We gave hundreds of developers an AI agent that can run shell commands, edit files, and call MCP servers on their laptops.

Then we realized we had no record of what it actually did.

So we built one.

1 bash script, 280 lines, no dependencies. Cursor hooks fire it on every tool call. Elastic Agent ships the log to Elasticsearch.

Since the May rollout: 13M+ tool-call events across 1,100+ machines.

What the data showed:
- File reads outnumber shell commands roughly 4 to 1: agents mostly read your codebase before acting
- 300+ distinct MCP servers in use, 86% of them by only 1 or 2 people
- The CLI surface alone produced nearly a fifth of all events

"Which hosts ran an agent that read a .pem file last week?" is now 1 ES|QL query.

We log commands, paths, and tool names. Never file contents, prompts, or responses.

Full writeup from Wieger van der Meulen on the InfoSec team: the collector script, hooks.json, the 2 deployment gotchas that cost the most time, and the ES|QL hunting queries.

https://go.es.io/4wHDZID

Courtesy of @stevelord:

https://stwipe.com/

This is the next-gen, value-aligned, over the horizon, into the abyss company I've been looking for, to waste my money on.

for the #emacs folks re: https://www.openwall.com/lists/oss-security/2026/08/21/1 ... to be clear: the implication here is that if you e.g. navigate a malicious git repo with dired (just opening the dir is enough) these bugs result in arbitrary command execution, because dired will stat the files by default ... so definitely pick up these fixes if you can 👍

@kagihq 's "small web" experiment kicked off 3 years ago with about 6,000 vetted human-written non-commercial blogs and is now up to almost 37,000. I would love to know how it's going: https://blog.kagi.com/small-web

@unchartedworlds or you could lead by example and steel-man my position?

@unchartedworlds then maybe help me better understand your position?

@unchartedworlds Not sure how quoting myself helped, but glad it did.

"- implicit consent vs explicit consent"

Do I understand correctly that you think requirements for consent are/should be the same on Fedi as they are on a city street?

"- context & scale as factors."

Do I understand correctly that you think Fedi and a city street are similar in how many people you meet, how many of them are familiar/stranger to you (scale) and that people participate in the street traffic in a similar capacity as they do in the Fediverse (context)?

@wdormann @malwaretech See, this removes friction! We should be thankful.

CVE Crowd's search feature is now public!

This means you can now search for vendors, products, package names or CVE numbers and find related posts on the Fediverse and Bluesky - all without signing up anymore.

Previously, I used sign up as an obstacle for bots. But since #ALTCHA proved good enough to keep those away, it now also secures search.

I hope this is useful to y'all!

https://cvecrowd.com

#Pentesting #AppSec #InfoSec #CyberSecurity #BugBounty #Hacking #CVE #CveCrowd

OMG did @jerry just update Akkoma so we now have enhanced search? 😍

Thank you!

@infosecdj Right??

I'm on this picture and don't like it.

...If anybody's looking for a person who basically does everything from compiler {backend,frontend} development, GPU driver development, to hardware/firmware security research, let me know. #getfedihired

US only.

@0v1 Parser generators: are we a joke to you?!

@unchartedworlds

My Step 1.: "My understanding is ..."

My Step 2.: "I'm genuinely curious if there's any point I miss"

Waiting for you to take Step 3.

@unchartedworlds TIL about steel-manning, it really sounds useful! When it comes to analogies though I think it may not be the right tool because arguing against an analogy requires to point out exactly where it breaks down instead of focusing on where it confirms the opposing argument. For example I could argue that it's fine to take pictures of birds on the street, but this would be an obviously bad argument for stalking people because people are not birds.

I described how I interpreted your analogy, I think this is as far as I can get describing what I think you think (lacking psychic abilities).

I also tried to explain our differences in thinking, and I'm genuinely curious if there's any point I miss (where I didn't manage to steel-man enough)!

@Viss @wdormann @cR0w yeah I'd be very interested in a deeplik :popcorn:

RE: https://mastodon.social/@campuscodi/117128474535423979

Ah, I get it now. They are doing the same thing to CISA that they did to 18F and login.gov - kill off perfectly functional (in fact, superior, non-partisan, cost-effective) public tech infrastructure so it can be privatized by attrition. The classic "starve it, then declare it ineffective" tactic. 😠

PSA: if you have a website or a blog, you can use Google Search Console to turn off the use of your site in AI overviews. You get multiple scary warnings if you try. I was curious what's the actual impact on site traffic, so I turned it off. It went from ~1k AI summaries a day to zero, with no measurable impact on visits to the site.

"You never can tell with bees."