Liran Tal is an AI security researcher and Node.js security expert focusing on securing agentic AI workflows, MCP, and software supply chains through research, education, and open-source work.
228 articles from this blog
A practical guide to building an LLM-operated Markdown knowledge graph for a second brain, focusing on structure, workflows, and maintenance.
Explore building a second brain with LLMs and AI agents, focusing on durable context systems for knowledge work.
Unicode tag characters can hide instructions in AI agent skill files, demonstrated by hijacking Gemini CLI to execute hidden commands.
Explains how to build robust agent workflows by coordinating with state ownership instead of relying on timing, using a Codex migration example.
A tutorial on creating portable dotfiles using chezmoi, Homebrew Bundle, and a public repo for reproducible terminal setups.
Analysis of DevRel evolution from 2020 to 2026, focusing on thematic shifts, product-centric advocacy, and the impact of coding agents.
Explores how coding agents boost productivity but require strong technical skills to use effectively, debunking the myth that AI replaces developers.
Explores whether prompt injection in AI systems is an unsolvable structural problem or just an unfixed vulnerability.
Introduces APM, an npm-inspired Agent Package Manager from Microsoft for managing AI agent dependencies like skills and MCP servers.
Guide on validating Fastify configuration using @fastify/env, dotenv, and env-schema for type-safe environment variables.
Explains Cursor agent hooks for running lint and build checks after each AI coding turn, enabling self-healing loops.
Analysis of structural failure modes when using LLMs as security scanners in agentic workflows, with measurement ideas and evidence.
Analysis of flaky Jest tests caused by wall-clock assertions on timer behavior, with solutions using fake timers.
Guide to building a benchmarking framework for AI coding agents using Claude's Agent SDK, focusing on security tasks.
Exploring agentic growthhacking tactics using AI bots to automate lead scoring, sales alerts, and sourcing user pain points on social media.
A technical guide for implementing secure direct browser uploads/downloads to Cloudflare R2 using pre-signed URLs generated by a Hono.js API on Cloudflare Workers.
A guide to implementing secure file uploads using Cloudflare R2 storage and the Hono framework, focusing on pre-signed URLs.
Explains the Model Context Protocol (MCP) by drawing parallels to RESTful HTTP architecture, using a travel planner server example.
A framework for evaluating security threats and risks in Model Context Protocol (MCP) implementations, based on recent incidents.
Analysis of a security attack exploiting toxic flows in the Model Context Protocol (MCP) to target Cursor IDE users via Jira tickets.
