nope.

Wonder if this has anything to do with performance degradation of anthropic models. But are you now paying more for same effort you were getting previously if you change this? * Default Shift: In March 2026…

FBI: Americans lost a record $21 billion to cybercrime last year www.bleepingcomputer.com/news/securit...

I was just listening to an interview on the radio with a person who worked at a hospital. 1. Your cyber insurance makes you a target. They know how much you can pay.

Iran has rapidly developed advanced cyber capabilities, evolving from information gathering to conducting destructive, state-linked attacks against critical infrastructure in the U.S., Israel, and the Gulf states. Read: share.google/aimode/50qKf...

How I Use AI for Penetration Testing Speaking at the Computer History Museum in Mountain View, CA April 10, 2026 teriradichel.substack.com/p/how-i-use-...

What happened to Claud Opus? I’m seeing highly respected researchers saying the same as me. One of them has switched to Codex.

ChatGPT DNS leak ~ possible C2 channel or DNS exfiltration. Data exposure in cursor via branch name. thehackernews.com/2026/03/open...

Seeing reports for similar issues with another vendor being called “vulnerabilities”

Wondering why I logged into an account and seeing a bunch of errors for something I don’t use in cloudtrail: codecomnections.amazonaws.com. GetSyncConfiguration. Resource not found…. So I ask and it’s coming from Cloudtrail. Code should be checking if the resource exists before trying to access it.

Latest scam. Interesting that when I used Apple cleanup to remove the ticket number it didn’t remove it but instead characters from another Arabic looking language showed up instead. This came as an attachment. Took screenshot. I did the cleanup like 5 times and then chars gone.

Note: As part of the analyzed intrusions, public-facing applications and valid accounts were abused for initial access. www.securityweek.com/chinese-hack...

I just wrote this post about DNS leaks and tunnels. So today I go to visit a web are and my host-based firewall is popping up repeatedly connection attempts to the website like it’s beaconing to maintain a connection. So at first I’m grumbling about whatever on the web site is doing that but…