Weekly Recon #9: Untrusted by Invitation

The agent era moves trust to both ends of the wire: the skills you install run as untrusted code, the scanners that vet them are theater, and the agents attackers run find your bugs faster than you do.

Weekly Recon #8: Borrowed Trust

Attackers ride the primitives you already trust: a poisoned official Claude Code Action, your own AWS domains as C2, your coding agent's tool calls

Weekly Recon #7: Machine Speed

Weekly Recon #6: False Assurance

Theme: False assurance failures, controls misread as boundaries

Weekly Recon #5: Hijacked Execution Context

Developers trust tooling that does not earn it. Three acts this week.

Weekly Recon #4: The patch window closed. The registry pushed back.

Theme: Weaponization speed & identity blast radius

Weekly Recon #3: AuthZ said deny. The parser said yes.

Theme: Sandbox & Control-Plane Isolation

Weekly Recon #2: The identity acting is not the identity you think

Theme: Agent & Bot Identity

Weekly Recon #1: The agent runs under its own AWS role, not yours

Theme: Cloud & Agent IAM