Topical Takes
Short, opinionated posts on eBPF, Linux internals, and the tools we all run in production.
How to Let an AI Agent Fix Something in Production Safely (2026)
A fix and an incident are the same syscalls, so the question is not whether the agent is trustworthy but what it can reach, what you can undo, and what you can prove afterward. What Replit's own documentation changed after an agent deleted a production database during a code freeze, why an instruction is not a control, and how to keep a record of an agent's changes that the agent did not write.
How Do I Let an AI Agent Inspect a Linux Server Safely? (2026)
Four ways to give an AI agent access to a Linux server it does not own, compared on what each one actually grants: an SSH account, a read-only user with sudo rules, a container alongside the workload, and a daemon that answers queries without handing over a login. What breaks in each, and why the capabilities that make inspection useful are also the ones that let an agent write.
How to Run AI Agents Locally on Linux (2026)
Running an AI coding agent locally means the agent process is yours and the model usually is not. How to set up Claude Code, Codex or an offline model on Linux, what the sandbox defaults actually allow, which parts of the loop still make network calls, and how to see what the agent did on your box when its own log stops at the shell.
AI Agents on Linux in 2026: Two Threat Models, and the One Your Stack Probably Isn't Solving
Confidential computing protects an agent from the infrastructure it runs on. Nothing in that stack protects your infrastructure from the agent. Two threat models with opposite trust assumptions get sold under one phrase, and the tell is which direction the isolation points. How to tell which problem you actually have, and what the kernel can record that an agent's own telemetry cannot.
Can an AI Coding Agent Exfiltrate My Source Code? What a Domain Allowlist Decides, and What It Doesn't (2026)
A domain allowlist decides whether a connection may open, not what goes through it, and the proxy in front of your agent does not read TLS by default. Here are the six ways to control agent egress on Linux in 2026, what each one covers, and how to see every host your agent dialed with claudefeed.
How to Audit a Local MCP Server on Linux: The Tool Call Is the Request, Not the Record (2026)
An MCP server on the stdio transport is a subprocess your agent launches, running as your user with your full filesystem and network access. Your agent's log records the tool call, not the syscalls the server ran. Here is how to audit one on Linux in 2026, with claudefeed and exectop.
How to Sandbox and Monitor an AI Agent on Linux in 2026: Why a Proxy Can't Tell You Which Process Spoke
Five questions about an AI coding agent's egress that a MITM proxy, a container and an HTTPS_PROXY variable structurally cannot answer, ranked by how much of the answer survives the agent doing something you did not anticipate. Compared against AgentSight, Claude Code's built-in proxy, Dev Proxy, Landlock and microVMs, with the kernel hook that answers each and what it costs to run.
How to Audit What an AI Coding Agent Actually Ran on Linux in 2026: The Log Stops Where the Shell Begins
Claude Code, Codex and Cursor all log their tool calls, and Anthropic documents the boundary in its own docs: OTEL_* is never passed to the subprocesses the Bash tool spawns. Compare what OpenTelemetry, an MCP gateway, auditd, strace and a kernel probe each record when an agent runs a shell one-liner, and see which one can name the commands underneath it.
How to Sandbox an AI Coding Agent on Linux in 2026: What the Kernel Can Refuse That Permissions Only Ask About
Claude Code, Codex, Aider and self-hosted agents run with your full filesystem access and choose what to read on their own — here are the six real ways to confine one, what each actually covers, and why the built-in sandboxes govern shell commands rather than the agent's own file reads.