Mihir Ajmera

WRITING

Findings from real tests, for the people who sign off on AI

Essays are long-form research with evidence. Notes are short: one finding, one control or one idea a day.

11 PIECES

  1. A regulator just wrote the audit program for AI agents

    Hong Kong's banking regulator published a discussion paper on governing AI agents in banks. It creates no new rules, but almost every section ends with a "practical test" an auditor can run tomorrow. Here are the tests, and what they mean outside banking.

    ESSAY

  2. Nine platforms, one target: the AI keys you handed them

    Wiz counts nine breaches of AI developer platforms in October, ending with Northflank telling customers to assume every environment variable was decrypted. There's no single vulnerability behind them. The common thread is what attackers came for, and the controls that decide how much it costs you are on your side, not the vendor's.

    ESSAY

  3. Could you name the laptops that installed it? The Claude Code extension backdoor, read as an auditor

    For about eleven hours on October 29, Cursor's extension marketplace served a tampered build of the Claude Code extension that planted an SSH key and persistence on developer machines. The payload is ordinary. The control questions it raises about developer endpoints are not, and most teams can't answer the first one.

    ESSAY

  4. Deleting the commit didn't revoke the key: the LiteLLM root cause, read as an auditor

    LiteLLM has published the real root cause of the October 21 release compromise. A master key leaked in May, the commit was rewritten but the key was never revoked, and 136 days later it unlocked an agent platform holding an org owner's GitHub token. Four control failures, and what to test for each.

    ESSAY

  5. Decide who takes it offline before the advisory lands

    PHP2Shell was exploited four days before disclosure, and some vendors still had no fix a day after it. The decisions that mattered that week can't be made well in the moment. Here are three to write down per system now, with a one-row template.

    ESSAY

  6. The banks just ran an access review on AI agents. Here's what they found.

    America's biggest banks are blocking outside AI agents from customer accounts. The reason isn't that agents are dangerous. It's that an agent using your password is indistinguishable from you, and every control downstream depends on knowing who acted.

    ESSAY

  7. Your patch SLA was written for a slower attacker: what PHP2Shell teaches about vulnerability governance in the AI era

    AI helped find two critical PHP flaws, and AI helped attackers weaponize them within hours. The 30-day patch window in most compliance programs assumes a world that ended this week.

    ESSAY

  8. The AI gateway is a crown jewel: what the LiteLLM compromise teaches about governing AI infrastructure

    For about two hours on October 21, the official LiteLLM release stole credentials from everyone who installed it. It was signed, approved and published by the real pipeline. Every control worked as designed, and that's the lesson.

    ESSAY

  9. What the official MCP READMEs teach you to copy

    I scanned the configuration examples from 9 widely used MCP server READMEs. No single one is dangerous. Pasted together, they build an exfiltration path.

    ESSAY

  10. Twelve clean results is not a pass

    Zero failures sounds like proof. With a small sample, it mostly tells you how little you tested. What auditors already know about sampling, applied to AI red-teaming.

    ESSAY

  11. I red-teamed an LLM. Then I audited the red-team.

    1,280 garak attacks against Llama 3.2 3B, turned into audit evidence, and what a hand review of that evidence found about the detector itself.

    ESSAY