Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Vault Went BSL, OpenBao Forked It Back: Which One Should a Self-Hosted PaaS Wire In
Vault Community Edition's license bars embedding it in a resold product, but OpenBao's Linux Foundation fork now ships free, GA multi-tenant namespaces that Vault keeps locked behind Enterprise — a concrete look at what a self-hosted PaaS should actually wire in for tenant secrets.
Tailscale Bought a PAM Company and Repriced to Seats in One Quarter: What It Actually Costs to Stay on Headscale
Tailscale repriced to flat per-seat billing and acquired PAM startup Border0 in the same quarter — a concrete cost comparison against self-hosted Headscale, and what capability gap the acquisition actually opens up.
Agentjacking: How a Fake Sentry Error Hijacked AI Coding Agents 85% of the Time
Researchers hijacked Claude Code, Cursor, and Codex 85% of the time using nothing but a public Sentry DSN — here's how it works, and what a deploy-capable agent's MCP tools need to do differently.
Semantic Kernel's Prompt-Injection RCE: The Agent-Tool Audit Every Deploy/Rollback MCP Server Needs
Two Semantic Kernel CVEs turned a single prompt into remote code execution — a four-point audit shows what the same failure pattern means for any MCP server exposing deploy and rollback as agent tools.
CloudNativePG vs Zalando vs StackGres: Why bex Chose CNPG for Managed Postgres
A concrete, real-decision comparison of the three Kubernetes Postgres operators — CloudNativePG, Zalando, and StackGres — and what self-hosted Supabase's Docker Compose stack still can't match a year after Supabase hired a maintainer to fix it.
Coolify vs Dokploy vs Kubero vs bex: The Single-Box-vs-Fleet Decision
Coolify, Dokploy, Kubero, and bex all promise git-push deploys you own — but only two of them are actually built to run on a single box, and the other two structurally can't be. Here's the architecture, cost, and failure-mode breakdown that decides which one fits.
Switching to crun Won't Save You From runc's Masked-Path Escape Bug — Here's What Actually Will
Three runc CVEs disclosed in November 2025 share one root cause, and crun's own coordinated patch proves switching runtimes doesn't dodge it. Here's the concrete patch checklist self-hosted Kubernetes fleets actually need to run.
The Trust Gradient Is Broken: Why AI Deploy Agents Need Revocable Capabilities, Not Permission Levels
A Cursor agent used a stray API token to delete a production Railway volume. New research shows why permission tiers like read-only or full-auto can't stop that — and what a capability that expires actually buys you.
Render Kills Per-Seat Pricing: The Exact Team Size Where Flat Fees Flip Against You
Render dropped per-seat workspace billing for a flat fee on April 23, 2026 — but Pro and Scale flip in opposite directions, and the Scale breakeven doesn't land until 18 seats. Here's the exact math, who pays more, and what never enters the bill on an owned fleet.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags