Beads

Agentic Security: Permissions, Provenance, and the Agent Supply Chain — Steve Yegge, Gas Town

Jul 20, 2026 · 22:32

Steve Yegge argues that AI-written code will dramatically increase security vulnerabilities unless developers adopt a separate security pass using tools like Snyk and Chainguard. He shares a bank architect's insight that shipping 10x faster with the same defect rate produces a 10x vulnerability surface, made worse by models writing code. Yegge demonstrates the gap by noting Fable's security hardening missed 241 vulnerabilities that Snyk found in his 30-year-old game. He warns of new attack surfaces like slop squatting, where models hallucinate package names that attackers then backfill with malicious versions. Yegge advocates for multiple passes—correctness, then security—and urges incorporating tools into agent workflows. He also cautions that Five Eyes predicts open-source models will autonomously hack production systems within months, and that personal scams using AI-generated voice and video are imminent.

Ralph Loops: Build Dumb AI Loops That Ship — Chris Parsons, Cherrypick

May 4, 2026 · 1:48:26

Chris Parsons argues that dumb loops—simple while loops where an AI agent repeatedly executes the same task, evaluates its output, and iterates—outperform complex multi-agent orchestration and planning graphs. In this hands-on workshop, he builds a Pomodoro timer using Claude Code, implementing tickets one by one in a loop that self-corrects with each pass. He demonstrates the 'loop' command in Claude Code for scheduled, continuous execution and shows how to use sub-agents for adversarial validation to avoid self-confirmation bias. The talk covers real-world applications such as a worker loop that processes project steps overnight and a morning loop that generates daily briefings, all designed to offload routine work while keeping human oversight for irreversible decisions. Parsons emphasizes that the bottleneck in AI-augmented teams is often the review process, not coding speed, urging teams to identify and fix their biggest constraint first.